CWE-798 · Use of Hard-coded Credentials (page 3)
Page 3 of 19 — CVEs classified under CWE-798, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-1612 | | 2026-03-30 | AL-KO Robolinho Update Software has hard-coded AWS Access and Secret keys that allow anyone to access AL-KO's AWS bucket. Using the keys directly might give th… | |
CVE-2025-9497 | Critical | 9.8 | 2026-03-28 | Use of Hard-coded Credentials vulnerability in Microchip Time Provider 4100 allows Malicious Manual Software Update.This issue affects Time Provider 4100: befo… |
CVE-2026-4993 | Low | 3.3 | 2026-03-28 | A vulnerability has been found in wandb OpenUI up to 0.0.0.0/1.0. This impacts an unknown function of the file backend/openui/config.py. The manipulation of th… |
CVE-2025-55263 | High | 7.3 | 2026-03-26 | HCL Aftermarket DPC is affected by Hardcoded Sensitive Data which allows attacker to gain access to the source code or if it is stored in insecure repositories… |
CVE-2025-55262 | High | 8.3 | 2026-03-26 | HCL Aftermarket DPC is affected by SQL Injection which allows attacker to exploit this vulnerability to retrieve sensitive information from the database. |
CVE-2025-12708 | Medium | 6.2 | 2026-03-25 | IBM Concert 1.0.0 through 2.2.0 contains hard-coded credentials that could be obtained by a local user. |
CVE-2026-27073 | High | 7.5 | 2026-03-25 | Use of Hard-coded Credentials vulnerability in Addi Addi – Cuotas que se adaptan a ti buy-now-pay-later-addi allows Password Recovery Exploitation.This issue a… |
CVE-2025-15605 | High | 7.3 | 2026-03-23 | A hardcoded cryptographic key within the configuration mechanism on TP-Link Archer NX200, NX210, NX500 and NX600 enables decryption and re-encryption of device… |
CVE-2026-4404 | Critical | 9.4 | 2026-03-23 | Use of hard coded credentials in GoHarbor Harbor version 2.15.0 and below, allows attackers to use the default password and gain access to the web UI. |
CVE-2026-1958 | | 2026-03-23 | Use of hard-coded credentials in Klinika XP and KlinikaXP Insertino allowed an unauthorized attacker access to several internal services. Critically, this incl… | |
CVE-2026-22900 | Critical | 9.8 | 2026-03-20 | A use of hard-coded credentials vulnerability has been reported to affect QuNetSwitch. The remote attackers can then exploit the vulnerability to gain unauthor… |
CVE-2026-33072 | High | 8.2 | 2026-03-20 | FileRise is a self-hosted web file manager / WebDAV server. In versions prior to 3.9.0, a hardcoded default encryption key (default_please_change_this_key) is… |
CVE-2026-4475 | High | 8.8 | 2026-03-20 | A vulnerability has been found in Yi Technology YI Home Camera 2 2.1.1_20171024151200. The affected element is an unknown function of the file home/web/ipc. Su… |
CVE-2026-30701 | Critical | 9.1 | 2026-03-18 | The web interface of the WiFi Extender WDR201A (HW V2.1, FW LFMZX28040922V1.02) contains hardcoded credential disclosure mechanisms (in the form of Server Side… |
CVE-2026-28674 | High | 7.2 | 2026-03-18 | xiaoheiFS is a self-hosted financial and operational system for cloud service businesses. In versions up to and including 0.3.15, the `AdminPaymentPluginUpload… |
CVE-2026-4219 | Low | 3.3 | 2026-03-16 | A flaw has been found in INDEX Conferences & Exhibitions Organization YWF BPOF APGCS App up to 1.0.2 on Android. Affected by this vulnerability is an unknown f… |
CVE-2026-4216 | Medium | 5.3 | 2026-03-16 | A weakness has been identified in i-SENS SmartLog App up to 2.6.8 on Android. This affects an unknown function of the component air.SmartLog.android. This mani… |
CVE-2016-20031 | Medium | 5.5 | 2026-03-16 | ZKTeco ZKBioSecurity 3.0 contains a local authorization bypass vulnerability in visLogin.jsp that allows attackers to authenticate without valid credentials by… |
CVE-2016-20026 | Critical | 9.8 | 2026-03-16 | ZKTeco ZKBioSecurity 3.0 contains hardcoded credentials in the bundled Apache Tomcat server that allow unauthenticated attackers to access the manager applicat… |
