CVE-2026-109813 | | | 2026-10-16 | A hard-coded cryptographic key vulnerability exists in the `/usr/bin/sysman` of some of Moxa's industrial computing products. An unauthenticated attacker with… |
CVE-2026-111347 | Medium | 5.9 | 2026-10-15 | go-ldap-admin through 0.6.2 embeds a hard-coded RSA private key, published in the public repository, that protects encrypted login passwords. Unauthenticated a… |
CVE-2026-105035 | High | 7.8 | 2026-10-15 | The EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the CDN bin.zip) uses a single hard-coded AES key shared by all installations. An attacker who rec… |
CVE-2026-108336 | | | 2026-10-14 | When the default self-signed certificate is used, an attacker could gain administrative access to the application.
The SSL certificate for the web interface… |
CVE-2026-100413 | | | 2026-10-14 | SeaweedFS is a distributed storage system for files and blobs. From 4.0.388 until 4.41, the SFTP Helm chart embedded one unencrypted Ed25519 private host key i… |
CVE-2026-110612 | Critical | 9.8 | 2026-10-14 | vlife through 2.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs using the hardcoded HS256 signing key i… |
CVE-2026-107171 | | | 2026-10-14 | An Hardcoded Cryptographic Key vulnerability existed in Trellix Agent 5.8.4 via mfecryptc.dll leads to Database Decryption by Regular Users. |
CVE-2026-110214 | Low | 3.7 | 2026-10-13 | Snowy 3.6.5 contains a hard-coded HMAC key vulnerability that allows unauthenticated attackers to forge download signatures for the /dev/file/download endpoint… |
CVE-2026-106172 | Medium | 5.3 | 2026-10-13 | A use of hard-coded cryptographic key vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4 all versio… |
CVE-2026-65198 | High | 8.6 | 2026-10-13 | Huawei's openUBMC ships a default SNMPv3 USM key that uses one value for both authentication and privacy. An attacker who holds the key (recoverable from the o… |
CVE-2026-53709 | Critical | 9.8 | 2026-10-13 | MCP Context Forge is an MCP gateway and administrative platform. Prior to 1.0.2, mcpgateway/config.py and .env.example ship a known JWT_SECRET_KEY, while verif… |
CVE-2026-109424 | Medium | 5.9 | 2026-10-12 | NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a weak encryption vulnerability where /eapi/ and /xeapi/ API… |
CVE-2026-85963 | High | 7.5 | 2026-10-12 | Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 include deprecated OpsDirector functionality with weaknesses that could a… |
CVE-2026-93694 | Medium | 4.0 | 2026-10-12 | In Progress ShareFile Storage Zones Controller v5.12.6 and below, processing of queue items can send acknowledgements to an unvalidated callback URL, this beha… |
CVE-2026-108798 | High | 7.3 | 2026-10-12 | A vulnerability was found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This issue affects some unknown processing. The manipulation results in use of hard-code… |
CVE-2026-108860 | Critical | 9.1 | 2026-10-11 | BotSharp through 5.2.0 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge bearer tokens using the hard-coded… |
CVE-2026-87424 | High | 8.8 | 2026-10-08 | A vulnerability in the SupportLink API authentication component of Brocade ASCG versions prior to 3.5.0 allows an attacker to bypass authentication across depl… |
CVE-2026-34499 | | | 2026-10-07 | Use of hard-coded cryptographic key vulnerability in Johnson Controls ADVMS allows Read Sensitive Constants Within an Executable.
This issue affects ADVMS: be… |
CVE-2026-103778 | Medium | 6.2 | 2026-10-06 | Dell Command | Configure (DCC), versions prior to 5.2.3.35 contain a Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with local… |
CVE-2026-85153 | | | 2026-10-06 | This vulnerability exists in the Schmooze app due to the use of hardcoded credentials and cryptographic keys in the client application. An unauthenticated remo… |
CVE-2026-105392 | High | 7.3 | 2026-10-05 | A vulnerability has been found in Lybbn Django-Vue-Lyadmin up to 3.2.12. The impacted element is an unknown function of the file backend/application/settings.p… |
CVE-2026-94591 | High | 8.4 | 2026-10-02 | Armatura One stores database and message-broker credentials in an install configuration file, encrypting them with AES-128-CBC when this protection is enabled… |
CVE-2026-71449 | | | 2026-10-01 | : Use of Hard-coded Cryptographic Key vulnerability in Johnson Controls EasyIO FS32 allows : Retrieve Embedded Sensitive Data.
