CVE-2025-56802

CVE-2025-56802 AES-CFB Key Generation and Management Vulnerability in Reolink Desktop Application 1. Overview Name : Reolink Desktop Application Version : 8.18.12 Vendor : Reolink CWE : CWE-321: Use of Hard-coded Cryptographic Key, CWE-522: Insufficiently Protected Credentials CVSS : 5.1 MEDIUM...

CVE-2026-15469

🔑 CVE-2026-15469 Hard-coded Mesh Group Private Key — TP-Link Deco XE75 / XE5300 / WE10800 A shared RSA-512 mesh group private key is baked into the firmware, letting a LAN-adjacent attacker impersonate a trusted mesh node, overwrite configuration, flash unsigned firmware, and pivot across the...

CVE-2026-102812

A hard-coded cryptographic key vulnerability exists in the user-configuration backup mechanism of TP-Link RE305 V3 and Archer C7 V5. A fixed AES-128 key and initialization vector are embedded in the firmware configuration-management component. An attacker who obtains an affected configuration...

EUVD-2026-111271

A hard-coded cryptographic key vulnerability exists in the user-configuration backup mechanism of TP-Link RE305 V3 and Archer C7 V5. A fixed AES-128 key and initialization vector are embedded in the firmware configuration-management component. An attacker who obtains an affected configuration...

CVE-2024-53522

CVE-2024-53522 Exploit PoC for CVE-2024-53522 This repository contains the Proof of Concept PoC for CVE-2024-53522 , a vulnerability discovered by Safecloud Co., Ltd. For detailed information about the vulnerability, please refer to our blog post: CVE-2024-53522: HOSxP Software 0day Discover &...

CVE-2014-125135 OctoPrint Flask Secret Key hard-coded key

A security vulnerability has been detected in OctoPrint 1.0.0/1.1.0. Affected is an unknown function of the component Flask Secret Key Handler. Such manipulation leads to use of hard-coded cryptographic key . The attack may be performed from remote. Upgrading to version 1.11.1 is able to address...

CVE-2014-125135

OctoPrint versions 1.0.0 and 1.1.0 are vulnerable to a remote attack due to a hard-coded cryptographic key within the Flask Secret Key Handler component. This vulnerability, identified as CWE-321 and CWE-320 , allows for the use of a static key for cryptographic operations. Remediation is availab...

CVE-2014-125135 OctoPrint Flask Secret Key hard-coded key

A security vulnerability has been detected in OctoPrint 1.0.0/1.1.0. Affected is an unknown function of the component Flask Secret Key Handler. Such manipulation leads to use of hard-coded cryptographic key . The attack may be performed from remote. Upgrading to version 1.11.1 is able to address...

Gladinet CentreStack < 16.4.10315.56368 Use of Hard-coded Key Leads to Unauthenticated RCE

Gladinet CentreStack through 16.1.10296.56315 fixed in 16.4.10315.56368 has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited in the wild in March 2025. This enables threat actors who know the machineKey to serialize a payload for server-side...

CVE-2026-113466 MinIO Embedded Console common-main.go SessionTokenAuthenticate hard-coded key

A security vulnerability has been detected in MinIO up to RELEASE.2025-10-15T17-29-55Z. This issue affects the function globalDeploymentID/SessionTokenAuthenticate of the file cmd/common-main.go of the component Embedded Console. Such manipulation leads to use of hard-coded cryptographic key . It...

CVE-2026-113466

A security vulnerability exists in MinIO (up to RELEASE.2025-10-15T17-29-55Z) within the Embedded Console component. The flaw is located in the globalDeploymentID/SessionTokenAuthenticate function of the cmd/common-main.go file, which leads to the use of a hard-coded cryptographic key . This vuln...

CVE-2026-111633: Use of Hard-coded Cryptographic Key

ZKEACMS through 4.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge REST API JWT bearer tokens using a hard-coded HMAC-SHA256 signing key in JwtBearerDefaults.cs. Attackers can sign a token with the Name claim set to 'admin' to call ApiAuthorize...

CVE-2026-111612: Use of Hard-coded Cryptographic Key

netdisk-fast-download through 0.4.8 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve donated netdisk credentials via the /v2/randomAuth endpoint in ParserApi. Attackers can repeatedly call the endpoint and decrypt the encryptedAuth blob using the...

CVE-2026-111347: Use of Hard-coded Cryptographic Key

go-ldap-admin through 0.6.2 embeds a hard-coded RSA private key, published in the public repository, that protects encrypted login passwords. Unauthenticated attackers who capture encrypted passwords can decrypt them offline or via the /base/decryptpwd endpoint, recovering cleartext LDAP...

CVE-2026-110214 Snowy 3.6.5 Hard-coded Download Signature Key Allows Unauthenticated File Download

Snowy 3.6.5 contains a hard-coded HMAC key vulnerability that allows unauthenticated attackers to forge download signatures for the /dev/file/download endpoint by using the published FILEDOWNLOADSIGNSECRET constant. Attackers can compute HMAC-SHA256 signatures of guessed file ids offline to...

CVE-2026-110214 Snowy 3.6.5 Hard-coded Download Signature Key Allows Unauthenticated File Download

Snowy 3.6.5 contains a hard-coded HMAC key vulnerability that allows unauthenticated attackers to forge download signatures for the /dev/file/download endpoint by using the published FILEDOWNLOADSIGNSECRET constant. Attackers can compute HMAC-SHA256 signatures of guessed file ids offline to...

CVE-2026-85963 Server-side request forgery and hard-coded key in Progress MarkLogic Server OpsDirector

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 include deprecated OpsDirector functionality with weaknesses that could allow an unauthenticated remote attacker to make unauthorized requests to internal services or forge trusted requests, potentially resultin...

CVE-2026-85963

Progress MarkLogic Server is affected by a vulnerability in deprecated OpsDirector functionality in versions 12.x before 12.1.0 and 11.x before 11.3.7 . The weakness involves Server-Side Request Forgery (SSRF) and the use of a hard-coded cryptographic key , which could allow an unauthenticated re...

CVE-2026-85963 Server-side request forgery and hard-coded key in Progress MarkLogic Server OpsDirector

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 include deprecated OpsDirector functionality with weaknesses that could allow an unauthenticated remote attacker to make unauthorized requests to internal services or forge trusted requests, potentially resultin...

CVE-2026-108798

A vulnerability exists in ZKTeco BioTime 9.5.6 Build 20260130.3206 involving the use of a hard-coded cryptographic key during unknown processing. This flaw can be exploited via a remote attack to compromise cryptographic integrity. The vendor has not responded to the disclosure. No specific remed...