CVE-2026-69657 | Critical | 9.8 | 2026-09-04 | XING CPTrans-ME-X contains a Use of Default Password (CWE-1393). Anyone with the knowledge of the credential may log in to the affected device. |
CVE-2026-82698 | Medium | 5.3 | 2026-08-31 | A vulnerability was detected in sambitraj Student-Management-System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. This affects an unknown function of the fil… |
CVE-2026-19851 | High | 7.7 | 2026-08-25 | A Use of Default Password vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to gain access to user accounts crea… |
CVE-2026-16504 | Critical | 9.8 | 2026-07-31 | Deployment of the VPS.org one-click Zulip template deploys a hardcoded application signing key, a default database password ("zulip"), and DISABLE_HTTPS=True. |
CVE-2026-16503 | Critical | 9.1 | 2026-07-31 | Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all interfaces (0.0.0.0:5432) with a default database… |
CVE-2026-5269 | Critical | 9.8 | 2026-07-14 | In Ciena's Navigator Network Control Suite (NCS) and Manage Control Plan (MCP), there are hidden system accounts used for internal software operations. Some of… |
CVE-2026-54445 | | | 2026-06-17 | vantage6 is an open-source infrastructure for privacy preserving analysis. Versions prior to 5.0.0 provide an initial user with username `root` and password `r… |
CVE-2026-35075 | Critical | 9.8 | 2026-06-03 | An unauthenticated remote attacker can recover a default, hard coded password from a firmware image and thus gain full access to all affected devices. |
CVE-2026-8672 | Medium | 5.1 | 2026-05-22 | Use of default password vulnerability in syslink software AG Avantra on Linux, Windows allows Try Common or Default Usernames and Passwords.
This issue affect… |
CVE-2026-33784 | Critical | 9.8 | 2026-04-09 | A Use of Default Password vulnerability in the Juniper Networks
Support Insights (JSI)
Virtual Lightweight Collector (vLWC) allows an unauthenticated, netw… |
CVE-2025-14917 | Medium | 6.7 | 2026-03-25 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.3 IBM WebSphere Application Server Liberty could provide weaker than expected security when… |
CVE-2026-4404 | Critical | 9.4 | 2026-03-23 | Use of hard coded credentials in GoHarbor Harbor version 2.15.0 and below, allows attackers to use the default password and gain access to the web UI. |
CVE-2026-22886 | Critical | 9.8 | 2026-03-03 | OpenMQ exposes a TCP-based management service (imqbrokerd) that by default requires
authentication. However, the product ships with a default administrative ac… |
CVE-2026-3186 | Medium | 6.3 | 2026-02-25 | A vulnerability was determined in feiyuchuixue sz-boot-parent up to 1.3.2-beta. Affected by this vulnerability is an unknown functionality of the file /api/adm… |
CVE-2026-2635 | High | 7.3 | 2026-02-20 | MLflow Use of Default Password Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installatio… |
CVE-2026-24429 | Critical | 9.8 | 2026-01-26 | Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) ship with a predefined default password for a built-in authentication account th… |
CVE-2025-66050 | Critical | 9.8 | 2026-01-09 | Vivotek IP7137 camera with firmware version 0200a by default dos not require to provide any password when logging in as an administrator. While it is possible… |
CVE-2025-8077 | Critical | 9.8 | 2025-09-17 | A vulnerability exists in NeuVector versions up to and including 5.4.5, where a fixed string is used as the default password for the built-in `admin` account… |
CVE-2025-43799 | Medium | 6.5 | 2025-09-15 | Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and 7… |
CVE-2025-9589 | Low | 2.5 | 2025-08-28 | A vulnerability was determined in Cudy WR1200EA 2.3.7-20250113-121810. Affected is an unknown function of the file /etc/shadow. Executing manipulation can lead… |
CVE-2025-43021 | Medium | 5.7 | 2025-07-22 | A potential security vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.1. The vulnerability could allow the use and ret… |
CVE-2025-2766 | High | 8.8 | 2025-06-06 | 70mai A510 Use of Default Password Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affect… |
CVE-2024-13966 | High | 7.3 | 2025-05-27 | ZKTeco BioTime allows unauthenticated attackers to enumerate usernames and log in as any user with a password unchanged from the default value '123456'. Users… |