This issue affects EasyIO FS32… |
CVE-2026-82827 | Critical | 9.8 | 2026-10-01 | Hitachi Coding Software Suite contains a vulnerability related to Use of Hard-coded Cryptographic Key. The Hardcoding of JWT signing secret key allows an attac… |
CVE-2026-47097 | High | 7.5 | 2026-09-30 | AJA HELO Plus firmware before 2.1.7 contains an information disclosure vulnerability that allows unauthenticated attackers to decrypt sensitive diagnostics bun… |
CVE-2026-10764 | High | 8.7 | 2026-09-30 | Information disclosure in BVMS 4.5 up to 12.3 including allows man-in-the-middle attackers to gain unauthorized access to sensitive data. |
CVE-2026-103055 | High | 7.5 | 2026-09-30 | AiSOC versions 7.5.0 before 12.0.0 use a hard-coded constant for JWT verification in the realtime WebSocket and SSE service when the AISOC_REALTIME_JWT_SECRET… |
CVE-2026-102241 | Low | 2.7 | 2026-09-29 | A vulnerability was determined in Netcore NAP930 0.1.241010.141410. This vulnerability affects unknown code of the file /lib/functions/backup_common.sh of the… |
CVE-2026-82929 | | | 2026-09-28 | mH-DEVELOPER smart home module uses the same hard-coded SSH host keys on every device, with no per-device key generation. An attacker who extracts these keys f… |
CVE-2026-75553 | Low | 2.4 | 2026-09-25 | Smartphone application Tohoku Electric Power "Yorisou e Net" uses a hard-coded cryptographic key, which may allow an attacker to retrieve a hard-coded cryptogr… |
CVE-2026-75558 | Medium | 5.3 | 2026-09-24 | The Botslab G980H dash camera firmware uses a hard-coded cryptographic key and initialization vector to protect WiFi credentials communicated by the device. An… |
CVE-2026-79762 | Medium | 5.5 | 2026-09-24 | Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, Termix derives the keys t… |
CVE-2026-18181 | High | 8.1 | 2026-09-23 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to bypass authentication and access sensitive information due to a h… |
CVE-2026-86708 | Critical | 10.0 | 2026-09-23 | ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to exposure of a Google Cloud service-account private key in the Applicati… |
CVE-2026-18154 | High | 8.0 | 2026-09-22 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to the use of a hard-coded or pr… |
CVE-2026-52727 | High | 7.2 | 2026-09-17 | lxc-ci contains continuous integration and image-build scripts for LXC. Prior to the 2026-05-28 Arch Linux image publication, images built from images/archlinu… |
CVE-2026-28326 | High | 8.8 | 2026-09-17 | SolarWinds Access Rights Manager was reported to be affected by an unauthenticated remote code execution vulnerability. The issue stems from a hardcoded static… |
CVE-2026-81478 | High | 8.1 | 2026-09-17 | Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker wit… |
CVE-2026-50606 | | | 2026-09-17 | A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. The vulnerability is caused by the use… |
CVE-2026-50603 | | | 2026-09-17 | A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. The vulnerability is caused by the use of a… |
CVE-2026-81326 | Medium | 5.5 | 2026-09-16 | QND uses a hard-coded cryptographic key, which may allow a local attacker who is logged in to a Windows PC where the affected product's client is installed to… |
CVE-2026-81855 | Critical | 9.1 | 2026-09-15 | A hardcoded cryptographic client authentication key vulnerability exists in the robot testing framework component of Wärtsilä FOS-Onboard. |
CVE-2026-78225 | Critical | 9.0 | 2026-09-15 | A hardcoded cryptographic server key vulnerability exists in the deployer-ng Update Controller component of Wärtsilä FOS-Onboard. |
CVE-2026-89026 | Critical | 9.8 | 2026-09-15 | The Issabel Framework, the web framework supporting Issabel PBX software, before commit b97dbaf contains a hard-coded HS256 JWT signing key in the pbxapi index… |
CVE-2026-79551 | High | 7.5 | 2026-09-15 | Tenda Technology Co., Ltd NVR_4H CH3 v2.1 V27.5.58.6 was discovered to contain a hardcoded cryptographic key. |
CVE-2026-90945 | Critical | 9.8 | 2026-09-14 | Crawlab through 0.6.3 uses a hard-coded HMAC-SHA256 secret for JWT token signing that cannot be overridden via configuration or environment variables. Unauthen… |
CVE-2026-90510 | High | 8.3 | 2026-09-13 | A security vulnerability has been detected in dromara orion-visor up to 2.5.7. This affects the function HostKeyServiceImpl.encryptKey of the file orion-visor-… |
CVE-2026-87929 | Critical | 9.8 | 2026-09-09 | MaxSite CMS through 109.6 ships with a hardcoded session encryption key in application/config/config.php that is never changed during installation, allowing un… |
CVE-2026-79735 | Medium | 4.4 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Cryptographic Key… |
CVE-2026-78486 | Medium | 4.4 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Cryptographic Key… |
CVE-2026-78481 | Medium | 6.5 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Cryptographic Key… |
CVE-2026-53939 | Critical | 9.1 | 2026-09-09 | OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). In versions 0.6.1 through 0.6.2.5, when cjose encrypts a JWE usi… |
CVE-2026-81821 | High | 8.4 | 2026-09-08 | The vulnerability, if exploited, could allow a miscreant with read access to PIMBoards project files to decrypt and view sensitive information. |
