CVE-2026-18164: Use of Hard-coded Credentials

An undocumented hard-coded credential, shared by all device units, is authorized to bypass authentication. This allows an attacker within Bluetooth range to arbitrarily manipulate brain stimulation parameters and state...

CVE-2026-59507: Use of Hard-coded Credentials

: Use of Hard-coded Credentials : Exposure of Sensitive Information to an Unauthorized Actor : Improper Access Control vulnerability in Priority Portal Generator addon to Priority ERP developed by Soft Solutions. This issue affects Portal Generator addon to Priority ERP developed by Soft Solution...

CVE-2026-67614: Use of Hard-coded Credentials

CyberPanel before 3.0.0 contains a hard-coded JWT secret vulnerability in the WebTerminal FastAPI SSH service that allows unauthenticated remote attackers to forge valid authentication tokens and obtain an interactive root shell via WebSocket on port 8888. Attackers can craft a forged JWT signed...

Exploit for CVE-2021-43716

Epson EH-TW5350 Security Advisories B-BEAM-BOB Three vulner...

CVE-2026-14866: Use of Hard-coded Credentials

IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to injection of rogue certificate authority due to publicly writeable truststore...

CVE-2026-73519: Use of Hard-coded Credentials

WolfStack before 25.9.2 contains a hard-coded cluster-authentication secret compiled into every build and published as a constant in src/auth/mod.rs, allowing remote unauthenticated attackers to bypass authentication by supplying this value in the X-WolfStack-Secret header to the requireauth gate...

CVE-2026-67568 Mira Hormone Monitor, Mira Android App Use of Hard-coded Credentials

The distributed Mira Android APK v4.5.15.4 allows an attacker read/write access to reproductive health profiles from internet connected hosts, which could result in forgery, deletion, or destruction of health information...

CVE-2026-67568

The CVE-2026-67568 entry concerns Mira Android APK v4.5.15.4, where an attacker could read/write reproductive health profiles from internet-connected hosts, enabling forgery, deletion, or destruction of health information. Public metrics show a critical impact (CVSS 3.1/3.1: 9.1; CVSS 4.0/4.0: 9....

CVE-2026-67568 Mira Hormone Monitor, Mira Android App Use of Hard-coded Credentials

The distributed Mira Android APK v4.5.15.4 allows an attacker read/write access to reproductive health profiles from internet connected hosts, which could result in forgery, deletion, or destruction of health information...

CVE-2026-69102: Use of Hard-coded Credentials

MaxKey contains an unauthorized access vulnerability due to a hard-coded JWT signing secret in application-maxkey.properties that allows unauthenticated attackers to forge valid JWT tokens and authenticate as any user by exploiting the password-skipped login endpoint. Attackers can craft a JWT...

CVE-2026-67568: Use of Hard-coded Credentials

The distributed Mira Android APK v4.5.15.4 allows an attacker read/write access to reproductive health profiles from internet connected hosts, which could result in forgery, deletion, or destruction of health information...

CVE-2026-6374

Use of Hard-coded Credentials vulnerability in Zyxel Networks WAH7601 allows Read Sensitive Constants Within an Executable. This issue affects WAH7601: through 20.07.2026...

EUVD-2026-55619

Use of Hard-coded Credentials vulnerability in Zyxel Networks WAH7601 allows Read Sensitive Constants Within an Executable. This issue affects WAH7601: through 20.07.2026...

PT-2026-69483

Name of the Vulnerable Software and Affected Versions Zyxel Networks WAH7601 versions prior to 20.07.2026 Description The software contains hard-coded credentials, which allows an attacker to read sensitive constants within an executable. Recommendations Update Zyxel Networks WAH7601 to a version...

CVE-2026-6374: Use of Hard-coded Credentials

Use of Hard-coded Credentials vulnerability in Zyxel Networks WAH7601 allows Read Sensitive Constants Within an Executable. This issue affects WAH7601: through 20.07.2026...

CVE-2025-13293: Use of Hard-coded Credentials

A hard-coded or default root account credential in TBEA TLogger V2.1.0.0B0.0.0.0 allows an unauthenticated remote attacker to obtain root-level access to the device via the exposed SSH service. The root password can be recovered from the password hash stored in /etc/shadow and used to authenticat...

CVE-2026-49007: Use of Hard-coded Credentials

By accessing unencrypted information in the device firmware, an attacker can obtain the initial login credentials for the device's web interface...

CVE-2025-63823: Use of Hard-coded Credentials

My Safetipin Android Application 5.2.1 contains Hardcoded credentials in the authentication module, which allows remote attackers to bypass authentication and gain unauthorized access to user accounts via predictable OTP values...

CVE-2026-71238: Use of Hard-coded Credentials

DjangoCRM ships with its Django SECRETKEY hardcoded directly in the committed webcrm/settings.py rather than read from an environment variable. Since this key is used for session signing, CSRF token generation, and password reset tokens, anyone who reads the public repository can forge valid...

Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints

Summary A workspace tool shared with a read grant returned its full Python source to the recipient. Any authenticated non-admin who could use a shared tool could also read its source, including any user on the instance when a tool was shared publicly. Source is meant to be a writer-only tier: the...