CWE-798 · Use of Hard-coded Credentials (page 2)
Page 2 of 19 — CVEs classified under CWE-798, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-63239 | Medium | 5.4 | 2026-07-29 | A hard-coded AWS IAM credentials vulnerability in Koollab LMS allowed an attacker to access shared multi-tenant S3 buckets and SQS queues, exposing sensitive d… |
CVE-2026-13463 | High | 7.5 | 2026-07-28 | IBM Cloud Pak System 2.3.5.0 could allow a local attacker to obtain sensitive information due to the insertion of credentials into log files. |
CVE-2021-32087 | High | 8.8 | 2026-07-27 | An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It installs with default user credentials. The kbftp account has a password… |
CVE-2021-32085 | High | 8.8 | 2026-07-27 | An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It installs with default user credentials. The report and R1 MySQL accounts… |
CVE-2026-12001 | | 2026-07-27 | A hardcoded credential vulnerability exists in the firmware of multiple TP-Link routers (TL-WR845N v4, TL-WR850N v3, TL-WR902AC v4, Archer C20 v6 & Archer MR20… | |
CVE-2026-55579 | Critical | 9.8 | 2026-07-27 | Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, Pheditor ships with a hardcoded default password… |
CVE-2025-59180 | | 2026-07-27 | Ericsson Packet Core Controller (PCC) versions prior to 1.38 contain a hardcoded credential vulnerability in the alarm system. An attacker with access to the c… | |
CVE-2026-65879 | Critical | 9.8 | 2026-07-27 | Joomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wide secret in SP Page Builder < 6.7.1 - A hardcoded secret allowed att… |
CVE-2026-8983 | Critical | 9.8 | 2026-07-21 | Autel Maxi Charger Single firmware through V1.03.51 contains a hard-coded authentication token that bypasses authorization checks for multiple management endpo… |
CVE-2026-8982 | High | 8.1 | 2026-07-21 | Two undocumented privileged accounts exist in Autel Maxi Charger Single firmware through V1.03.51. The accounts use vendor-defined password derivation mechanis… |
CVE-2026-47410 | Critical | 9.8 | 2026-07-21 | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an insecure default cryptographic key. The JW… |
CVE-2026-47255 | High | 8.2 | 2026-07-20 | AgenticMail gives AI agents real email addresses and phone numbers. @agenticmail/api prior to version 0.9.32 and @agenticmail/core prior to version 0.9.10 had… |
CVE-2026-13446 | Critical | 9.8 | 2026-07-17 | IBM Langflow OSS 1.0.0 through 1.10.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authenticatio… |
CVE-2024-32387 | Medium | 5.7 | 2026-07-16 | An issue in Kerlink Kerlink Wirnet iStation 868 KerOS v.4.3.3_20200803132042 allows a remote attacker to obtain sensitive information via the community string… |
CVE-2026-45336 | Critical | 10.0 | 2026-07-16 | HireFlow is a web-based interview management system for managing candidates, scheduling interviews, and tracking hiring progress. In 1.2 and earlier, app.py as… |
CVE-2026-49352 | Critical | 9.8 | 2026-07-15 | 9Router is an AI router & token saver. From 0.2.21 until 0.4.44, 9Router used the hardcoded fallback JWT secret 9router-default-secret-change-me in src/app/api… |
CVE-2026-61740 | | 2026-07-15 | LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.4, when LightRAG is deployed with LIGHTRAG_API_KEY set but AUTH_ACCOUNTS unset… | |
CVE-2026-61684 | | 2026-07-15 | FastGPT is a knowledge-based AI application platform. In 4.15.0-beta4, FastGPT plugin invoke reverse-call endpoints under /api/invoke/* authenticate only by ve… | |
CVE-2026-37270 | Critical | 9.8 | 2026-07-07 | Trueview Security camera T18161- AF v4.9.60.0 contains an authentication bypass vulnerability caused by improper password validation and the presence of hard-c… |
CVE-2026-57172 | | 2026-07-07 | DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, ShareSecretManage uses a hardcoded default share link signature key, allowin… | |