CVE-2026-80167 | Medium | 5.5 | 2026-09-07 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Cryptographic Key… |
CVE-2026-80057 | Medium | 5.5 | 2026-09-07 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Cryptographic Key… |
CVE-2026-78487 | Medium | 5.5 | 2026-09-07 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Cryptographic Key… |
CVE-2026-86241 | Medium | 4.3 | 2026-09-07 | A weakness has been identified in liufee FeehiCMS up to 2.1.1. This impacts an unknown function of the file environments/prod/backend/config/main-local.php of… |
CVE-2026-80114 | High | 7.8 | 2026-09-04 | PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a hard-coded credentials vul… |
CVE-2026-75431 | Critical | 9.1 | 2026-09-04 | PowerJob Server version 5.1.2 (and likely earlier) uses a predictable JWT signing key for HS256-based authentication. This allows a remote attacker to execute… |
CVE-2026-18330 | | | 2026-09-03 | A hard-coded
cryptographic key vulnerability exists in the web module of TP-Link Archer
AX55 v4. A LAN attacker who captures an HTTP login session may use the… |
CVE-2026-84483 | Medium | 5.3 | 2026-09-01 | WWBN AVideo through commit 9c39d8c8 contains an incomplete authentication bypass in encryptPass.json.php that allows unauthenticated attackers to compute valid… |
CVE-2026-74233 | Critical | 9.8 | 2026-08-27 | Zbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, and WG3526 firmware 19.1101, Zbtlink WE2426-C firmware 19.1112, Zbtlink WE5926-EC… |
CVE-2026-24166 | Medium | 5.1 | 2026-08-25 | NVIDIA UFM Enterprise contains a vulnerability in the session management component, where an attacker could use a hard-coded cryptographic key to extract infor… |
CVE-2026-15469 | | | 2026-08-24 | The use of
hard-coded cryptographic key vulnerability has been identified in the mesh
functionality of Deco XE75 v3, XE5300 v3.6 and WE10800 v3.6.
A shared RS… |
CVE-2026-76847 | High | 8.8 | 2026-08-24 | act starts an HTTP Artifacts V4 backend whenever a workflow uses actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs of that bac… |
CVE-2026-76258 | Medium | 6.5 | 2026-08-19 | In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.10, 3.9.24, and 3.8.71, a user who does n… |
CVE-2026-51977 | Critical | 9.1 | 2026-08-17 | An issue in Trueview T18061 WiFi 3MP Robot Pan-Tilt Security Camera Version 1.0 allows a physically proximate attacker to escalate privileges via the RSA priva… |
CVE-2026-64887 | | | 2026-08-14 | Use of hard-coded cryptographic key vulnerability in Johnson Controls Airwall allows : Cryptanalytic Attack.
This issue affects Airwall: before 4.1. |
CVE-2026-17468 | Medium | 5.3 | 2026-08-13 | IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to forge valid session tokens due to the use of a hardcoded cryptographic key. |
CVE-2026-63423 | High | 7.8 | 2026-08-13 | During an internal security assessment, a potential vulnerability was discovered in Lenovo Accessories and Display Manager for Enterprise for Windows that coul… |
CVE-2026-34635 | High | 8.4 | 2026-08-11 | is affected by a Use of Hard-coded Cryptographic Key vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage thi… |
CVE-2026-57262 | Medium | 6.8 | 2026-08-11 | A vulnerability has been identified in LOGO! Soft Comfort (All versions < V9). Affected products use a static, hardcoded AES master key to encrypt project file… |
CVE-2026-66763 | High | 7.9 | 2026-08-11 | SAP BusinessObjects Business Intelligence Platform stores certain sensitive credentials associated with user objects using a hard-coded cryptographic key. An a… |
CVE-2025-30239 | | | 2026-08-10 | In affected TP-Link Aginet devices, use of
hardcoded cryptographic keys embedded in the firmware to protect sensitive
configuration data may allow an attacker… |
CVE-2026-54218 | | | 2026-08-07 | Use of hard-coded cryptographic key vulnerability in Tobit Laboratories AG TeamDavid's Webbox. For users created locally in David, passwords are stored in vari… |
CVE-2026-49008 | Medium | 6.5 | 2026-08-07 | By accessing unencrypted information in the device firmware, an attacker can obtain credentials related to the integrity verification of a specific application… |
CVE-2026-49006 | Medium | 5.3 | 2026-08-07 | By accessing unencrypted information in the device firmware, an attacker can obtain credentials related to TLS transmission. |
CVE-2026-18411 | High | 8.1 | 2026-08-05 | The KARR Security System and SWDS dealer-installed automotive anti-theft systems use a shared Bluetooth authentication key across affected devices. An attacker… |
CVE-2026-14804 | Critical | 9.1 | 2026-08-04 | Use of hard-coded cryptographic key vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Read Sensitive Con… |
CVE-2026-18754 | Critical | 9.1 | 2026-08-04 | The
product firmware contains an embedded, static RSA private key utilized by the
Lighttpd web server for TLS termination. Exposure of this private key allows
… |
CVE-2026-18753 | Critical | 9.1 | 2026-08-04 | The
product firmware contains an embedded, static RSA private key utilized by the
Lighttpd web server for TLS termination. Exposure of this private key allows
… |
CVE-2025-15627 | High | 7.5 | 2026-08-03 | A cryptographic
weakness exists in the Omada adoption protocol.
