CVE-2026-86150

A security vulnerability has been detected in Tenda CP3 27.5.57.101. Impacted is an unknown function of the file custom-x/softap/hostapd. Such manipulation of the argument wpapassphrase leads to hard-coded credentials. The attack can be launched remotely. The exploit has been disclosed publicly a...

CVE-2026-86150

Tenda CP3 (firmware 27.5.57.101) is affected by a hard-coded credentials vulnerability in the file custom-x/softap/hostapd . Manipulation of the wpa_passphrase argument results in fixed credentials, which can be exploited remotely . The CVSS 4.0 score is 5.1 (Medium) with high privileges required...

CVE-2026-86150 Tenda CP3 hostapd hard-coded credentials

A security vulnerability has been detected in Tenda CP3 27.5.57.101. Impacted is an unknown function of the file custom-x/softap/hostapd. Such manipulation of the argument wpapassphrase leads to hard-coded credentials. The attack can be launched remotely. The exploit has been disclosed publicly a...

CVE-2026-86150 Tenda CP3 hostapd hard-coded credentials

A security vulnerability has been detected in Tenda CP3 27.5.57.101. Impacted is an unknown function of the file custom-x/softap/hostapd. Such manipulation of the argument wpapassphrase leads to hard-coded credentials. The attack can be launched remotely. The exploit has been disclosed publicly a...

Exploit for CVE-2026-18963

CVE-2026-18963-ke...

Attackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS Credentials

JetBrains is urging Cadence users to revoke and rotate all credentials following a security incident last month in which unidentified threat actors exploited a recently disclosed critical vulnerability in TeamCity to breach its own environment. "Cadence users should immediately revoke or rotate a...

CVE-2026-84221 Kirki 6.0.0 - 6.2.5 - Editor+ SQLi via Content Manager Field ID

The Kirki WordPress plugin before 6.3.0 does not escape a user-supplied identifier before using it in a SQL query, allowing users with editor-level access and above to append arbitrary SQL and read the contents of the database, including user credentials...

EUVD-2026-71845

The Search Atlas SEO WordPress plugin before 2.6.24 does not perform a nonce or capability check before processing a settings update in one of its early-priority handlers, allowing any authenticated user such as a Subscriber to overwrite or delete the site's stored Google service-account...

EUVD-2026-71773

Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a Missing Authorization vulnerability. This could allow an attacker to extract system credentials, configurations, or flash contents...

SUSE CVE-2026-73080

SeaweedFS is a distributed storage system. Prior to 4.24, VolumeServer.FetchAndWriteNeedle in weed/server/volumegrpcremote.go fetches a caller-supplied remote endpoint through weed/remotestorage/s3/s3storageclient.go and writes the response into a needle. The RPC performs no authentication and no...

CVE-2026-86175: Insufficiently Protected Credentials

NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authenticated users with only view permission can retrieve plaintext passwords and secret keys for Git and Amazon S3 backends through API endpoints, gaining unauthorized access to...

CVE-2026-15247: Missing Authorization

The Search Atlas SEO WordPress plugin before 2.6.24 does not perform a nonce or capability check before processing a settings update in one of its early-priority handlers, allowing any authenticated user such as a Subscriber to overwrite or delete the site's stored Google service-account...

CVE-2026-86150: Use of Hard-coded Credentials

A security vulnerability has been detected in Tenda CP3 27.5.57.101. Impacted is an unknown function of the file custom-x/softap/hostapd. Such manipulation of the argument wpapassphrase leads to hard-coded credentials. The attack can be launched remotely. The exploit has been disclosed publicly a...

PT-2026-86459

🚨 CVE-2026-86150 A security vulnerability has been detected in Tenda CP3 27.5.57.101. Impacted is an unknown function of the file custom-x/softap/hostapd. Such manipulation of the argument wpa passphrase leads to hard-coded credentials. The attack can be launched remotely. The exploit has been...

CVE-2026-77847

Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a use of hard-coded credential vulnerability. This could allow an attacker to intercept sensitive information or credentials...

CVE-2026-77847

Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior contain a hard-coded credential vulnerability. The flaw allows an attacker on an adjacent network to intercept sensitive information or credentials without requiring prior privileges (CVSS 3.1: 6.5 MEDIUM , CVSS 4.0: 7.1 HIGH ). The device...

CVE-2026-77847 Tycon Systems TPDIN-Monitor-WEB3 Use of Hard-coded Credentials

Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a use of hard-coded credential vulnerability. This could allow an attacker to intercept sensitive information or credentials...

CVE-2026-80114

PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a hard-coded credentials vulnerability in DirectIo64.sys that allows local attackers to perform arbitrary physical memory writes by extracting an 8-byte key embedded ...

EUVD-2026-71685

PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a hard-coded credentials vulnerability in DirectIo64.sys that allows local attackers to perform arbitrary physical memory writes by extracting an 8-byte key embedded ...

CVE-2026-80114 PassMark PerformanceTest, BurnInTest, and OSForensics Hard-coded Credentials Authentication Bypass via DirectIo64.sys

PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a hard-coded credentials vulnerability in DirectIo64.sys that allows local attackers to perform arbitrary physical memory writes by extracting an 8-byte key embedded ...