CVE-2026-112014 LobsterAI before 2026.10.16 Hardcoded Password in Provider API Key Export

LobsterAI before 2026.10.16 contains a hardcoded password vulnerability that allows attackers to decrypt exported provider API keys encrypted with the constant 'lobsterai-APP'. Attackers who obtain a providers export file can derive the AES-GCM key via PBKDF2 using the embedded salt and recover...

PT-2026-116618

Name of the Vulnerable Software and Affected Versions LobsterAI versions prior to 2026.10.16 Description An issue exists where exported provider API keys are encrypted using a hardcoded password 'lobsterai-APP'. An attacker who obtains a provider export file can use this constant with PBKDF2 a ke...

CVE-2026-85488

Brocade ASCG before 3.5.0 has a well-known Brocade default password embedded in a script distributed to every customer. Any local authenticated user with read access to the installation path can discover this credential and perform privilege escalation on affected Open Virtual Appliance OVA...

CVE-2026-62252 Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Login

Homer is open source telecom observability software. Prior to version 11.0.283, on every fresh Homer deployment using internal authentication, the bootstrap process automatically creates an admin account with the password sipcapture stored as a legacy SHA-256 hex hash. There is no first-login...

CVE-2026-62252 Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Login

Homer is open source telecom observability software. Prior to version 11.0.283, on every fresh Homer deployment using internal authentication, the bootstrap process automatically creates an admin account with the password sipcapture stored as a legacy SHA-256 hex hash. There is no first-login...

CVE-2026-62252 Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Login

Homer is open source telecom observability software. Prior to version 11.0.283, on every fresh Homer deployment using internal authentication, the bootstrap process automatically creates an admin account with the password sipcapture stored as a legacy SHA-256 hex hash. There is no first-login...

CVE-2026-62252

Homer , an open-source telecom observability software, contains a hardcoded default admin password vulnerability in versions prior to 11.0.283 . The bootstrap process automatically creates an admin account with the password sipcapture (stored as a legacy SHA-256 hex hash) when using internal auth...

EUVD-2026-94455

Homer is open source telecom observability software. Prior to version 11.0.283, on every fresh Homer deployment using internal authentication, the bootstrap process automatically creates an admin account with the password sipcapture stored as a legacy SHA-256 hex hash. There is no first-login...

CVE-2026-22094

The firmware for the EVbee DC-80 has a weak hardcoded root password, which allows attackers to login as root using the SSH daemon that is exposed to the network...

EUVD-2026-88973

The firmware for the EVbee DC-80 has a weak hardcoded root password, which allows attackers to login as root using the SSH daemon that is exposed to the network...

PT-2026-102629

The firmware for the EVbee DC-80 has a weak hardcoded root password, which allows attackers to login as root using the SSH daemon that is exposed to the network...

Harness Hardcoded Password

Harness has a hardcoded password that can be leveraged by an attacker who can reach a Gitspace's published SSH or IDE endpoint. https://packetstorm.news/download/233046...

CVE-2026-37152

TOTOLINK X5000R V9.1.0cu.2415B20250515 was discovered to contain a hardcoded password for root access...

CVE-2026-37152

TOTOLINK X5000R V9.1.0cu.2415B20250515 was discovered to contain a hardcoded password for root access...

PT-2026-92108

TOTOLINK X5000R V9.1.0cu.2415 B20250515 was discovered to contain a hardcoded password for root access...

CVE-2026-37152

The TOTOLINK X5000R running firmware version V9.1.0cu.2415_B20250515 contains a hardcoded password for root access . This vulnerability allows for unauthorized administrative access to the device. While technical exploit details are not provided in the documents, proof-of-concept (PoC) informatio...

CVE-2026-37152

TOTOLINK X5000R V9.1.0cu.2415B20250515 was discovered to contain a hardcoded password for root access...

EUVD-2026-78811

TOTOLINK X5000R V9.1.0cu.2415B20250515 was discovered to contain a hardcoded password for root access...

EUVD-2026-77484

novel-plus through 5.3.3 contains an insecure default cache-management password in the CacheController.refreshCache endpoint that allows anonymous attackers to invalidate portal caches by supplying the hardcoded default value in the URL path. Attackers can trigger unauthorized cache invalidation ...

PT-2026-91244

Name of the Vulnerable Software and Affected Versions novel-plus versions prior to 5.3.4 Description An insecure default cache-management password exists in the 'CacheController.refreshCache' endpoint. Anonymous attackers can invalidate portal caches by providing the hardcoded default value in th...