CVE-2026-96587 | Critical | 10.0 | 2026-09-29 | The Viidure Android application embeds permanent, plaintext cloud storage credentials within its compiled code. These credentials provide full access to critic… |
CVE-2026-100294 | High | 7.5 | 2026-09-29 | In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, the firmware embeds hardcoded cloud‑API credentials that are shared across deployed devices. Anyone obtaini… |
CVE-2026-7193 | | | 2026-09-29 | A vulnerability relating to the use of predefined credentials in the Dbit T-CPE301K 4G WiFi mini-router allows an attacker connected to the same network to gai… |
CVE-2026-101052 | High | 7.3 | 2026-09-28 | A security vulnerability has been detected in refly-ai refly up to 1.1.0. This issue affects some unknown processing of the file apps/api/src/modules/config/ap… |
CVE-2026-79959 | Medium | 6.8 | 2026-09-24 | The Botslab G980H dash camera firmware contains a hard-coded root account password that cannot be changed by the user. An attacker who obtains the firmware or… |
CVE-2026-93290 | Medium | 5.5 | 2026-09-24 | Omni C20 uses hard-coded credentials that could allow an attacker to monitor log files to obtain credentials to access information like mapping data. |
CVE-2026-96548 | Medium | 5.6 | 2026-09-23 | A flaw has been found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. This affects an unknown part of the file ssm_pro/src/main/resource… |
CVE-2026-92928 | Medium | 6.5 | 2026-09-23 | OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 contains a hardcoded, undocumented recovery account with a shared credential that cannot be change… |
CVE-2026-17644 | High | 8.8 | 2026-09-22 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local attacker to gain unauthorized access to sensitive information and modify trans… |
CVE-2026-76708 | Critical | 9.8 | 2026-09-22 | A vulnerability exists in the Analytics and Location Engine (ALE) where the application and underlying operating system use default, hard-coded credentials for… |
CVE-2026-47116 | Critical | 9.8 | 2026-09-22 | LTSecurity LTK3500SF contains a hard-coded credentials vulnerability where the root and guest account passwords are stored in /etc/shadow as weak hashes recove… |
CVE-2026-65113 | Critical | 9.8 | 2026-09-22 | NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause use of hard-coded credentials. A successful exploit of this v… |
CVE-2026-86555 | Medium | 6.2 | 2026-09-20 | The ZTE SmartLife application has a hardcoded key. The key used to decrypt account server information is stored in plaintext in the code. Once the key is obtai… |
CVE-2026-93970 | High | 7.3 | 2026-09-20 | A security flaw has been discovered in aiyiyi121 SxDevOps 1.0/1.1. This issue affects some unknown processing of the file backend/sxdevops/settings.py of the c… |
CVE-2026-93969 | High | 7.3 | 2026-09-20 | A vulnerability was identified in aiyiyi121 SxDevOps 1.0/1.1. This vulnerability affects the function ensure_default_superuser of the file rbac/services.py. Th… |
CVE-2026-84034 | High | 8.8 | 2026-09-18 | IBM Guardium Data Protection 12.2 is vulnerable to a hardcoded credentials vulnerability in the hardware_assess/obstore binaries. A low-privileged authenticate… |
CVE-2026-63406 | Medium | 5.9 | 2026-09-18 | AnyCable is a realtime server for reliable two-way communication that supports any backend. Prior to 1.6.15, the telemetry subsystem in telemetry/config.go ena… |
CVE-2026-86520 | High | 7.5 | 2026-09-18 | Bransys ELD is shipped with hardcoded MQTT credentials, which will grant read access to real-time data for every active device across a subset of carriers that… |
CVE-2026-77960 | Medium | 5.3 | 2026-09-18 | Bransys ELD is shipped with hardcoded MQTT credentials, which will grant read access to real-time data for every active device across a subset of carriers that… |
CVE-2026-54767 | Critical | 9.1 | 2026-09-17 | WeGIA is a web manager for charitable institutions. Prior to 3.8.5, web/html/socio/sistema/controller/deletar_socios.php exposes an unauthenticated GET endpoin… |
CVE-2026-81440 | High | 7.3 | 2026-09-17 | Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use of Hard-coded Credentials vulnerability. An unauthenticated attacker with remo… |
CVE-2026-92787 | Critical | 9.8 | 2026-09-16 | Feast through 0.66.0 fails to verify JWT token signatures before establishing user identity, allowing attackers to bypass all role-based access control by pres… |
CVE-2026-68950 | High | 8.8 | 2026-09-15 | The affected products use hard-coded credentials, which could allow an attacker to run the ftpd service as root, providing remote root file access where FTP is… |
CVE-2026-66890 | Critical | 9.6 | 2026-09-15 | The affected products use hard-coded credentials, which could allow remote access to files with root privileges where FTP is reachable. |
