CVE-2026-109813

A hard-coded cryptographic key vulnerability exists in the /usr/bin/sysman of some of Moxa's industrial computing products. An unauthenticated attacker with adjacent network access could exploit the exposed private key material to compromise the confidentiality and integrity of communications...

EUVD-2026-102594

A hard-coded cryptographic key vulnerability exists in the /usr/bin/sysman of some of Moxa's industrial computing products. An unauthenticated attacker with adjacent network access could exploit the exposed private key material to compromise the confidentiality and integrity of communications...

CVE-2026-109813

A hard-coded cryptographic key vulnerability exists in the /usr/bin/sysman component of certain Moxa industrial computing products . An unauthenticated attacker with adjacent network access can exploit the exposed private key material to compromise the confidentiality and integrity of communicati...

EUVD-2026-102507

BillionMail through 4.9 contains a hard-coded cryptographic key vulnerability that allows unauthenticated attackers to forge unsubscribe and subscribe-confirm JWTs by computing the key from shipped configuration constants. Attackers can submit forged tokens to /api/unsubscribe, /api/unsubscribene...

CVE-2026-111367

BillionMail through 4.9 contains a hard-coded cryptographic key vulnerability that allows unauthenticated attackers to forge unsubscribe and subscribe-confirm JWTs by computing the key from shipped configuration constants. Attackers can submit forged tokens to /api/unsubscribe, /api/unsubscribene...

CVE-2026-111367

BillionMail through version 4.9 contains a hard-coded cryptographic key vulnerability (CWE-1394 ) in its JWT implementation. Attackers can compute the cryptographic key from shipped configuration constants to forge unsubscribe and subscribe-confirm tokens. By submitting these forged tokens to the...

PT-2026-115307

Name of the Vulnerable Software and Affected Versions BillionMail versions prior to 5.0 Description An issue exists where a hard-coded cryptographic key allows unauthenticated attackers to forge JSON Web Tokens JWTs by calculating the key from provided configuration constants. Attackers can use...

CVE-2026-106172

A use of hard-coded cryptographic key vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4 all versions, FortiSandbox Cloud 5.2.0 through 5.2.1, FortiSandbox Cloud 5.0.0 through 5.0.6, FortiSandbox Cloud 4.4 all versions may allow attacker...

CVE-2026-106172

A use of hard-coded cryptographic key vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4 all versions, FortiSandbox Cloud 5.2.0 through 5.2.1, FortiSandbox Cloud 5.0.0 through 5.0.6, FortiSandbox Cloud 4.4 all versions may allow attacker...

CVE-2026-106172

A use of hard-coded cryptographic key vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4 all versions, FortiSandbox Cloud 5.2.0 through 5.2.1, FortiSandbox Cloud 5.0.0 through 5.0.6, FortiSandbox Cloud 4.4 all versions may allow attacker...

CVE-2026-106172

Fortinet FortiSandbox and FortiSandbox Cloud products are vulnerable to a use of hard-coded cryptographic key (CWE-321). This vulnerability affects FortiSandbox versions 5.2.0 through 5.2.1 , 5.0.0 through 5.0.6 , and all 4.4 versions , as well as FortiSandbox Cloud versions 5.2.0 through 5.2.1 ,...

CVE-2026-110214: Use of Hard-coded Cryptographic Key

Snowy 3.6.5 contains a hard-coded HMAC key vulnerability that allows unauthenticated attackers to forge download signatures for the /dev/file/download endpoint by using the published FILEDOWNLOADSIGNSECRET constant. Attackers can compute HMAC-SHA256 signatures of guessed file ids offline to...

CVE-2026-106172: Use of Hard-coded Cryptographic Key

A use of hard-coded cryptographic key vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4 all versions, FortiSandbox Cloud 5.2.0 through 5.2.1, FortiSandbox Cloud 5.0.0 through 5.0.6, FortiSandbox Cloud 4.4 all versions may allow attacker...

PT-2026-111782

Name of the Vulnerable Software and Affected Versions FortiSandbox versions 5.2.0 through 5.2.1 FortiSandbox versions 5.0.0 through 5.0.6 FortiSandbox version 4.4 FortiSandbox Cloud versions 5.2.0 through 5.2.1 FortiSandbox Cloud versions 5.0.0 through 5.0.6 FortiSandbox Cloud version 4.4...

CVE-2026-108798

A vulnerability was found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This issue affects some unknown processing. The manipulation results in use of hard-coded cryptographic key . The attack may be launched remotely. Upgrading to version 9.5.6 Build 3623 is capable of addressing this issue. It i...

EUVD-2026-97169

A vulnerability was found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This issue affects some unknown processing. The manipulation results in use of hard-coded cryptographic key . The attack may be launched remotely. The vendor was contacted early about this disclosure but did not respond in any...

CVE-2026-108798 ZKTeco BioTime hard-coded key

A vulnerability was found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This issue affects some unknown processing. The manipulation results in use of hard-coded cryptographic key . The attack may be launched remotely. Upgrading to version 9.5.6 Build 3623 is capable of addressing this issue. It i...

CVE-2026-109424: Use of Hard-coded Cryptographic Key

NetEase Cloud Music client for Windows cloudmusic.exe versions 3.1.38 and 3.1.39.205426 contains a weak encryption vulnerability where /eapi/ and /xeapi/ API response bodies are decrypted using a fixed, publicly documented AES-128-ECB key with no integrity credential. Attackers who can intercept ...

PT-2026-110438

Name of the Vulnerable Software and Affected Versions ZKTeco BioTime version 9.5.6 Build 20260130.3206 Description A remote attack can be launched to manipulate unknown processing, resulting in the use of a hard-coded cryptographic key. Recommendations At the moment, there is no information about...

CVE-2026-108798: Use of Hard-coded Cryptographic Key

A vulnerability was found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This issue affects some unknown processing. The manipulation results in use of hard-coded cryptographic key . The attack may be launched remotely. Upgrading to version 9.5.6 Build 3623 is capable of addressing this issue. It i...