CVE-2026-102241 | Low | 2.7 | 2026-09-29 | A vulnerability was determined in Netcore NAP930 0.1.241010.141410. This vulnerability affects unknown code of the file /lib/functions/backup_common.sh of the… |
CVE-2026-82929 | | | 2026-09-28 | mH-DEVELOPER smart home module uses the same hard-coded SSH host keys on every device, with no per-device key generation. An attacker who extracts these keys f… |
CVE-2026-75553 | Low | 2.4 | 2026-09-25 | Smartphone application Tohoku Electric Power "Yorisou e Net" uses a hard-coded cryptographic key, which may allow an attacker to retrieve a hard-coded cryptogr… |
CVE-2026-75558 | Medium | 5.3 | 2026-09-24 | The Botslab G980H dash camera firmware uses a hard-coded cryptographic key and initialization vector to protect WiFi credentials communicated by the device. An… |
CVE-2026-79762 | Medium | 5.5 | 2026-09-24 | Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, Termix derives the keys t… |
CVE-2026-18181 | High | 8.1 | 2026-09-23 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to bypass authentication and access sensitive information due to a h… |
CVE-2026-86708 | Critical | 10.0 | 2026-09-23 | ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to exposure of a Google Cloud service-account private key in the Applicati… |
CVE-2026-18154 | High | 8.0 | 2026-09-22 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to the use of a hard-coded or pr… |
CVE-2026-52727 | High | 7.2 | 2026-09-17 | lxc-ci contains continuous integration and image-build scripts for LXC. Prior to the 2026-05-28 Arch Linux image publication, images built from images/archlinu… |
CVE-2026-28326 | High | 8.8 | 2026-09-17 | SolarWinds Access Rights Manager was reported to be affected by an unauthenticated remote code execution vulnerability. The issue stems from a hardcoded static… |
CVE-2026-81478 | High | 8.1 | 2026-09-17 | Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker wit… |
CVE-2026-50606 | | | 2026-09-17 | A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. The vulnerability is caused by the use… |
CVE-2026-50603 | | | 2026-09-17 | A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. The vulnerability is caused by the use of a… |
CVE-2026-81326 | Medium | 5.5 | 2026-09-16 | QND uses a hard-coded cryptographic key, which may allow a local attacker who is logged in to a Windows PC where the affected product's client is installed to… |
CVE-2026-81855 | Critical | 9.1 | 2026-09-15 | A hardcoded cryptographic client authentication key vulnerability exists in the robot testing framework component of Wärtsilä FOS-Onboard. |
CVE-2026-78225 | Critical | 9.0 | 2026-09-15 | A hardcoded cryptographic server key vulnerability exists in the deployer-ng Update Controller component of Wärtsilä FOS-Onboard. |
CVE-2026-89026 | Critical | 9.8 | 2026-09-15 | The Issabel Framework, the web framework supporting Issabel PBX software, before commit b97dbaf contains a hard-coded HS256 JWT signing key in the pbxapi index… |
CVE-2026-79551 | High | 7.5 | 2026-09-15 | Tenda Technology Co., Ltd NVR_4H CH3 v2.1 V27.5.58.6 was discovered to contain a hardcoded cryptographic key. |
CVE-2026-90945 | Critical | 9.8 | 2026-09-14 | Crawlab through 0.6.3 uses a hard-coded HMAC-SHA256 secret for JWT token signing that cannot be overridden via configuration or environment variables. Unauthen… |
CVE-2026-90510 | High | 8.3 | 2026-09-13 | A security vulnerability has been detected in dromara orion-visor up to 2.5.7. This affects the function HostKeyServiceImpl.encryptKey of the file orion-visor-… |