CVE-2026-14807 | Critical | 9.8 | 2026-07-06 | ERP App developed by PROG MIS has a Use of Hard-coded Credentials vulnerability, allowing unauthenticated remote attackers to log in to view application code a… |
CVE-2026-13768 | Critical | 10.0 | 2026-07-03 | Gardyn devices expose a privileged iothubowner key. Access to this key will allow a malicious user to invoke an IoTHub Registry Manager function which returns… |
CVE-2026-13728 | Medium | 4.4 | 2026-07-03 | In exception circumstances, WatchGuard Fireware OS on a FireCluster may use a hard-coded encryption key to encrypt saved credentials for Access Portal resource… |
CVE-2026-7839 | Critical | 9.1 | 2026-07-01 | UltraVNC repeater through 1.8.2.2 initializes the HTTP administration server with a hardcoded default password. In repeater/webgui/settings.c:197, when setting… |
CVE-2026-56278 | Critical | 9.1 | 2026-06-30 | Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses a weak hardcoded default secret ('flowise') for the express-session middleware when the EXPRES… |
CVE-2026-50110 | Critical | 9.2 | 2026-06-30 | Storage Concentrator (SC & SCVM) contains hardcoded credentials for numerous internal services embedded within a configuration file. While the credentials are… |
CVE-2026-31928 | High | 8.1 | 2026-06-26 | The DMP-5000 devices are shipped with a default administrative web account with weak authentication controls, which are not required to be changed during initi… |
CVE-2026-46386 | Critical | 9.9 | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to , the official openproject/openproject Docker image ships ENV SECRET_KEY_BASE=OVERW… |
CVE-2026-56269 | Medium | 4.6 | 2026-06-24 | Flowise before 3.1.0 (npm package flowise, versions 3.0.13 and earlier) uses a weak hardcoded default value 'Secre$t' for the TOKEN_HASH_SECRET environment var… |
CVE-2026-12628 | Critical | 9.1 | 2026-06-22 | IBM Storage Protect Client 8.1.0.0 through 8.2.1.0 and IBM Storage Protect Snapshot For Windows 8.1.0.0 through 8.2.1.0 could allow a remote attacker to bypass… |
CVE-2026-11746 | | 2026-06-22 | A vulnerability has been identified in centraldogma-server versions prior to 0.84.0, where enabling ZooKeeper replication without setting replication.secret ca… | |
CVE-2026-56265 | Critical | 9.8 | 2026-06-21 | Crawl4AI before 0.8.7 contains an authentication bypass vulnerability due to a hardcoded default JWT signing key in the Docker API server. Attackers who know t… |
CVE-2026-47847 | Medium | 5.3 | 2026-06-18 | Bitnami MariaDB Galera container images and Helm chart are affected by a hardcoded default credential vulnerability in the Galera replication health-check user… |
CVE-2026-47846 | Critical | 9.8 | 2026-06-18 | Bitnami Cassandra container images are affected by a retained default superuser vulnerability. When a custom administrator account is configured via the CASSAN… |
CVE-2025-10560 | | 2026-06-18 | Worksnaps before version 1.6.20260201 contains hardcoded cloud credentials and related secret material in the Worksnaps client application binaries. The expose… | |
CVE-2026-5667 | | 2026-06-17 | Use of Hard-coded Credentials vulnerability in Mitsubishi Electric Room Air Conditioners (for Japan and outside Japan); Wireless LAN Adapters for Room Air Cond… | |
CVE-2026-22312 | High | 8.6 | 2026-06-16 | The device has a webserver that exposes a REST API authenticated with a constant token. The unauthenticated API can be used by an attacker to get access to sys… |
CVE-2026-9260 | Medium | 6.2 | 2026-06-16 | Use of hard-coded cryptographic keys in Canon EOS Network Setting Tool Version 1.5.0 or earlier |
CVE-2026-50091 | Critical | 9.1 | 2026-06-12 | Aqara Home Android (com.lumiunited.aqarahome) 6.0.0 (and white-label clients embedding the same liblumidevsdk.so) uses hard-coded cryptographic keys, which is… |
CVE-2026-50083 | Critical | 9.1 | 2026-06-12 | The Aqara IAM/SSO Gateway (gw-builder.aqara.com) used a hardcoded OAuth client credential, which is an instance of "CWE-798: Use of Hard-coded Credentials." Th… |
