CVE-2026-111281 | Critical | 9.8 | 2026-10-15 | Jooan JA-A12 IP cameras with firmware 009_20171107 and 05.02.31.105 contain a remote code execution vulnerability that allows unauthenticated attackers to run… |
CVE-2026-105033 | High | 8.8 | 2026-10-15 | The EnergizeLab AI Station (RK3562) firmware image ships with default root credentials and SSH enabled. An attacker with network access to the device can log i… |
CVE-2026-77427 | Medium | 5.9 | 2026-10-14 | FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. From 3.9.0 until 3.22.0, pristine manual FileRise insta… |
CVE-2026-110667 | High | 7.3 | 2026-10-14 | A security flaw has been discovered in cemtan sar2html 4.0.0. Affected by this vulnerability is an unknown functionality of the file sar2html.py. The manipulat… |
CVE-2026-81964 | Medium | 5.5 | 2026-10-13 | Use of hard-coded credentials in Windows Update Orchestrator Service allows an authorized attacker to bypass a security feature locally. |
CVE-2026-53709 | Critical | 9.8 | 2026-10-13 | MCP Context Forge is an MCP gateway and administrative platform. Prior to 1.0.2, mcpgateway/config.py and .env.example ship a known JWT_SECRET_KEY, while verif… |
CVE-2026-109758 | | | 2026-10-13 | Perforce Helix Authentication Service (HAS) deployments that retain the shipped default SCIM bearer token are vulnerable to unauthorized access when the SCIM e… |
CVE-2026-109566 | Critical | 9.8 | 2026-10-12 | Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerability that allows remote unauthenticated attackers to gain super-admin access th… |
CVE-2026-108831 | Medium | 6.3 | 2026-10-12 | A security vulnerability has been detected in meetecho janus-gateway up to 1.4.2. This vulnerability affects unknown code of the file html/demos/admin.js of th… |
CVE-2026-107437 | Medium | 6.2 | 2026-10-12 | GV-E-Map
Server V18.2.0A contains a plaintext database password embedded within an
application component. The credential can be recovered through static analys… |
CVE-2026-108905 | High | 7.5 | 2026-10-11 | pH7Builder (pH7 Social Dating CMS) before 18.6.0 contains a hard-coded API key vulnerability in Tool.class.php that allows unauthenticated attackers to bypass… |
CVE-2026-108753 | Critical | 9.4 | 2026-10-11 | Agnaistic agnai through 1.0.555 contains a hard-coded credentials vulnerability in self-host.docker-compose.yml, which sets a fixed admin password and public J… |
CVE-2026-108584 | Medium | 5.3 | 2026-10-11 | A security flaw has been discovered in FunnyWolf Viper up to 3.1.11. The affected element is an unknown function of the file /root/viper/.git/config. Performin… |
CVE-2026-32645 | Medium | 6.0 | 2026-10-09 | Default factory credentials with administrative access are enabled and persist even after configuring other administrator accounts. |
CVE-2026-105278 | Critical | 9.8 | 2026-10-09 | The published Docker image for openPDC includes a fixed administrative credential with no forced change on first use. An attacker with network access to the ma… |
CVE-2026-84891 | Medium | 5.9 | 2026-10-08 | IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to obtain sensitive information due to use of hard-coded credentials. |
CVE-2026-84250 | High | 8.4 | 2026-10-08 | IBM Guardium Data Protection 12.2 is vulnerable due to weak cryptographic protection and a hard-coded recovery key in the pkcrypto passkey component. A local a… |
CVE-2026-85488 | High | 7.8 | 2026-10-08 | Brocade ASCG before 3.5.0 has a well-known Brocade default password embedded in a script distributed to every customer. Any local authenticated user with read… |
CVE-2026-85422 | High | 7.8 | 2026-10-08 | A vulnerability in Brocade ASCG version before 3.5.0 could allow an attacker to obtain a static cryptographic key hardcoded into the software binaries to secur… |
CVE-2026-92861 | Medium | 4.0 | 2026-10-08 | The Android application "Ticket Ryutsu Center" contains hard-coded credentials, which may allow an attacker to obtain an API key used by the application. |
CVE-2026-62252 | Critical | 9.8 | 2026-10-07 | Homer is open source telecom observability software. Prior to version 11.0.283, on every fresh Homer deployment using internal authentication, the bootstrap pr… |
CVE-2026-102161 | High | 8.8 | 2026-10-06 | An unauthenticated attacker located on an adjacent private network (or any attacker routed through a reverse proxy/load balancer that forwards client headers)… |
CVE-2026-61421 | Critical | 9.8 | 2026-10-06 | Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Use of Hard-coded Credentials vulnerability in the CSM Authorization. An unauthenticate… |
CVE-2026-54472 | Critical | 9.8 | 2026-10-06 | Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Use of Hard-coded Credentials vulnerability in the csm-docs. An unauthenticated attacke… |