CVE-2026-87929 | Critical | 9.8 | 2026-09-09 | MaxSite CMS through 109.6 ships with a hardcoded session encryption key in application/config/config.php that is never changed during installation, allowing un… |
CVE-2026-79735 | Medium | 4.4 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Cryptographic Key… |
CVE-2026-78486 | Medium | 4.4 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Cryptographic Key… |
CVE-2026-78481 | Medium | 6.5 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Cryptographic Key… |
CVE-2026-53939 | Critical | 9.1 | 2026-09-09 | OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). In versions 0.6.1 through 0.6.2.5, when cjose encrypts a JWE usi… |
CVE-2026-81821 | High | 8.4 | 2026-09-08 | The vulnerability, if exploited, could allow a miscreant with read access to PIMBoards project files to decrypt and view sensitive information. |
CVE-2026-80167 | Medium | 5.5 | 2026-09-07 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Cryptographic Key… |
CVE-2026-80057 | Medium | 5.5 | 2026-09-07 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Cryptographic Key… |
CVE-2026-78487 | Medium | 5.5 | 2026-09-07 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Cryptographic Key… |
CVE-2026-86241 | Medium | 4.3 | 2026-09-07 | A weakness has been identified in liufee FeehiCMS up to 2.1.1. This impacts an unknown function of the file environments/prod/backend/config/main-local.php of… |
CVE-2026-80114 | High | 7.8 | 2026-09-04 | PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a hard-coded credentials vul… |
CVE-2026-75431 | Critical | 9.1 | 2026-09-04 | PowerJob Server version 5.1.2 (and likely earlier) uses a predictable JWT signing key for HS256-based authentication. This allows a remote attacker to execute… |
CVE-2026-18330 | | | 2026-09-03 | A hard-coded
cryptographic key vulnerability exists in the web module of TP-Link Archer
AX55 v4. A LAN attacker who captures an HTTP login session may use the… |
CVE-2026-84483 | Medium | 5.3 | 2026-09-01 | WWBN AVideo through commit 9c39d8c8 contains an incomplete authentication bypass in encryptPass.json.php that allows unauthenticated attackers to compute valid… |
CVE-2026-74233 | Critical | 9.8 | 2026-08-27 | Zbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, and WG3526 firmware 19.1101, Zbtlink WE2426-C firmware 19.1112, Zbtlink WE5926-EC… |
CVE-2026-24166 | Medium | 5.1 | 2026-08-25 | NVIDIA UFM Enterprise contains a vulnerability in the session management component, where an attacker could use a hard-coded cryptographic key to extract infor… |
CVE-2026-15469 | | | 2026-08-24 | The use of
hard-coded cryptographic key vulnerability has been identified in the mesh
functionality of Deco XE75 v3, XE5300 v3.6 and WE10800 v3.6.
A shared RS… |
CVE-2026-76847 | High | 8.8 | 2026-08-24 | act starts an HTTP Artifacts V4 backend whenever a workflow uses actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs of that bac… |
CVE-2026-76258 | Medium | 6.5 | 2026-08-19 | In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.10, 3.9.24, and 3.8.71, a user who does n… |
CVE-2026-51977 | Critical | 9.1 | 2026-08-17 | An issue in Trueview T18061 WiFi 3MP Robot Pan-Tilt Security Camera Version 1.0 allows a physically proximate attacker to escalate privileges via the RSA priva… |
CVE-2026-64887 | | | 2026-08-14 | Use of hard-coded cryptographic key vulnerability in Johnson Controls Airwall allows : Cryptanalytic Attack.
