Storage Concentrator (SC & SCVM) contains hardcoded credentials for numerous internal services...
CVE-2026-50110
Storage Concentrator (SC & SCVM) contains hardcoded credentials for numerous internal services embedded within a configu
#cwe-798
共收录 273 条相关情报。
← 返回所有主题Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses a weak hardcoded default secret ('flowise') for the express-session middleware when the EXPRESS_SESSION_SECRET e...
CVE-2026-56278
Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses a weak hardcoded default secret ('flowise') for the exp
Storage Concentrator (SC & SCVM) contains hardcoded credentials for numerous internal services embedded within a configuration file. While the credentials are stored in an encod...
CVE-2026-50110
Storage Concentrator (SC & SCVM) contains hardcoded credentials for numerous internal services embedded within a configu
The DMP-5000 devices are shipped with a default administrative web account with weak...
CVE-2026-31928
The DMP-5000 devices are shipped with a default administrative web account with weak authentication controls, which are
The DMP-5000 devices are shipped with a default administrative web account with weak authentication controls, which are not required to be changed during initial configuration o...
CVE-2026-31928
DMP-5000 设备在出厂时预置了默认的管理员 Web 账户，其认证机制非常薄弱，且初始配置或日常运行中不强制要求用户修改这些默认凭据。攻击者一旦获得这些默认凭据（例如通过互联网扫描、默认密码字典或数据泄露），即可远程登录设备的 Web
OpenProject is open-source, web-based project management software. Prior to , the official openproject/openproject Docker image ships ENV SECRET_KEY_BASE=OVERWRITE_ME as the def...
CVE-2026-46386
OpenProject is open-source, web-based project management software. Prior to , the official openproject/openproject Docke
Flowise before 3.1.0 (npm package flowise, versions 3.0.13 and earlier) uses a weak hardcoded default value 'Secre$t' for the TOKEN_HASH_SECRET environment variable in packages/...
CVE-2026-56269
Flowise before 3.1.0 (npm package flowise, versions 3.0.13 and earlier) uses a weak hardcoded default value 'Secre$t' fo
IBM Storage Protect Client 8.1.0.0 through 8.2.1.0 and IBM Storage Protect Snapshot For Windows 8...
CVE-2026-12628
IBM Storage Protect Client 8.1.0.0 through 8.2.1.0 and IBM Storage Protect Snapshot For Windows 8.1.0.0 through 8.2.1.0
IBM Storage Protect Client 8.1.0.0 through 8.2.1.0 and IBM Storage Protect Snapshot For Windows 8.1.0.0 through 8.2.1.0 could allow a remote attacker to bypass authentication du...
CVE-2026-12628
IBM Storage Protect Client 8.1.0.0 through 8.2.1.0 and IBM Storage Protect Snapshot For Windows 8.1.0.0 through 8.2.1.0
A vulnerability has been identified in centraldogma-server versions prior to 0.84.0, where enabling ZooKeeper replication without setting replication.secret causes the server to...
CVE-2026-11746
A vulnerability has been identified in centraldogma-server versions prior to 0.84.0, where enabling ZooKeeper replicatio
Crawl4AI before 0.8.7 contains an authentication bypass vulnerability due to a hardcoded default...
CVE-2026-56265
Crawl4AI before 0.8.7 contains an authentication bypass vulnerability due to a hardcoded default JWT signing key in the
Crawl4AI before 0.8.7 contains an authentication bypass vulnerability due to a hardcoded default JWT signing key in the Docker API server. Attackers who know the default key can...
CVE-2026-56265
Crawl4AI before 0.8.7 contains an authentication bypass vulnerability due to a hardcoded default JWT signing key in the
Bitnami MariaDB Galera container images and Helm chart are affected by a hardcoded default credential vulnerability in the Galera replication health-check user. The MARIADB_REPL...
CVE-2026-47847
Bitnami MariaDB Galera container images and Helm chart are affected by a hardcoded default credential vulnerability in t
Bitnami Cassandra container images are affected by a retained default superuser vulnerability. When a custom administrator account is configured via the CASSANDRA_USER environme...
CVE-2026-47846
Bitnami Cassandra container images are affected by a retained default superuser vulnerability. When a custom administrat
Worksnaps before version 1.6.20260201 contains hardcoded cloud credentials and related secret material in the Worksnaps client application binaries. The exposed credentials incl...
CVE-2025-10560
Worksnaps before version 1.6.20260201 contains hardcoded cloud credentials and related secret material in the Worksnaps
Use of Hard-coded Credentials vulnerability in Mitsubishi Electric Room Air Conditioners (for...
CVE-2026-5667
Use of Hard-coded Credentials vulnerability in Mitsubishi Electric Room Air Conditioners (for Japan and outside Japan);
The device has a webserver that exposes a REST API authenticated with a constant token. The...
CVE-2026-22312
The device has a webserver that exposes a REST API authenticated with a constant token. The unauthenticated API can be u
The device has a webserver that exposes a REST API authenticated with a constant token. The unauthenticated API can be used by an attacker to get access to system settings, modi...
CVE-2026-22312
CVE-2026-22312 是一个影响某未知厂商设备的严重漏洞。该设备运行的 Web 服务器暴露了一个 REST API，其身份验证依赖于一个硬编码的恒定令牌（constant token）。由于该令牌在实现中未有效更换或随机化，攻击者可
The Aqara IAM/SSO Gateway (gw-builder.aqara.com) used a hardcoded OAuth client credential, which is an instance of "CWE-798: Use of Hard-coded Credentials." This issue has an es...
CVE-2026-50083
The Aqara IAM/SSO Gateway (gw-builder.aqara.com) used a hardcoded OAuth client credential, which is an instance of "CWE-
The Yarbo Android and iOS applications contain hard-coded MQTT broker credentials that are identical for all users and all devices. These credentials are embedded in the applica...
CVE-2026-10557
The Yarbo Android and iOS applications contain hard-coded MQTT broker credentials that are identical for all users and a