CVE-2026-105641 | Critical | 9.8 | 2026-10-05 | Plane is an open-source project management tool. Prior to 1.4.0, the deployments/aio/community/ and deployments/cli/community/ manifests provide fixed, publicl… |
CVE-2026-105147 | High | 7.3 | 2026-10-04 | A vulnerability was determined in SciPhi-AI R2R up to 3.6.6. This affects an unknown part of the component JWT Secret Handler. This manipulation of the argumen… |
CVE-2026-105141 | Medium | 6.3 | 2026-10-04 | A security flaw has been discovered in topoteretes cognee up to 1.5.4. The affected element is the function get_user_id_by_email of the file cognee/modules/use… |
CVE-2026-94592 | High | 8.4 | 2026-10-02 | Armatura One's database initialization routine assigns a fixed, vendor-defined password to the database superuser account at creation time, rather than generat… |
CVE-2026-103097 | High | 7.5 | 2026-10-02 | An API key is
hardcoded and retrievable from the application package. Since Android
applications can be reverse engineered, embedding sensitive API credentials… |
CVE-2026-103096 | High | 7.5 | 2026-10-02 | API
key is hardcoded and retrievable from the application package. Since Android
applications can be reverse engineered, embedding sensitive API credentials
di… |
CVE-2026-27873 | | | 2026-10-01 | - Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FG allows - Pasword Spraying.
This issue affects EasyIO FG: before 2.0b52. |
CVE-2026-55395 | | | 2026-10-01 | Hardcoded passwords in the access control in Teledyne FLIR Aware2 versions through 6.9.0.2 (PackBot) and 1.7.9 (FirstLook) allows remote unauthenticated attack… |
CVE-2026-27874 | | | 2026-10-01 | : Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FS32 allows : Exploitation of Default or Hard-coded Credentials.
This issue affects E… |
CVE-2026-102666 | Medium | 6.5 | 2026-10-01 | The Joyland AI app contains hard-coded credentials for the GeTui push notification service, allowing an attacker to access the GeTui REST API and send push not… |
CVE-2026-13043 | | | 2026-10-01 | A missing authentication vulnerability in the Kernel Memory Access Driver (PSKMAD) used by WatchGuard endpoint security products allows a local, authenticated… |
CVE-2026-67104 | Medium | 5.3 | 2026-10-01 | HCL BigFix Service Management is affected by an Information Disclosure vulnerability, which could allow an unauthenticated attacker to analyze publicly accessi… |
CVE-2026-96587 | Critical | 10.0 | 2026-09-29 | The Viidure Android application embeds permanent, plaintext cloud storage credentials within its compiled code. These credentials provide full access to critic… |
CVE-2026-100294 | High | 7.5 | 2026-09-29 | In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, the firmware embeds hardcoded cloud‑API credentials that are shared across deployed devices. Anyone obtaini… |
CVE-2026-7193 | | | 2026-09-29 | A vulnerability relating to the use of predefined credentials in the Dbit T-CPE301K 4G WiFi mini-router allows an attacker connected to the same network to gai… |
CVE-2026-101052 | High | 7.3 | 2026-09-28 | A security vulnerability has been detected in refly-ai refly up to 1.1.0. This issue affects some unknown processing of the file apps/api/src/modules/config/ap… |
CVE-2026-79959 | Medium | 6.8 | 2026-09-24 | The Botslab G980H dash camera firmware contains a hard-coded root account password that cannot be changed by the user. An attacker who obtains the firmware or… |
CVE-2026-93290 | Medium | 5.5 | 2026-09-24 | Omni C20 uses hard-coded credentials that could allow an attacker to monitor log files to obtain credentials to access information like mapping data. |
CVE-2026-96548 | Medium | 5.6 | 2026-09-23 | A flaw has been found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. This affects an unknown part of the file ssm_pro/src/main/resource… |
CVE-2026-92928 | Medium | 6.5 | 2026-09-23 | OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 contains a hardcoded, undocumented recovery account with a shared credential that cannot be change… |
CVE-2026-17644 | High | 8.8 | 2026-09-22 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local attacker to gain unauthorized access to sensitive information and modify trans… |
CVE-2026-76708 | Critical | 9.8 | 2026-09-22 | A vulnerability exists in the Analytics and Location Engine (ALE) where the application and underlying operating system use default, hard-coded credentials for… |
CVE-2026-47116 | Critical | 9.8 | 2026-09-22 | LTSecurity LTK3500SF contains a hard-coded credentials vulnerability where the root and guest account passwords are stored in /etc/shadow as weak hashes recove… |
CVE-2026-65113 | Critical | 9.8 | 2026-09-22 | NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause use of hard-coded credentials. A successful exploit of this v… |