This issue affects Airwall: before 4.1. |
CVE-2026-17468 | Medium | 5.3 | 2026-08-13 | IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to forge valid session tokens due to the use of a hardcoded cryptographic key. |
CVE-2026-63423 | High | 7.8 | 2026-08-13 | During an internal security assessment, a potential vulnerability was discovered in Lenovo Accessories and Display Manager for Enterprise for Windows that coul… |
CVE-2026-34635 | High | 8.4 | 2026-08-11 | is affected by a Use of Hard-coded Cryptographic Key vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage thi… |
CVE-2026-57262 | Medium | 6.8 | 2026-08-11 | A vulnerability has been identified in LOGO! Soft Comfort (All versions < V9). Affected products use a static, hardcoded AES master key to encrypt project file… |
CVE-2026-66763 | High | 7.9 | 2026-08-11 | SAP BusinessObjects Business Intelligence Platform stores certain sensitive credentials associated with user objects using a hard-coded cryptographic key. An a… |
CVE-2025-30239 | | | 2026-08-10 | In affected TP-Link Aginet devices, use of
hardcoded cryptographic keys embedded in the firmware to protect sensitive
configuration data may allow an attacker… |
CVE-2026-54218 | | | 2026-08-07 | Use of hard-coded cryptographic key vulnerability in Tobit Laboratories AG TeamDavid's Webbox. For users created locally in David, passwords are stored in vari… |
CVE-2026-49008 | Medium | 6.5 | 2026-08-07 | By accessing unencrypted information in the device firmware, an attacker can obtain credentials related to the integrity verification of a specific application… |
CVE-2026-49006 | Medium | 5.3 | 2026-08-07 | By accessing unencrypted information in the device firmware, an attacker can obtain credentials related to TLS transmission. |
CVE-2026-18411 | High | 8.1 | 2026-08-05 | The KARR Security System and SWDS dealer-installed automotive anti-theft systems use a shared Bluetooth authentication key across affected devices. An attacker… |
CVE-2026-14804 | Critical | 9.1 | 2026-08-04 | Use of hard-coded cryptographic key vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Read Sensitive Con… |
CVE-2026-18754 | Critical | 9.1 | 2026-08-04 | The
product firmware contains an embedded, static RSA private key utilized by the
Lighttpd web server for TLS termination. Exposure of this private key allows
… |
CVE-2026-18753 | Critical | 9.1 | 2026-08-04 | The
product firmware contains an embedded, static RSA private key utilized by the
Lighttpd web server for TLS termination. Exposure of this private key allows
… |
CVE-2025-15627 | High | 7.5 | 2026-08-03 | A cryptographic
weakness exists in the Omada adoption protocol.
The protocol relies on hard-coded cryptographic keys to establish trust and
protect authentica… |
CVE-2026-16504 | Critical | 9.8 | 2026-07-31 | Deployment of the VPS.org one-click Zulip template deploys a hardcoded application signing key, a default database password ("zulip"), and DISABLE_HTTPS=True. |
CVE-2026-5846 | Medium | 5.7 | 2026-07-30 | The affected Watchfire Controller Software contains self-signed hard-coded RSA private keys and corresponding X.509 certificates used for authenticating and en… |
CVE-2026-54363 | Critical | 9.1 | 2026-07-30 | CentreStack before 17.5 contains a hardcoded cryptographic key vulnerability that allows unauthenticated attackers to forge arbitrary encrypted tokens by explo… |
CVE-2021-32086 | Critical | 9.8 | 2026-07-27 | An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It uses a hardcoded symmetric encryption key to encrypt secrets in the MySQL… |
CVE-2026-14932 | Medium | 6.5 | 2026-07-22 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, the obsolete RadChart component's ChartImage.axd handler is vulnerable to unauthenticated file read and… |
CVE-2026-13184 | High | 7.5 | 2026-07-22 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, when Telerik.Upload.ConfigurationHashKey is absent and machineKey is not explicitly configured, upload… |