CVE-2026-3873 | High | 7.2 | 2026-03-13 | Use of Hard-coded Credentials vulnerability in Avantra allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Avantra: before 25… |
CVE-2026-32138 | High | 8.2 | 2026-03-12 | NEXULEAN is a cybersecurity portfolio & service platform for an Ethical Hacker, AI Enthusiast, and Penetration Tester. Prior to 2.0.0, a security vulnerability… |
CVE-2026-28255 | Critical | 9.8 | 2026-03-12 | A Use of Hard-coded Credentials vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an attacker to disclose sensitive information an… |
CVE-2019-25470 | High | 7.5 | 2026-03-11 | eWON Firmware versions 12.2 to 13.0 contain an authentication bypass vulnerability that allows attackers with minimal privileges to retrieve sensitive user dat… |
CVE-2026-24448 | Critical | 9.8 | 2026-03-11 | Use of hard-coded credentials issue exists in MR-GM5L-S1 and MR-GM5A-L1, which may allow an attacker to obtain administrative access. |
CVE-2023-27573 | Critical | 9.0 | 2026-03-11 | netbox-docker before 2.5.0 has a superuser account with default credentials (admin password for the admin account, and 0123456789abcdef0123456789abcdef01234567… |
CVE-2025-41710 | Medium | 6.5 | 2026-03-10 | An unauthenticated remote attacker may use hardcodes credentials to get access to the previously activated FTP Server with limited read and write privileges. |
CVE-2025-13957 | | 2026-03-10 | CWE-798: Use of Hard-coded Credentials vulnerability exists that could cause information disclosure and remote code execution when SOCKS Proxy is enabled, and… | |
CVE-2026-29023 | High | 7.3 | 2026-03-09 | Keygraph Shannon contains a hard-coded API key in its router configuration that, when the router component is enabled and exposed, allows network attackers to… |
CVE-2026-29128 | Critical | 10.0 | 2026-03-05 | IDC SFX2100 Satellite Receiver firmware ships with multiple daemon configuration files for routing components (e.g., zebra, bgpd, ospfd, and ripd) that are own… |
CVE-2026-29120 | High | 7.8 | 2026-03-04 | The /root/anaconda-ks.cfg installation configuration file in International Datacasting Corporation (IDC) SFX Series(SFX2100) SuperFlex Satellite Receiver insec… |
CVE-2026-29119 | Critical | 9.8 | 2026-03-04 | International Datacasting Corporation (IDC) SFX Series SuperFlex(SFX2100) SatelliteReceiver contains hardcoded and insecure credentials for the `admin` account… |
CVE-2026-28778 | Critical | 9.8 | 2026-03-04 | International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver contains undocumented, hardcoded/insecure credentials for the `xd` user acc… |
CVE-2026-28777 | Critical | 9.8 | 2026-03-04 | International Datacasting Corporation (IDC) SFX2100 Satellite Receiver, trivial password for the `user` (usr) account. A remote unauthenticated attacker can… |
CVE-2026-28776 | Critical | 9.8 | 2026-03-04 | International Datacasting Corporation (IDC) SFX Series SuperFlex SatelliteReceiver contains hardcoded credentials for the `monitor` account. A remote unauthent… |
CVE-2025-14923 | Medium | 4.7 | 2026-03-03 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.2 IBM WebSphere Application Server Liberty could provide weaker than expected security when… |
CVE-2024-55027 | High | 7.5 | 2026-03-03 | Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 was discovered to stroe credentials in plaintext in the component uac_temp.db. |
CVE-2024-55023 | Medium | 5.3 | 2026-03-03 | Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 was discovered to contain a hardcoded encryption key which could allow attackers to access sensitive informat… |
CVE-2024-55021 | High | 7.5 | 2026-03-03 | Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 was discovered to contain a hardcoded password in the FTP protocol. |
CVE-2026-27167 | Unrated | | 2026-02-27 | Gradio is an open-source Python package designed for quick prototyping. Starting in version 4.16.0 and prior to version 6.6.0, Gradio applications running outs… |
CVE-2025-1242 | Critical | 9.1 | 2026-02-25 | The administrative credentials can be extracted through application API responses, mobile application reverse engineering, and device firmware reverse engineer… |