The protocol relies on hard-coded cryptographic keys to establish trust and
protect authentica… |
CVE-2026-16504 | Critical | 9.8 | 2026-07-31 | Deployment of the VPS.org one-click Zulip template deploys a hardcoded application signing key, a default database password ("zulip"), and DISABLE_HTTPS=True. |
CVE-2026-5846 | Medium | 5.7 | 2026-07-30 | The affected Watchfire Controller Software contains self-signed hard-coded RSA private keys and corresponding X.509 certificates used for authenticating and en… |
CVE-2026-54363 | Critical | 9.1 | 2026-07-30 | CentreStack before 17.5 contains a hardcoded cryptographic key vulnerability that allows unauthenticated attackers to forge arbitrary encrypted tokens by explo… |
CVE-2021-32086 | Critical | 9.8 | 2026-07-27 | An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It uses a hardcoded symmetric encryption key to encrypt secrets in the MySQL… |
CVE-2026-14932 | Medium | 6.5 | 2026-07-22 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, the obsolete RadChart component's ChartImage.axd handler is vulnerable to unauthenticated file read and… |
CVE-2026-13184 | High | 7.5 | 2026-07-22 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, when Telerik.Upload.ConfigurationHashKey is absent and machineKey is not explicitly configured, upload… |
CVE-2026-47410 | Critical | 9.8 | 2026-07-21 | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an insecure default cryptographic key. The JW… |
CVE-2026-62241 | Critical | 9.1 | 2026-07-17 | clawvet self-hosted API server (apps/api) before 0.7.5 hard-codes a fallback JWT secret ('clawvet-dev-secret-change-me') in auth.ts and ships it as the default… |
CVE-2026-9770 | Medium | 5.3 | 2026-07-15 | Kasa EC71 v4 and EC70 v4 firmware contains a static cryptographic private key stored in a read-only filesystem
that is shared across devices. An
attacker with… |
CVE-2026-56271 | Critical | 9.8 | 2026-07-12 | Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses weak hardcoded default JWT secrets ('auth_token', 'refresh_token') and default audience and is… |
CVE-2026-57172 | | | 2026-07-07 | DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, ShareSecretManage uses a hardcoded default share link signature key, allowin… |
CVE-2026-39031 | Medium | 5.5 | 2026-06-26 | Lansweeper lsrunase 2.0 and lsencrypt 2.0 use RC4 encryption with a hardcoded 142-byte static key array to encrypt credentials. An 8-character prefix is stored… |
CVE-2026-54833 | High | 7.4 | 2026-06-26 | Unauthenticated Backdoor in Enable CORS <= 2.0.3 versions. |
CVE-2026-9220 | High | 7.5 | 2026-06-26 | Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior encrypts requests between the watch and its backend with static hardcoded AES ke… |
CVE-2026-35019 | High | 8.1 | 2026-06-23 | NetComm NF20MESH routers running firmware R6B031 and earlier contain an authentication bypass vulnerability that allows unauthenticated attackers to gain admin… |
CVE-2026-9260 | Medium | 6.2 | 2026-06-16 | Use of hard-coded cryptographic keys in Canon EOS Network Setting Tool Version 1.5.0 or earlier |
CVE-2026-34029 | | | 2026-06-15 | The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains a hard-coded cryptographic key in the SafeSystem.Infrastructure.Security.dll co… |
CVE-2026-34022 | | | 2026-06-15 | The Wertheim SafeController Family 65000, Controller 65000 - AssemblyVersion 6.11.8130.22319, uses weak custom cryptographic algorithms with hard-coded cryptog… |