CVE-2026-37152 | Critical | 9.8 | 2026-09-15 | TOTOLINK X5000R V9.1.0cu.2415_B20250515 was discovered to contain a hardcoded password for root access. |
CVE-2026-16141 | High | 8.1 | 2026-09-15 | OpenBMC's IPMI implementation, phosphor-net-ipmid, contains a logic flaw in which an unauthenticated client can force the RAKP Message 1 handler to return befo… |
CVE-2026-57148 | Critical | 9.8 | 2026-09-15 | PraisonAI is a multi-agent teams system. Prior to 0.1.6, praisonai_platform/services/auth_service.py falls back to the public dev-secret-change-me HS256 signin… |
CVE-2026-57147 | Critical | 9.8 | 2026-09-15 | PraisonAI is a multi-agent teams system. Prior to 0.1.6, praisonai_platform/services/auth_service.py assigns the public dev-secret-change-me value to JWT_SECRE… |
CVE-2026-90509 | High | 7.3 | 2026-09-13 | A weakness has been identified in dromara orion-visor up to 2.5.7. Affected by this issue is the function ExposeApiAspect.beforeExposeApi of the file ExposeApi… |
CVE-2026-79396 | Critical | 9.8 | 2026-09-11 | Use of hardcoded default credentials in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier stores static account credentials in unencrypted… |
CVE-2026-85083 | Medium | 6.8 | 2026-09-11 | The ANJIA AJL33PC0801 IP camera uses a hard-coded credential for bootloader authentication. An attacker with physical access to the device may leverage this we… |
CVE-2026-75940 | Critical | 9.1 | 2026-09-10 | A vulnerability was reported in Lenovo Health Android Application, distributed exclusively in the Chinese market, that could allow an attacker to access sensit… |
CVE-2026-85544 | Medium | 6.1 | 2026-09-10 | Some Hikvision intercom products utilize an immutable factory value which should be obtained from local network or physical interaction with the device within… |
CVE-2026-17038 | | | 2026-09-10 | DrEryk Gabinet before 11.5.0 uses hard-coded API credentials in its ticket reporting component. These credentials can be used to authenticate directly to the t… |
CVE-2026-71801 | Critical | 9.8 | 2026-09-09 | An issue was discovered in s-pms SPMS-Server through v1.0. The application contains a hardcoded default access token secret within its core configuration file… |
CVE-2026-81640 | High | 8.8 | 2026-09-09 | An attacker could derive the camera's Wi-Fi password and connect to its wireless network. This weakens or eliminates the security value of the access-point pas… |
CVE-2026-79950 | High | 7.5 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Credentials vulner… |
CVE-2026-79740 | High | 7.5 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Credentials vulner… |
CVE-2026-79738 | High | 7.5 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Credentials vulner… |
CVE-2026-79731 | Medium | 4.4 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Credentials vulner… |
CVE-2026-86464 | | | 2026-09-08 | In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Identity Manager (IdM) deployment included inse… |
CVE-2026-86673 | High | 7.3 | 2026-09-08 | A vulnerability was determined in ningzichun Student Management System up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected by this issue is the function m… |
CVE-2026-80170 | Medium | 6.5 | 2026-09-07 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Credentials vulner… |
CVE-2026-80134 | High | 7.7 | 2026-09-07 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Credentials vulner… |
CVE-2026-86276 | High | 7.3 | 2026-09-07 | A flaw has been found in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. This issue affects some unknown processing of the file d… |
CVE-2026-86150 | Medium | 4.1 | 2026-09-05 | A security vulnerability has been detected in Tenda CP3 27.5.57.101. Impacted is an unknown function of the file custom-x/softap/hostapd. Such manipulation of… |
CVE-2026-77847 | Medium | 6.5 | 2026-09-04 | Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a use of hard-coded credential vulnerability. This could allow an attacker to inter… |
CVE-2026-5522 | Medium | 6.7 | 2026-09-04 | IBM QRadar 7.5.0 through 7.5.0 UP15 Interim Fix 005 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound… |
CVE-2026-85149 | Medium | 5.3 | 2026-09-04 | SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the SFTP service… |
CVE-2026-85148 | Critical | 9.8 | 2026-09-04 | SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can exploit a fixed password… |
CVE-2026-85146 | Critical | 9.8 | 2026-09-04 | SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the SSH service a… |
CVE-2026-75754 | | | 2026-09-04 | Missing Authentication for Critical Function, Server-Side Request Forgery (SSRF), and Use of Hard-coded Credentials in ASUS Control Center allow an unauthorize… |