CVE-2025-13776 | High | 7.1 | 2026-02-24 | Multiple Finka programs use hard-coded Firebird database credentials (shared across all instances of this software). A malicious attacker in local network who… |
CVE-2026-27507 | Critical | 9.8 | 2026-02-24 | Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior contain hard-coded administrative credentials that cannot be changed by users… |
CVE-2026-2635 | High | 7.3 | 2026-02-20 | MLflow Use of Default Password Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installatio… |
CVE-2025-67304 | Critical | 9.8 | 2026-02-19 | In Ruckus Network Director (RND) < 4.5.0.54, the OVA appliance contains hardcoded credentials for the ruckus PostgreSQL database user. In the default configura… |
CVE-2026-2702 | Low | 3.1 | 2026-02-19 | A security flaw has been discovered in Beetel 777VR1 up to 01.00.09. This issue affects some unknown processing of the component WPA2 PSK. Performing a manipul… |
CVE-2026-22769 | Critical | 10.0 | 2026-02-17 | Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability. This is considered critical as an unauthen… |
CVE-2025-33089 | Medium | 6.5 | 2026-02-17 | IBM Concert 1.0.0 through 2.1.0 could allow a remote attacker to obtain sensitive information or perform unauthorized actions due to the use of hard coded user… |
CVE-2026-23647 | Critical | 9.8 | 2026-02-17 | Glory RBG-100 recycler systems using the ISPK-08 software component contain hard-coded operating system credentials that allow remote authentication to the und… |
CVE-2026-2616 | High | 8.8 | 2026-02-17 | A vulnerability has been found in Beetel 777VR1 up to 01.00.09. The impacted element is an unknown function of the component Web Management Interface. The mani… |
CVE-2026-26334 | High | 7.8 | 2026-02-13 | Calero VeraSMART versions prior to 2026 R1 contain hardcoded static AES encryption keys within Veramark.Framework.dll (Veramark.Core.Config class). These keys… |
CVE-2019-25322 | High | 7.5 | 2026-02-12 | Heatmiser Netmonitor 3.03 contains a hardcoded credentials vulnerability in the networkSetup.htm page with predictable admin login credentials. Attackers can a… |
CVE-2026-26218 | Critical | 9.8 | 2026-02-12 | newbee-mall includes pre-seeded administrator accounts in its database initialization script. These accounts are provisioned with a predictable default passwor… |
CVE-2020-37135 | High | 7.5 | 2026-02-07 | AMSS++ 4.7 contains an authentication bypass vulnerability that allows attackers to access administrative accounts using hardcoded credentials. Attackers can l… |
CVE-2026-25803 | Critical | 9.8 | 2026-02-06 | 3DP-MANAGER is an inbound generator for 3x-ui. In version 2.0.1 and prior, the application automatically creates an administrative account with known default c… |
CVE-2026-2103 | High | 7.1 | 2026-02-06 | Infor SyteLine ERP uses hard-coded static cryptographic keys to encrypt stored credentials, including user passwords, database connection strings, and API keys… |
CVE-2026-20111 | Medium | 4.8 | 2026-02-04 | A vulnerability in the web-based management interface of Cisco Prime Infrastructure could allow an authenticated, remote attacker to conduct a stored cross-sit… |
CVE-2020-37092 | High | 7.5 | 2026-02-03 | Netis E1+ version 1.2.32533 contains a hardcoded root account vulnerability that allows unauthenticated attackers to access the device with predefined credenti… |
CVE-2025-69971 | Critical | 9.8 | 2026-02-03 | FUXA v1.2.7 contains a hard-coded credential vulnerability in server/api/jwt-helper.js. The application uses a hard-coded secret key to sign and verify JWT Tok… |
CVE-2026-25202 | Critical | 9.8 | 2026-02-02 | The database account and password are hardcoded, allowing login with the account to manipulate the database in MagicInfo9 Server.This issue affects MagicINFO 9… |
CVE-2026-1610 | High | 8.1 | 2026-01-29 | A vulnerability was found in Tenda AX12 Pro V2 16.03.49.24_cn. Affected by this issue is some unknown functionality of the component Telnet Service. Performing… |