CVE-2026-10557 | Critical | 9.8 | 2026-06-12 | The Yarbo Android and iOS applications contain hard-coded MQTT broker credentials that are identical for all users and all devices. These credentials are embed… |
CVE-2026-11849 | Critical | 9.8 | 2026-06-12 | The iRM-IEI Remote Management developed by IEI Integration Corp has a Hardcoded Credentials vulnerability, allowing unauthenticated remote attackers to exploi… |
CVE-2026-47281 | Critical | 9.6 | 2026-06-09 | Missing authorization in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-11414 | Critical | 9.8 | 2026-06-05 | A hard-coded cryptographic key is used by Altium Enterprise Server to sign file download URLs in the Vault service. Because the key is identical across all ins… |
CVE-2025-71317 | Critical | 9.8 | 2026-06-05 | NetMan 204 contains a hard-coded backdoor account with the username and password 'eurek' that grants administrative access. A remote, unauthenticated attacker… |
CVE-2026-21404 | Medium | 6.3 | 2026-06-04 | NAVTOR NavBox through version 4.16.1.20 contains hard-coded credentials within its Windows Communication Foundation (SOAP) implementation. If the SOAP function… |
CVE-2026-50213 | High | 7.5 | 2026-06-04 | The account validation endpoint /v1/User/validate returns comprehensive user profile data sheets, which can be crawled by iterating predictable identification… |
CVE-2026-49204 | Medium | 6.5 | 2026-06-04 | Leftover debug modules contain fixed credentials for internal AWS Cognito test sandboxes, risking asset exploitation. |
CVE-2026-8876 | High | 7.3 | 2026-06-03 | Version 3.0.7 of the Securly Chrome Extension contains hardcoded, plaintext AES passphrases in securly.min.js. These keys decrypt crisis alert keyword data and… |
CVE-2026-36616 | Medium | 5.9 | 2026-06-03 | Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 contains hardcoded WiFi driver credentials including a RADIUS shared secret, WPS test key, and default… |
CVE-2026-36606 | High | 7.1 | 2026-06-03 | Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 encrypts configuration backups with a hardcoded DES key using single DES in ECB mode. An attack… |
CVE-2019-25722 | High | 7.6 | 2026-06-02 | Dräger SC Monitoring devices (SC 6002XL, SC 6802XL, SC 7000, SC 8000, SC 9000 XL) contain hard-coded plaintext credentials in source code and a denial-of-servi… |
CVE-2026-42251 | | 2026-06-01 | Use of hard-coded credentials in KS-SOMED allowed an unauthorized attacker access to FTP server that hosted the application's update packages. The attacker wit… | |
CVE-2026-25600 | Medium | 6.4 | 2026-06-01 | The PDBM application relies on a static, hard‑coded secret embedded in the PDBM.exe executable. This secret is used by the application’s encryption routines… |
CVE-2026-44825 | High | 8.1 | 2026-06-01 | Hardcoded credentials in the Basic Authentication setup tool (bin/solr auth enable) in Apache Solr versions 9.4.0 through 9.10.1 and 10.0.0 allows a remote att… |
CVE-2026-42929 | High | 8.3 | 2026-05-29 | Danelec MacGregor Voyage Data Recorder includes default accounts with hard-coded credentials. |
CVE-2026-7786 | Critical | 9.8 | 2026-05-29 | Jinan USR IOT Technology Limited (PUSR) USR-W610 RS232/485 to Wi-Fi/Ethernet Converter device firmware contains plaintext administrative credentials embedded i… |
CVE-2026-45631 | Critical | 10.0 | 2026-05-29 | Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.27.0 to before 0.29.3, a hardcoded BETTER_AUTH_SECRET fallback ("better-auth-secret-12345… |
CVE-2026-46376 | Critical | 9.8 | 2026-05-29 | FreePBX is an open source IP PBX. From 15.0.42 to before 16.0.45 and 17.0.7, unauthenticated users may be able to access the User Control Panel (UCP) using har… |
CVE-2026-49323 | Medium | 4.3 | 2026-05-29 | Weak authentication between the Wireless Control Module (WCM) and the Engine Control Module (ECM) of the Indian Motorcycle Scout Bobber + Tech 2025 model year… |