CVE-2026-86555 | Medium | 6.2 | 2026-09-20 | The ZTE SmartLife application has a hardcoded key. The key used to decrypt account server information is stored in plaintext in the code. Once the key is obtai… |
CVE-2026-93970 | High | 7.3 | 2026-09-20 | A security flaw has been discovered in aiyiyi121 SxDevOps 1.0/1.1. This issue affects some unknown processing of the file backend/sxdevops/settings.py of the c… |
CVE-2026-93969 | High | 7.3 | 2026-09-20 | A vulnerability was identified in aiyiyi121 SxDevOps 1.0/1.1. This vulnerability affects the function ensure_default_superuser of the file rbac/services.py. Th… |
CVE-2026-84034 | High | 8.8 | 2026-09-18 | IBM Guardium Data Protection 12.2 is vulnerable to a hardcoded credentials vulnerability in the hardware_assess/obstore binaries. A low-privileged authenticate… |
CVE-2026-63406 | Medium | 5.9 | 2026-09-18 | AnyCable is a realtime server for reliable two-way communication that supports any backend. Prior to 1.6.15, the telemetry subsystem in telemetry/config.go ena… |
CVE-2026-86520 | High | 7.5 | 2026-09-18 | Bransys ELD is shipped with hardcoded MQTT credentials, which will grant read access to real-time data for every active device across a subset of carriers that… |
CVE-2026-77960 | Medium | 5.3 | 2026-09-18 | Bransys ELD is shipped with hardcoded MQTT credentials, which will grant read access to real-time data for every active device across a subset of carriers that… |
CVE-2026-54767 | Critical | 9.1 | 2026-09-17 | WeGIA is a web manager for charitable institutions. Prior to 3.8.5, web/html/socio/sistema/controller/deletar_socios.php exposes an unauthenticated GET endpoin… |
CVE-2026-81440 | High | 7.3 | 2026-09-17 | Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use of Hard-coded Credentials vulnerability. An unauthenticated attacker with remo… |
CVE-2026-92787 | Critical | 9.8 | 2026-09-16 | Feast through 0.66.0 fails to verify JWT token signatures before establishing user identity, allowing attackers to bypass all role-based access control by pres… |
CVE-2026-68950 | High | 8.8 | 2026-09-15 | The affected products use hard-coded credentials, which could allow an attacker to run the ftpd service as root, providing remote root file access where FTP is… |
CVE-2026-66890 | Critical | 9.6 | 2026-09-15 | The affected products use hard-coded credentials, which could allow remote access to files with root privileges where FTP is reachable. |
CVE-2026-37152 | Critical | 9.8 | 2026-09-15 | TOTOLINK X5000R V9.1.0cu.2415_B20250515 was discovered to contain a hardcoded password for root access. |
CVE-2026-16141 | High | 8.1 | 2026-09-15 | OpenBMC's IPMI implementation, phosphor-net-ipmid, contains a logic flaw in which an unauthenticated client can force the RAKP Message 1 handler to return befo… |
CVE-2026-57148 | Critical | 9.8 | 2026-09-15 | PraisonAI is a multi-agent teams system. Prior to 0.1.6, praisonai_platform/services/auth_service.py falls back to the public dev-secret-change-me HS256 signin… |
CVE-2026-57147 | Critical | 9.8 | 2026-09-15 | PraisonAI is a multi-agent teams system. Prior to 0.1.6, praisonai_platform/services/auth_service.py assigns the public dev-secret-change-me value to JWT_SECRE… |
CVE-2026-90509 | High | 7.3 | 2026-09-13 | A weakness has been identified in dromara orion-visor up to 2.5.7. Affected by this issue is the function ExposeApiAspect.beforeExposeApi of the file ExposeApi… |
CVE-2026-79396 | Critical | 9.8 | 2026-09-11 | Use of hardcoded default credentials in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier stores static account credentials in unencrypted… |
CVE-2026-85083 | Medium | 6.8 | 2026-09-11 | The ANJIA AJL33PC0801 IP camera uses a hard-coded credential for bootloader authentication. An attacker with physical access to the device may leverage this we… |
CVE-2026-75940 | Critical | 9.1 | 2026-09-10 | A vulnerability was reported in Lenovo Health Android Application, distributed exclusively in the Chinese market, that could allow an attacker to access sensit… |
CVE-2026-85544 | Medium | 6.1 | 2026-09-10 | Some Hikvision intercom products utilize an immutable factory value which should be obtained from local network or physical interaction with the device within… |
CVE-2026-17038 | | | 2026-09-10 | DrEryk Gabinet before 11.5.0 uses hard-coded API credentials in its ticket reporting component. These credentials can be used to authenticate directly to the t… |
CVE-2026-71801 | Critical | 9.8 | 2026-09-09 | An issue was discovered in s-pms SPMS-Server through v1.0. The application contains a hardcoded default access token secret within its core configuration file… |