CVE-2026-47410 | Critical | 9.8 | 2026-07-21 | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an insecure default cryptographic key. The JW… |
CVE-2026-62241 | Critical | 9.1 | 2026-07-17 | clawvet self-hosted API server (apps/api) before 0.7.5 hard-codes a fallback JWT secret ('clawvet-dev-secret-change-me') in auth.ts and ships it as the default… |
CVE-2026-9770 | Medium | 5.3 | 2026-07-15 | Kasa EC71 v4 and EC70 v4 firmware contains a static cryptographic private key stored in a read-only filesystem
that is shared across devices. An
attacker with… |
CVE-2026-56271 | Critical | 9.8 | 2026-07-12 | Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses weak hardcoded default JWT secrets ('auth_token', 'refresh_token') and default audience and is… |
CVE-2026-57172 | | | 2026-07-07 | DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, ShareSecretManage uses a hardcoded default share link signature key, allowin… |
CVE-2026-39031 | Medium | 5.5 | 2026-06-26 | Lansweeper lsrunase 2.0 and lsencrypt 2.0 use RC4 encryption with a hardcoded 142-byte static key array to encrypt credentials. An 8-character prefix is stored… |
CVE-2026-54833 | High | 7.4 | 2026-06-26 | Unauthenticated Backdoor in Enable CORS <= 2.0.3 versions. |
CVE-2026-9220 | High | 7.5 | 2026-06-26 | Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior encrypts requests between the watch and its backend with static hardcoded AES ke… |
CVE-2026-35019 | High | 8.1 | 2026-06-23 | NetComm NF20MESH routers running firmware R6B031 and earlier contain an authentication bypass vulnerability that allows unauthenticated attackers to gain admin… |
CVE-2026-9260 | Medium | 6.2 | 2026-06-16 | Use of hard-coded cryptographic keys in Canon EOS Network Setting Tool Version 1.5.0 or earlier |
CVE-2026-34029 | | | 2026-06-15 | The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains a hard-coded cryptographic key in the SafeSystem.Infrastructure.Security.dll co… |
CVE-2026-34022 | | | 2026-06-15 | The Wertheim SafeController Family 65000, Controller 65000 - AssemblyVersion 6.11.8130.22319, uses weak custom cryptographic algorithms with hard-coded cryptog… |
CVE-2026-28742 | Critical | 9.8 | 2026-06-12 | Naxclow devices use a uniform request-signing scheme based on a hard-coded, platform-wide salt embedded in every firmware image. Once this salt is recovered fr… |
CVE-2026-50091 | Critical | 9.1 | 2026-06-12 | Aqara Home Android (com.lumiunited.aqarahome) 6.0.0 (and white-label clients embedding the same liblumidevsdk.so) uses hard-coded cryptographic keys, which is… |
CVE-2026-11505 | Medium | 5.0 | 2026-06-08 | A flaw has been found in GL.iNet A1300, AX1800, AXT1800, MT2500, MT3000, MT6000, X3000 and XE3000 4.8.x. This affects an unknown function of the component glna… |
CVE-2026-46395 | | | 2026-06-05 | HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, the `hmacBase64()` function in the HAXcms Node.js backend contain… |
CVE-2026-11347 | | | 2026-06-05 | The linqi application contains hardcoded cryptographic keys. Additionally, the application uses a weak algorithm with a limited ASCII charset to dynamically ge… |
CVE-2026-45433 | | | 2026-06-04 | This vulnerability exists in GX Earth 2022 ONT models due to the presence of hardcoded RSA private key within the device firmware. A remote attacker could expl… |
CVE-2026-50226 | Medium | 5.3 | 2026-06-04 | Fixed AES-128-CBC keys inside the AcerConnect OTA application let attackers forge authorization credentials for arbitrary IMEI numbers. This allows unauthorize… |
CVE-2026-45041 | | | 2026-05-28 | RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, crates/appauth/src/token.rs ships a 2048-bit RSA private key as a string co… |
CVE-2026-24218 | High | 8.1 | 2026-05-20 | NVIDIA DGX OS contains a vulnerability in the factory provisioning process, where the cloning of a base image causes identical SSH host keys to be deployed ac… |
CVE-2026-31986 | Critical | 9.1 | 2026-05-19 | Use of Hard-coded Cryptographic Key vulnerability in Apache OFBiz.
This issue affects Apache OFBiz: before 24.09.06.