CVE-2026-85451 | High | 7.1 | 2026-09-03 | MOOS core-moos through 10.4.0 contains a remote process termination vulnerability in the SuicidalSleeper component that uses a hard-coded passphrase for multic… |
CVE-2026-85391 | Critical | 9.8 | 2026-09-03 | Peppermint through 0.5.5 contains a hardcoded JWT signing secret in docker-compose.yml that allows unauthenticated attackers to forge session tokens for any ac… |
CVE-2024-7952 | | | 2026-09-01 | A data exposure vulnerability exists in the affected product. There are hardcoded links in the source code that lead to JSON files that can be reached without… |
CVE-2026-18931 | Critical | 9.1 | 2026-09-01 | Use of Hard-coded Credentials vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software allows Retrieve Embedded Sensit… |
CVE-2026-38577 | Critical | 9.8 | 2026-08-31 | Insecure hardcoded credentials in the Admin account of Tenda HG21 V4.0.0-260302 allows attackers to gain root access. |
CVE-2026-82808 | High | 7.3 | 2026-08-31 | A vulnerability was identified in Inbox Foundry ActiveInbox Extension up to 7.10.24 on Chrome. Impacted is an unknown function of the file dist/service-worker… |
CVE-2026-82448 | Critical | 9.8 | 2026-08-29 | Shinobi before commit 5a76c74f contains a hardcoded connection key in the child node service that allows unauthenticated attackers to execute arbitrary databas… |
CVE-2026-19412 | | | 2026-08-28 | This vulnerability exists in the CP Plus CP-XR-DE21-S Router due to the presence of hardcoded HTTP Digest authentication credentials in the firmware that are i… |
CVE-2026-13086 | | | 2026-08-28 | A stack-based buffer overflow in the epm (Endpoint Protection Manager) service used by the deprecated Mobile Security feature in WatchGuard Fireware OS allows… |
CVE-2026-71396 | Medium | 5.4 | 2026-08-28 | Bendix EC80 Brake ECU uses hard-coded credentials, which could allow an attacker to disable automatic traction control. |
CVE-2026-37012 | High | 7.5 | 2026-08-27 | A vulnerability in pentestgpt/core/langfuse.py in PentestGPT 1.0.0 allows remote attackers to disclose sensitive user telemetry data via hardcoded API credenti… |
CVE-2026-78251 | | | 2026-08-27 | DJI drones contain an FTP service that uses hardcoded credentials shared across affected models and permits authenticated users to upload files without limits… |
CVE-2026-75896 | Critical | 9.1 | 2026-08-26 | Use of Hard-coded Credentials vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Liderahenk allows Try Common or Default Usernames and Pa… |
CVE-2026-12587 | | | 2026-08-26 | The vulnerability allows the unauthorised generation of physical access QR codes due to the use of hard-coded credentials within the application. The generatio… |
CVE-2026-59769 | Critical | 9.1 | 2026-08-25 | FA-50 all versions contain hard-coded credentials.
An attacker, who knows the credentials and has access to the vessel's internal network, can operate the set… |
CVE-2026-78062 | High | 7.3 | 2026-08-23 | A vulnerability was identified in vas3k TaxHacker up to 0.8.2. The affected element is the function envSchema.parse of the file lib/config.ts of the component… |
CVE-2026-76131 | Medium | 5.3 | 2026-08-21 | Use of hard-coded credentials issue exists in VOCALOID6 , which may allow an attacker to impersonate a legitimate VOCALOID6 Editor and gain access to Yamaha's… |
CVE-2026-76392 | Medium | 5.4 | 2026-08-19 | In Splunk AI Toolkit versions below 6.0.0, a user who does not hold the "admin" or "power" Splunk roles could obtain predictable or default credentials for con… |
CVE-2026-71960 | Critical | 9.1 | 2026-08-19 | Cudy WR3000 2.0 running firmware before 2.5.24 contains a hard-coded JWT HMAC signing secret vulnerability in the Mosquitto MQTT broker's authentication plugin… |
CVE-2021-43717 | Critical | 9.8 | 2026-08-18 | An issue exists in pson EH-TW5350 Epson iProjection.apk v3.2.6. If you identify a projector equipped with an iProjection function, you can access the projector… |
CVE-2026-74893 | High | 8.8 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain hardcoded default JWT signing secrets in config.py that pass validation checks. Attackers with access to source c… |
CVE-2026-74892 | High | 7.5 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain a hardcoded default secret key in the standalone telemetry server configuration that is used for API key hashing… |
CVE-2026-74891 | Critical | 9.8 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain hardcoded database credentials in standalone server configuration files. Attackers on the same network can access… |
CVE-2026-50601 | | | 2026-08-17 | A security vulnerability has been identified in the Planet9 desktop application where a hardcoded read-only API key permitted unauthorized access to internal r… |