CVE-2026-81640 | High | 8.8 | 2026-09-09 | An attacker could derive the camera's Wi-Fi password and connect to its wireless network. This weakens or eliminates the security value of the access-point pas… |
CVE-2026-79950 | High | 7.5 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Credentials vulner… |
CVE-2026-79740 | High | 7.5 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Credentials vulner… |
CVE-2026-79738 | High | 7.5 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Credentials vulner… |
CVE-2026-79731 | Medium | 4.4 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Credentials vulner… |
CVE-2026-86464 | | | 2026-09-08 | In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Identity Manager (IdM) deployment included inse… |
CVE-2026-86673 | High | 7.3 | 2026-09-08 | A vulnerability was determined in ningzichun Student Management System up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected by this issue is the function m… |
CVE-2026-80170 | Medium | 6.5 | 2026-09-07 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Credentials vulner… |
CVE-2026-80134 | High | 7.7 | 2026-09-07 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Credentials vulner… |
CVE-2026-86276 | High | 7.3 | 2026-09-07 | A flaw has been found in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. This issue affects some unknown processing of the file d… |
CVE-2026-86150 | Medium | 4.1 | 2026-09-05 | A security vulnerability has been detected in Tenda CP3 27.5.57.101. Impacted is an unknown function of the file custom-x/softap/hostapd. Such manipulation of… |
CVE-2026-77847 | Medium | 6.5 | 2026-09-04 | Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a use of hard-coded credential vulnerability. This could allow an attacker to inter… |
CVE-2026-5522 | Medium | 6.7 | 2026-09-04 | IBM QRadar 7.5.0 through 7.5.0 UP15 Interim Fix 005 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound… |
CVE-2026-85149 | Medium | 5.3 | 2026-09-04 | SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the SFTP service… |
CVE-2026-85148 | Critical | 9.8 | 2026-09-04 | SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can exploit a fixed password… |
CVE-2026-85146 | Critical | 9.8 | 2026-09-04 | SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the SSH service a… |
CVE-2026-75754 | | | 2026-09-04 | Missing Authentication for Critical Function, Server-Side Request Forgery (SSRF), and Use of Hard-coded Credentials in ASUS Control Center allow an unauthorize… |
CVE-2026-85451 | High | 7.1 | 2026-09-03 | MOOS core-moos through 10.4.0 contains a remote process termination vulnerability in the SuicidalSleeper component that uses a hard-coded passphrase for multic… |
CVE-2026-85391 | Critical | 9.8 | 2026-09-03 | Peppermint through 0.5.5 contains a hardcoded JWT signing secret in docker-compose.yml that allows unauthenticated attackers to forge session tokens for any ac… |
CVE-2024-7952 | | | 2026-09-01 | A data exposure vulnerability exists in the affected product. There are hardcoded links in the source code that lead to JSON files that can be reached without… |
CVE-2026-18931 | Critical | 9.1 | 2026-09-01 | Use of Hard-coded Credentials vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software allows Retrieve Embedded Sensit… |
CVE-2026-38577 | Critical | 9.8 | 2026-08-31 | Insecure hardcoded credentials in the Admin account of Tenda HG21 V4.0.0-260302 allows attackers to gain root access. |
CVE-2026-82808 | High | 7.3 | 2026-08-31 | A vulnerability was identified in Inbox Foundry ActiveInbox Extension up to 7.10.24 on Chrome. Impacted is an unknown function of the file dist/service-worker… |
CVE-2026-82448 | Critical | 9.8 | 2026-08-29 | Shinobi before commit 5a76c74f contains a hardcoded connection key in the child node service that allows unauthenticated attackers to execute arbitrary databas… |
CVE-2026-19412 | | | 2026-08-28 | This vulnerability exists in the CP Plus CP-XR-DE21-S Router due to the presence of hardcoded HTTP Digest authentication credentials in the firmware that are i… |
CVE-2026-13086 | | | 2026-08-28 | A stack-based buffer overflow in the epm (Endpoint Protection Manager) service used by the deprecated Mobile Security feature in WatchGuard Fireware OS allows… |
CVE-2026-71396 | Medium | 5.4 | 2026-08-28 | Bendix EC80 Brake ECU uses hard-coded credentials, which could allow an attacker to disable automatic traction control. |
CVE-2026-37012 | High | 7.5 | 2026-08-27 | A vulnerability in pentestgpt/core/langfuse.py in PentestGPT 1.0.0 allows remote attackers to disclose sensitive user telemetry data via hardcoded API credenti… |
CVE-2026-78251 | | | 2026-08-27 | DJI drones contain an FTP service that uses hardcoded credentials shared across affected models and permits authenticated users to upload files without limits… |