CVE-2026-49201 | Critical | 9.8 | 2026-05-29 | The upload.cgi binary, responsible for processing device backups, contains a hardcoded AES encryption key. This allows an attacker to decrypt, modify, and re-e… |
CVE-2026-45039 | Critical | 9.8 | 2026-05-28 | RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, the internode RPC layer authenticates every request with an HMAC-SHA256 sig… |
CVE-2026-24444 | Critical | 9.8 | 2026-05-28 | SDMC NE6037 cable modem routers running firmware 7.1.6.0.25 and 7.1.6.1.9_B9 contain a hardcoded password vulnerability in the web management interface recover… |
CVE-2026-5065 | High | 8.8 | 2026-05-27 | IBM Controller 11.0.1, 11.1.0, 11.1.1, and 11.1.2 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound a… |
CVE-2026-36538 | High | 7.3 | 2026-05-27 | Netis AC1200 Router NC21 V4.0.1.4296 contains a hard-coded root credential stored in /etc/shadow.sample. The password for the root account is set to the trivia… |
CVE-2026-48245 | Medium | 5.3 | 2026-05-21 | Open ISES Tickets before 3.44.2 embeds a hardcoded Google Maps API key in tables.php that is committed to the public source repository. The key can be extracte… |
CVE-2026-48244 | Medium | 5.3 | 2026-05-21 | Open ISES Tickets before 3.44.2 embeds a hardcoded Google Maps API key in settings.inc.php that is committed to the public source repository. The key can be ex… |
CVE-2026-48243 | Medium | 5.3 | 2026-05-21 | Open ISES Tickets before 3.44.2 embeds a hardcoded WhitePages reverse-phone API key in wp1.php that is committed to the public source repository. Any actor wit… |
CVE-2026-48242 | High | 8.1 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains hardcoded MySQL database connection credentials (host, username, password, database name) in import_mdb.php. The crede… |
CVE-2026-48241 | High | 8.1 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains hardcoded MySQL database credentials in loader.php (a public-facing database utility) that are committed to the source… |
CVE-2026-9139 | Critical | 9.8 | 2026-05-20 | Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contains a hard-coded credential vulnerability in the embedded web configuration interface where authentic… |
CVE-2026-8605 | Critical | 9.8 | 2026-05-19 | In ScadaBR version 1.2.0, a Use of Hard-Coded Credentials vulnerability could allow an attacker to access the SCADA system as admin. |
CVE-2025-68421 | | 2026-05-14 | Comarch ERP Optima client makes use of a hard-coded password for a database user. These credentials cannot be changed. It is possible for a remote attacker to… | |
CVE-2020-37220 | High | 7.5 | 2026-05-13 | Huawei HG630 V2 router contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain administrative access by retrieving the… |
CVE-2026-33893 | High | 7.5 | 2026-05-12 | A vulnerability has been identified in Teamcenter V2312 (All versions < V2312.0014), Teamcenter V2406 (All versions < V2406.0012), Teamcenter V2412 (All versio… |
CVE-2026-42869 | Critical | 10.0 | 2026-05-11 | SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.57, SOCFortress CoPilot ships a hardcoded… |
CVE-2026-40636 | Critical | 9.8 | 2026-05-11 | Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains a use of hard-coded credentials vulnerability. An unauthenti… |
CVE-2024-46508 | High | 7.5 | 2026-05-08 | yeti-platform yeti before 2.1.12 allows attackers to generate valid JWT tokens is the secret is not changed (by setting YETI_AUTH_SECRET_KEY to a value other t… |
CVE-2026-7414 | Critical | 9.8 | 2026-05-07 | Yarbo firmware v2.3.9 contains hardcoded administrative credentials embedded in the firmware image. These credentials are identical across all devices running… |
CVE-2026-8032 | High | 7.3 | 2026-05-06 | A flaw has been found in PicoTronica e-Clinic Healthcare System ECHS 5.7. The impacted element is an unknown function of the file /cdemos/echs/priv/echs.js. Th… |
CVE-2026-32834 | High | 7.5 | 2026-05-04 | Easy PayPal Events & Tickets plugin for WordPress before version 1.4 contains a hardcoded authentication bypass vulnerability in the QR code scanning functiona… |