CVE-2026-19901 | High | 8.1 | 2026-08-15 | A security flaw has been discovered in LB-LINK X-PRO 1.0.22-20231206. This affects an unknown function of the file /etc/config/easycwmp. The manipulation resul… |
CVE-2026-19900 | High | 8.1 | 2026-08-15 | A vulnerability was identified in LB-LINK X-PRO 1.0.22-20231206. The impacted element is an unknown function of the file /etc/shadow. The manipulation leads to… |
CVE-2026-73847 | Medium | 6.8 | 2026-08-14 | Emlog is an open source website building system. In 2.6.26 and earlier, missing CSRF protection on the AI Assistant execute_tool action in admin/ai.php lets a… |
CVE-2026-63702 | Medium | 6.3 | 2026-08-14 | Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain a Use of Hard-coded Credentials vulnerability. A low privileged attacker with local acces… |
CVE-2026-19871 | | | 2026-08-14 | Use of Hard-coded Credentials in the human resources component in Roskus Prospero Flow CRM before 5.15.9 allows unauthenticated remote attackers to authenticat… |
CVE-2026-18164 | High | 8.1 | 2026-08-13 | An undocumented hard-coded credential, shared by all device units, is authorized to bypass authentication. This allows an attacker within Bluetooth range to ar… |
CVE-2026-13460 | High | 7.5 | 2026-08-13 | IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.0.0 through 6.0.1.0 GUI contains a hardcoded token in the source code, which was used for inter-node cluster… |
CVE-2026-67614 | Critical | 9.8 | 2026-08-13 | CyberPanel before 3.0.0 contains a hard-coded JWT secret vulnerability in the WebTerminal FastAPI SSH service that allows unauthenticated remote attackers to f… |
CVE-2026-59507 | Critical | 9.3 | 2026-08-13 | : Use of Hard-coded Credentials : Exposure of Sensitive Information to an Unauthorized Actor : Improper Access Control vulnerability in Priority Portal Generat… |
CVE-2026-73519 | Critical | 9.8 | 2026-08-12 | WolfStack before 25.9.2 contains a hard-coded cluster-authentication secret compiled into every build and published as a constant in src/auth/mod.rs, allowing… |
CVE-2026-14866 | High | 7.7 | 2026-08-12 | IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to injection of rogue certificate authority due to publicly writeable truststore. |
CVE-2026-67568 | Critical | 9.1 | 2026-08-11 | The distributed Mira Android APK v4.5.15.4 allows an attacker read/write access to reproductive health profiles from internet connected hosts, which could resu… |
CVE-2026-69102 | Critical | 9.8 | 2026-08-11 | MaxKey contains an unauthorized access vulnerability due to a hard-coded JWT signing secret in application-maxkey.properties that allows unauthenticated attack… |
CVE-2026-58245 | Low | 3.8 | 2026-08-11 | SAP Advanced Planning and Optimization (Model Mix Planning) contains a hardcoded credential within the source code of the application to perform authorization… |
CVE-2025-13293 | | | 2026-08-10 | A hard-coded or default root account credential in TBEA TLogger V2.1.0.0B0.0.0.0 allows an unauthenticated remote attacker to obtain root-level access to the d… |
CVE-2026-6374 | High | 7.3 | 2026-08-10 | Use of Hard-coded Credentials vulnerability in Zyxel Networks WAH7601 allows Read Sensitive Constants Within an Executable.
This issue affects WAH7601: throug… |
CVE-2026-49007 | High | 7.5 | 2026-08-07 | By accessing unencrypted information in the device firmware, an attacker can obtain the initial login credentials for the device's web interface. |
CVE-2025-63823 | Critical | 9.8 | 2026-08-05 | My Safetipin Android Application 5.2.1 contains Hardcoded credentials in the authentication module, which allows remote attackers to bypass authentication and… |
CVE-2026-71238 | Critical | 9.1 | 2026-08-05 | DjangoCRM ships with its Django SECRET_KEY hardcoded directly in the committed webcrm/settings.py rather than read from an environment variable. Since this key… |
CVE-2026-48031 | Critical | 9.1 | 2026-08-03 | go-base is a Go RESTful API Boilerplate template with JWT Authentication, backed by PostgreSQL. In versions prior to 2026-05-18, the JWT signing secret is hard… |
CVE-2025-15628 | High | 7.5 | 2026-08-03 | Affected
Omada devices rely on embedded certificates that are shared across deployments
to establish trust between controllers and managed devices.
An… |
CVE-2026-65313 | High | 8.1 | 2026-07-31 | A provisioning script used when installing HIPASE-250 (formerly 250
SCALA) engineering workstations sets a fixed, hard-coded x11vnc
password. Because the same… |
CVE-2026-18452 | Critical | 10.0 | 2026-07-31 | DMS+ (Non-Mobile) developed by Rich Source has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can exploit a fixed API key to g… |
CVE-2026-52539 | Critical | 9.1 | 2026-07-30 | Outstatic CMS <= 2.1.9 contains a hardcoded JWT signing secret. When the OST_TOKEN_SECRET environment variable is not set, the application falls back to the de… |