Users are recommended to upgrade to vers… |
CVE-2026-8739 | Medium | 5.3 | 2026-05-17 | A vulnerability was detected in Sanluan PublicCMS 5.202506.d. The affected element is the function getSignKey of the file publiccms-core/src/main/java/com/publ… |
CVE-2026-25107 | Medium | 6.5 | 2026-05-13 | ELECOM wireless LAN access point devices use a hard-coded cryptographic key when creating backups of configuration files. An attacker who knows the encryption… |
CVE-2026-44278 | Low | 2.3 | 2026-05-12 | A use of hard-coded cryptographic key vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.2, FortiClientWindows 7.2 all versions may allow attacker… |
CVE-2025-40946 | High | 8.3 | 2026-05-12 | A vulnerability has been identified in blueplanet 100 NX3 M8 (All versions), blueplanet 100 TL3 GEN2 (All versions < V6.1.4.9), blueplanet 105 TL3 (All version… |
CVE-2026-33362 | High | 8.6 | 2026-05-11 | In Meari IoT SDK builds embedded in CloudEdge 5.5.0 (build 220), Arenti 1.8.1 (build 220), and white-label Android apps <= 1.8.x (latest observed), multiple se… |
CVE-2026-8243 | Medium | 5.3 | 2026-05-10 | A vulnerability was determined in Industrial Application Software IAS Canias ERP 8.03. This affects an unknown function of the component JNLP Deployment Endpoi… |
CVE-2025-55449 | High | 7.3 | 2026-05-08 | AstrBotDevs AstrBot 3.5.15 has Advanced_System_for_Text_Response_and_Bot_Operations_Tool as the hardcoded private key used to sign a JWT. |
CVE-2026-6787 | High | 7.8 | 2026-05-06 | Use of Hard-coded Cryptographic Key vulnerability in WatchGuard Agent on Windows allows Inclusion of Code in Existing Process. |
CVE-2026-42518 | | | 2026-04-29 | This vulnerability exists in e-Sushrut due to disclosure of sensitive information and hardcoded AES encryption keys in client-side JavaScript. An unauthenticat… |
CVE-2026-7306 | Medium | 5.6 | 2026-04-28 | A security vulnerability has been detected in Xuxueli xxl-job up to 3.3.2. The impacted element is an unknown function of the file xxl-job-admin/src/main/java/… |
CVE-2026-32644 | Critical | 9.8 | 2026-04-28 | Specific firmware versions of Milesight AIOT cameras use SSL certificates with default private keys. |
CVE-2026-7018 | Medium | 5.6 | 2026-04-26 | A vulnerability was determined in Datavane Datavines up to 13607645e14a4982468cfdbcf75c85cde63bae71. The affected element is an unknown function of the file da… |
CVE-2026-6611 | Low | 3.1 | 2026-04-20 | A vulnerability was found in liangliangyy DjangoBlog up to 2.1.0.0. This affects an unknown function of the file djangoblog/settings.py of the component File U… |
CVE-2026-32958 | Medium | 6.5 | 2026-04-20 | SD-330AC and AMC Manager provided by silex technology, Inc. use a hard-coded cryptographic key. An administrative user may be directed to apply a fake firmware… |
CVE-2026-6580 | High | 7.3 | 2026-04-19 | A security vulnerability has been detected in liangliangyy DjangoBlog up to 2.1.0.0. Affected is an unknown function of the file owntracks/views.py of the comp… |
CVE-2026-32324 | High | 7.7 | 2026-04-17 | Anviz CX7 Firmware is
vulnerable because the application embeds reusable certificate/key
material, enabling decryption of MQTT traffic and potential interact… |
CVE-2026-5426 | Critical | 9.1 | 2026-04-16 | Hard-coded ASP.NET/IIS machineKey value in Digital Knowledge KnowledgeDeliver deployments prior to February 24, 2026 allows adversaries to circumvent ViewState… |