CVE-2025-40537 | High | 7.5 | 2026-01-28 | SolarWinds Web Help Desk was found to be susceptible to a hardcoded credentials vulnerability that, under certain situations, could allow access to administrat… |
CVE-2026-24840 | High | 8.0 | 2026-01-28 | Dokploy is a free, self-hostable Platform as a Service (PaaS). In versions prior to 0.26.6, a hardcoded credential in the provided installation script (located… |
CVE-2026-24346 | Critical | 9.1 | 2026-01-27 | Use of well-known default credentials in Admin UI of EZCast Pro II version 1.17478.146 allows attackers to access protected areas in the web application |
CVE-2025-59107 | | 2026-01-26 | Dormakaba provides the software FWServiceTool to update the firmware version of the Access Managers via the network. The firmware in some instances is provided… | |
CVE-2025-59096 | | 2026-01-26 | The default password for the extended admin user mode in the application U9ExosAdmin.exe ("Kaba 9300 Administration") is hard-coded in multiple locations as we… | |
CVE-2025-59095 | | 2026-01-26 | The program libraries (DLL) and binaries used by exos 9300 contain multiple hard-coded secrets. One notable example is the function "EncryptAndDecrypt" in the… | |
CVE-2025-59092 | | 2026-01-26 | An RPC service, which is part of exos 9300, is reachable on port 4000, run by the process FSMobilePhoneInterface.exe. This service is used for interprocess com… | |
CVE-2025-59091 | | 2026-01-26 | Multiple hardcoded credentials have been identified, which are allowed to sign-in to the exos 9300 datapoint server running on port 1004 and 1005. This server… | |
CVE-2025-58744 | High | 7.5 | 2026-01-20 | Use of Default Credentials, Hard-coded Credentials vulnerability in C2SGlobalSettings.dll in Milner ImageDirector Capture on Windows allows decryption of do… |
CVE-2026-0622 | Medium | 6.5 | 2026-01-20 | Open 5GS WebUI uses a hard-coded JWT signing key (change-me) whenever the environment variable JWT_SECRET_KEY is unset |
CVE-2025-14115 | High | 8.4 | 2026-01-20 | IBM Sterling Connect:Direct for UNIX Container 6.3.0.0 through 6.3.0.6 Interim Fix 016, and 6.4.0.0 through 6.4.0.3 Interim Fix 019 IBM® Sterling Connect:Direc… |
CVE-2026-1221 | Critical | 9.8 | 2026-01-20 | PrismX MX100 AP controller developed by BROWAN COMMUNICATIONS has a Use of Hard-coded Credentials vulnerability, allowing unauthenticated remote attackers to… |
CVE-2021-47796 | Critical | 9.8 | 2026-01-16 | Denver SHC-150 Smart Wifi Camera contains a hardcoded telnet credential vulnerability that allows unauthenticated attackers to access a Linux shell. Attackers… |
CVE-2026-22911 | Medium | 5.3 | 2026-01-15 | Firmware update files may expose password hashes for system accounts, which could allow a remote attacker to recover credentials and gain unauthorized access t… |
CVE-2020-36911 | Critical | 9.8 | 2026-01-13 | Covenant 0.1.3 - 0.5 contains a remote code execution vulnerability that allows attackers to craft malicious JWT tokens with administrative privileges. Attacke… |
CVE-2025-69426 | | 2026-01-09 | The Ruckus vRIoT IoT Controller firmware versions prior to 3.0.0.0 (GA) contain hardcoded credentials for an operating system user account within an initializa… | |
CVE-2025-69425 | | 2026-01-09 | The Ruckus vRIoT IoT Controller firmware versions prior to 3.0.0.0 (GA) expose a command execution service on TCP port 2004 running with root privileges. Authe… | |
CVE-2025-7072 | | 2026-01-09 | The firmware in KAON CG3000TC and CG3000T routers contains hard-coded credentials in clear text (shared across all routers of this model) that an unauthenticat… | |
CVE-2019-25291 | High | 7.5 | 2026-01-08 | INIM Electronics Smartliving SmartLAN/G/SI <=6.x contains hard-coded credentials in its Linux distribution image that cannot be changed through normal device o… |
CVE-2017-20214 | High | 7.5 | 2026-01-08 | FLIR Thermal Camera F/FC/PT/D firmware version 8.0.0.64 contains hard-coded SSH credentials that cannot be changed through normal camera operations. Attackers… |