CVE-2025-27690 | Critical | 9.8 | 2025-04-10 | Dell PowerScale OneFS, versions 9.5.0.0 through 9.10.1.0, contains a use of default password vulnerability. An unauthenticated attacker with remote access coul… |
CVE-2025-22938 | Critical | 9.8 | 2025-03-31 | Adtran 411 ONT L80.00.0011.M2 was discovered to contain weak default passwords. |
CVE-2025-2921 | Medium | 6.4 | 2025-03-28 | A vulnerability classified as critical has been found in Netis WF-2404 1.1.124EN. Affected is an unknown function of the file /etc/passwd. The manipulation wit… |
CVE-2024-49559 | High | 8.8 | 2025-03-17 | Dell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contain(s) an Use of Default Password vulnerability. A low privileged attack… |
CVE-2025-2347 | Medium | 6.3 | 2025-03-16 | A vulnerability was found in IROAD Dash Cam FX2 up to 20250308 and classified as problematic. This issue affects some unknown processing of the component Devic… |
CVE-2025-26701 | Critical | 10.0 | 2025-03-11 | An issue was discovered in Percona PMM Server (OVA) before 3.0.0-1.ova. The default service account credentials can lead to SSH access, use of Sudo to root, an… |
CVE-2025-1878 | Low | 3.1 | 2025-03-03 | A vulnerability has been found in i-Drive i11 and i12 up to 20250227 and classified as problematic. This vulnerability affects unknown code of the component Wi… |
CVE-2025-26793 | | | 2025-02-15 | The Web GUI configuration panel of Hirsch (formerly Identiv and Viscount) Enterphone MESH through 2024 ships with default credentials (username freedom, passwo… |
CVE-2024-43659 | High | 7.2 | 2025-01-09 | After gaining access to the firmware of a charging station, a file at <redacted> can be accessed to obtain default credentials that are the same across all Ioc… |
CVE-2024-51555 | Critical | 10.0 | 2024-12-05 | Default Credentail vulnerabilities allows access to an Aspect device using publicly available default credentials since the system does not require the install… |
CVE-2024-50588 | Critical | 9.8 | 2024-11-08 | An unauthenticated attacker with access to the local network of the
medical office can use known default credentials to gain remote DBA
access to the Elefant… |
CVE-2024-48987 | Medium | 6.6 | 2024-10-11 | Snipe-IT before 7.0.10 allows remote code execution (associated with cookie serialization) when an attacker knows the APP_KEY. This is exacerbated by .env file… |
CVE-2024-36440 | Medium | 6.8 | 2024-08-22 | An issue was discovered on Swissphone DiCal-RED 4009 devices. An attacker with access to the file /etc/deviceconfig may recover the administrative device passw… |
CVE-2023-45249 | Critical | 9.8 | 2024-07-24 | Remote command execution due to use of default passwords. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 5.0.1-61, Acroni… |
CVE-2024-30802 | Critical | 9.8 | 2024-05-14 | An issue in Vehicle Management System 7.31.0.3_20230412 allows an attacker to escalate privileges via the login.html component. |
CVE-2024-29021 | Critical | 9.0 | 2024-04-18 | Judge0 is an open-source online code execution system. The default configuration of Judge0 leaves the service vulnerable to a sandbox escape via Server Side Re… |
CVE-2024-29666 | Critical | 9.8 | 2024-03-25 | Insecure Permissions vulnerability in Vehicle Monitoring platform system CMSV6 v.7.31.0.2 through v.7.32.0.3 allows a remote attacker to escalate privileges vi… |
CVE-2023-43042 | High | 7.5 | 2023-12-14 | IBM SAN Volume Controller, IBM Storwize, IBM FlashSystem and IBM Storage Virtualize 8.3 products use default passwords for a privileged user. IBM X-Force ID… |
CVE-2023-24049 | Critical | 9.8 | 2023-12-04 | An issue was discovered on Connectize AC21000 G6 641.139.1.1256 allows attackers to gain escalated privileges on the device via poor credential management. |
CVE-2023-32090 | Critical | 9.8 | 2023-08-07 | Pega platform clients who are using versions 6.1 through 7.3.1 may be
utilizing default credentials
|
CVE-2023-28094 | High | 8.1 | 2023-06-22 | Pega platform clients who are using versions 7.4 through 8.8.x and have upgraded from a version prior to 8.x may be utilizing default credentials. |
CVE-2023-25131 | Critical | 9.4 | 2023-04-24 | Use of default password vulnerability in PowerPanel Business Local/Remote for Windows v4.8.6 and earlier, PowerPanel Business Management for Windows v4.8.6 and… |
CVE-2022-4126 | Critical | 9.6 | 2023-03-27 | Use of Default Password vulnerability in ABB RCCMD on Windows, Linux, MacOS allows Try Common or Default Usernames and Passwords.This issue affects RCCMD: befo… |