PT-2026-93120

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The software uses hard-coded credentials, which may allow an attacker to execute the ftpd service as root. This could result in unauthorized remote root file...

CVE-2026-16141: Use of Hard-coded Credentials

OpenBMC's IPMI implementation, phosphor-net-ipmid, contains a logic flaw in which an unauthenticated client can force the RAKP Message 1 handler to return before it overwrites the authentication object's constructor defaults. The IPMI service then accepts a RAKP Message 3 whose HMAC is computed...

CVE-2026-57147: Use of Hard-coded Credentials

PraisonAI is a multi-agent teams system. Prior to 0.1.6, praisonaiplatform/services/authservice.py assigns the public dev-secret-change-me value to JWTSECRET when PLATFORMJWTSECRET is unset, and its production guard does not run when PLATFORMENV is also unset because that setting defaults to dev....

CVE-2026-68950: Use of Hard-coded Credentials

The affected products use hard-coded credentials, which could allow an attacker to run the ftpd service as root, providing remote root file access where FTP is reachable...

PT-2026-93118

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The software contains hard-coded credentials. This flaw allows remote access to files with root privileges on systems where the FTP service is reachable...

CVE-2026-90509

A weakness has been identified in dromara orion-visor up to 2.5.7. Affected by this issue is the function ExposeApiAspect.beforeExposeApi of the file ExposeApiAspect.java. Executing a manipulation can lead to hard-coded credentials. The attack can be executed remotely. The exploit has been made...

CVE-2026-90509 dromara orion-visor ExposeApiAspect.java ExposeApiAspect.beforeExposeApi hard-coded credentials

A weakness has been identified in dromara orion-visor up to 2.5.7. Affected by this issue is the function ExposeApiAspect.beforeExposeApi of the file ExposeApiAspect.java. Executing a manipulation can lead to hard-coded credentials. The attack can be executed remotely. The exploit has been made...

CVE-2026-90509

A hard-coded credential weakness (CWE-798) exists in dromara orion-visor versions up to 2.5.7 , specifically in the function ExposeApiAspect.beforeExposeApi within ExposeApiAspect.java. The vulnerability allows a remote, unauthenticated attacker to exploit a hardcoded default token for authentica...

CVE-2026-90509 dromara orion-visor ExposeApiAspect.java ExposeApiAspect.beforeExposeApi hard-coded credentials

A weakness has been identified in dromara orion-visor up to 2.5.7. Affected by this issue is the function ExposeApiAspect.beforeExposeApi of the file ExposeApiAspect.java. Executing a manipulation can lead to hard-coded credentials. The attack can be executed remotely. The exploit has been made...

EUVD-2026-76982

A weakness has been identified in dromara orion-visor up to 2.5.7. Affected by this issue is the function ExposeApiAspect.beforeExposeApi of the file ExposeApiAspect.java. Executing a manipulation can lead to hard-coded credentials. The attack can be executed remotely. The exploit has been made...

CVE-2026-90509 dromara orion-visor ExposeApiAspect.java ExposeApiAspect.beforeExposeApi hard-coded credentials

A weakness has been identified in dromara orion-visor up to 2.5.7. Affected by this issue is the function ExposeApiAspect.beforeExposeApi of the file ExposeApiAspect.java. Executing a manipulation can lead to hard-coded credentials. The attack can be executed remotely. The exploit has been made...

CVE-2026-90509: Use of Hard-coded Credentials

A weakness has been identified in dromara orion-visor up to 2.5.7. Affected by this issue is the function ExposeApiAspect.beforeExposeApi of the file ExposeApiAspect.java. Executing a manipulation can lead to hard-coded credentials. The attack can be executed remotely. The exploit has been made...

PT-2026-90828

Name of the Vulnerable Software and Affected Versions dromara orion-visor versions prior to 2.5.8 Description A remote manipulation of the ExposeApiAspect.beforeExposeApi function within the ExposeApiAspect.java file can lead to the exposure of hard-coded credentials. Recommendations At the momen...

Use Of Hard-coded Credentials

centraldogma-server is vulnerable to Use of Hard-coded Credentials.The vulnerability is due to the server falling back to a publicly known hard-coded secret when replication.secret is not configured, which allows an attacker with network access to authenticate to the embedded ZooKeeper ensemble,...

CVE-2026-85083

CVE-2026-85083 affects the ANJIA AJL33PC0801 IP camera (CareCam Pro), which ships with a hard-coded credential used for bootloader authentication . The affected firmware is linuxlinux202008261138 svn13796 with U-Boot 2010.06 (compiled Aug 26, 2020). An attacker with physical access can exploit th...

CVE-2026-85083 CareCam Pro IP Cameras Use of Hard-coded Credentials

The ANJIA AJL33PC0801 IP camera uses a hard-coded credential for bootloader authentication. An attacker with physical access to the device may leverage this weakness to gain privileged bootloader access, allowing unauthorized modification of firmware and system configuration and potentially...

CVE-2026-85083 CareCam Pro IP Cameras Use of Hard-coded Credentials

The ANJIA AJL33PC0801 IP camera uses a hard-coded credential for bootloader authentication. An attacker with physical access to the device may leverage this weakness to gain privileged bootloader access, allowing unauthorized modification of firmware and system configuration and potentially...

CVE-2026-79396: Use of Hard-coded Credentials

Use of hardcoded default credentials in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier stores static account credentials in unencrypted plaintext within bin/config.xml and compiled into the Sofia executable, allowing remote attackers to gain full administrative control over...

CVE-2026-85083: Use of Hard-coded Credentials

The ANJIA AJL33PC0801 IP camera uses a hard-coded credential for bootloader authentication. An attacker with physical access to the device may leverage this weakness to gain privileged bootloader access, allowing unauthorized modification of firmware and system configuration and potentially...

CVE-2026-17038

DrEryk Gabinet before 11.5.0 uses hard-coded API credentials in its ticket reporting component. These credentials can be used to authenticate directly to the ticket system API. This allows an attacker to perform privileged operations beyond what is offered by the application, including reading an...