CVE-2020-36915 | High | 7.5 | 2026-01-06 | Adtec Digital SignEdje Digital Signage Player v2.08.28 contains multiple hardcoded default credentials that allow unauthenticated remote access to web, telnet… |
CVE-2021-47744 | High | 7.5 | 2025-12-31 | Cypress Solutions CTM-200/CTM-ONE 1.3.6 contains hard-coded credentials vulnerability in Linux distribution that exposes root access. Attackers can exploit the… |
CVE-2025-15371 | High | 7.8 | 2025-12-31 | A vulnerability has been found in Tenda i24, 4G03 Pro, 4G05, 4G08, G0-8G-PoE, Nova MW5G and TEG5328F up to 65.10.15.6. Affected is an unknown function of the c… |
CVE-2023-53983 | Critical | 9.8 | 2025-12-30 | Anevia Flamingo XL/XS 3.6.20 contains a critical vulnerability with weak default administrative credentials that can be easily guessed. Attackers can leverage… |
CVE-2022-50696 | Critical | 9.8 | 2025-12-30 | SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain hardcoded credentials embedded in server binaries that cannot be modified through normal device op… |
CVE-2025-68926 | Critical | 9.8 | 2025-12-30 | RustFS is a distributed object storage system built in Rust. In versions prior to 1.0.0-alpha.78, RustFS implements gRPC authentication using a hardcoded stati… |
CVE-2025-15107 | Low | 3.7 | 2025-12-27 | A security vulnerability has been detected in actiontech sqle up to 4.2511.0. The impacted element is an unknown function of the file sqle/utils/jwt.go of the… |
CVE-2025-15105 | Low | 3.7 | 2025-12-27 | A security flaw has been discovered in getmaxun maxun up to 0.0.28. Impacted is an unknown function of the file /getmaxun/maxun/blob/develop/server/src/routes/… |
CVE-2025-68948 | High | 8.1 | 2025-12-27 | SiYuan is self-hosted, open source personal knowledge management software. In versions 3.5.1 and prior, the SiYuan Note application utilizes a hardcoded crypto… |
CVE-2019-25241 | Critical | 9.8 | 2025-12-24 | FaceSentry Access Control System 6.4.8 contains a critical authentication vulnerability with hard-coded SSH credentials for the wwwuser account. Attackers can… |
CVE-2018-25138 | Critical | 9.8 | 2025-12-24 | FLIR AX8 Thermal Camera 1.32.16 contains hard-coded SSH and web panel credentials that cannot be changed through normal camera operations. Attackers can exploi… |
CVE-2025-33222 | Critical | 9.8 | 2025-12-23 | NVIDIA Isaac Launchable contains a vulnerability where an attacker could exploit a hard-coded credential issue. A successful exploit of this vulnerability migh… |
CVE-2025-67418 | Critical | 9.8 | 2025-12-22 | ClipBucket 5.5.2 is affected by an improper access control issue where the product is shipped or deployed with hardcoded default administrative credentials. An… |
CVE-2025-56157 | Critical | 9.8 | 2025-12-18 | Default credentials in Dify thru 1.5.1. PostgreSQL username and password specified in the docker-compose.yaml file included in its source code. NOTE: the Suppl… |
CVE-2025-7358 | High | 7.5 | 2025-12-18 | Use of Hard-coded Credentials vulnerability in Utarit Informatics Services Inc. SoliClub allows Authentication Abuse. This issue affects SoliClub: before 5.3… |
CVE-2025-1029 | High | 7.5 | 2025-12-18 | Use of Hard-coded Credentials vulnerability in Utarit Information Services Inc. SoliClub allows Read Sensitive Constants Within an Executable. This issue affe… |
CVE-2025-65855 | Medium | 6.6 | 2025-12-17 | The OTA firmware update mechanism in Netun Solutions HelpFlash IoT (firmware v18_178_221102_ASCII_PRO_1R5_50) uses hard-coded WiFi credentials identical across… |
CVE-2025-14096 | High | 8.4 | 2025-12-17 | A vulnerability exists in multiple Radiometer products that allow an attacker with physical access to the analyzer possibility to extract credential informatio… |
CVE-2025-67809 | Medium | 4.7 | 2025-12-15 | An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A hardcoded Flickr API key and secret are present in the publicly accessible Flickr Zimlet… |
CVE-2025-36752 | Critical | 9.8 | 2025-12-13 | Growatt ShineLan-X communication dongle has an undocumented backup account with undocumented credentials which allows significant level access to the device, s… |