CVE-2026-42376 | Critical | 9.8 | 2026-05-04 | D-Link DIR-456U Hardware Revision A1 (End-of-Life, EOL) contains a hardcoded telnet backdoor. The device starts a telnet daemon at boot via /etc/init0.d/S80tel… |
CVE-2026-42375 | Critical | 9.8 | 2026-05-04 | D-Link DIR-600L Hardware Revision A1 (End-of-Life) contains a hardcoded telnet backdoor. The device starts a telnet daemon at boot via /bin/telnetd.sh with the… |
CVE-2026-42374 | Critical | 9.8 | 2026-05-04 | D-Link DIR-600L Hardware Revision B1 (End-of-Life) contains a hardcoded telnet backdoor. The device starts a telnet daemon at boot via /bin/telnetd.sh with the… |
CVE-2026-42373 | Critical | 9.8 | 2026-05-04 | D-Link DIR-605L Hardware Revision B2 (End-of-Life, EOL) contains a hardcoded telnet backdoor. The device starts a telnet daemon at boot via /bin/telnetd.sh wit… |
CVE-2026-42372 | High | 8.8 | 2026-05-04 | D-Link DIR-605L Hardware Revision A1 (End-of-Life, EOL) contains a hardcoded telnet backdoor. The device starts a telnet daemon at boot via /bin/telnetd.sh wit… |
CVE-2026-7579 | High | 7.3 | 2026-05-01 | A security vulnerability has been detected in AstrBotDevs AstrBot up to 4.16.0. This issue affects some unknown processing of the file astrbot/dashboard/routes… |
CVE-2026-41446 | Critical | 9.8 | 2026-04-28 | Snap One WattBox 800 and 820 series firmware versions prior to 2.10.0.0 contain undisclosed diagnostic HTTP endpoints that require only the device MAC address… |
CVE-2026-27785 | High | 8.8 | 2026-04-28 | Specific firmware versions of Milesight AIOT camera firmware contain hard-coded credentials. |
CVE-2026-35503 | Critical | 9.8 | 2026-04-24 | A vulnerability in SenseLive X3050’s web management interface allows authentication logic to be performed entirely on the client side, relying on hardcoded val… |
CVE-2026-6610 | Low | 3.7 | 2026-04-20 | A vulnerability has been found in liangliangyy DjangoBlog up to 2.1.0.0. The impacted element is an unknown function of the file djangoblog/settings.py of the… |
CVE-2026-6578 | Medium | 5.6 | 2026-04-19 | A security flaw has been discovered in liangliangyy DjangoBlog up to 2.1.0.0. This affects an unknown function of the file djangoblog/settings.py of the compon… |
CVE-2026-6574 | High | 7.3 | 2026-04-19 | A vulnerability has been found in osuuu LightPicture up to 1.2.2. This issue affects some unknown processing of the file /public/install/lp.sql of the componen… |
CVE-2026-5189 | Critical | 9.8 | 2026-04-15 | CWE-798: Use of Hard-coded Credentials in Sonatype Nexus Repository Manager versions 3.0.0 through 3.70.5 allows an unauthenticated attacker with network acces… |
CVE-2026-4832 | | 2026-04-14 | CWE-798 Use of Hard-coded Credentials vulnerability exists that could cause unauthorized access to sensitive device information when an unauthenticated attacke… | |
CVE-2026-23781 | Critical | 9.8 | 2026-04-10 | An issue was discovered in BMC Control-M/MFT 9.0.20 through 9.0.22. A set of default debug user credentials is hardcoded in cleartext within the application pa… |
CVE-2026-1233 | High | 7.5 | 2026-04-04 | The Text to Speech for WP (AI Voices by Mementor) plugin for WordPress is vulnerable to sensitive information exposure in all versions up to, and including, 1… |
CVE-2017-20234 | Critical | 9.8 | 2026-04-03 | GarrettCom Magnum 6K and 10K managed switches contain an authentication bypass vulnerability that allows unauthenticated attackers to gain unauthorized access… |
CVE-2025-10681 | High | 8.6 | 2026-04-03 | Storage credentials are hardcoded in the mobile app and device firmware. These credentials do not adequately limit end user permissions and do not expire withi… |
CVE-2026-25601 | Medium | 6.4 | 2026-04-01 | A vulnerability was identified in MEPIS RM, an industrial software product developed by Metronik. The application contained a hardcoded cryptographic key withi… |