PT-2026-111565

Name of the Vulnerable Software and Affected Versions Wazuh versions 4.6.0 through 4.14.7 Description An authentication bypass exists because the security.update user function implements the reserved user guard and password policy within a falsy truthiness check. This allows a delegated user...

PT-2026-104437

Name of the Vulnerable Software and Affected Versions Armatura One affected versions not specified Description The database initialization routine assigns a fixed, vendor-defined password to the database superuser account during creation instead of generating a unique password for each...

EUVD-2026-57697

UpSnap is a wake on lan web app. Versions 4.4.1 through 5.3.5 are vulnerable to a missing-authentication / privilege-escalation chain in pb.HandlerInitSuperuser backend/pb/handlers.go:249, reachable as POST /api/upsnap/init-superuser. The vulnerable code lacks any authentication, setup token, IP...

CVE-2026-47846: Use of Hard-coded Credentials

Bitnami Cassandra container images are affected by a retained default superuser vulnerability. When a custom administrator account is configured via the CASSANDRAUSER environment variable, the container initialization script creates the new superuser account but fails to drop the built-in cassand...

CVE-2023-27573

NetBox-Docker

CVE-2023-31240

Snap One OvrC Pro versions prior to 7.2 have their own locally running web server accessible both from the local network and remotely. OvrC cloud contains a hidden superuser account accessible through hard-coded credentials...

CVE-2018-25151: Cross-Site Request Forgery (CSRF)

Ecessa WANWorx WVR-30 versions before 10.7.4 contain a cross-site request forgery vulnerability that allows attackers to perform administrative actions without request validation. Attackers can craft a malicious web page with a hidden form to create a new superuser account by tricking an...

EUVD-2021-26508

Malware in sbrugna...

EUVD-2018-17119

Malware in sbrugna...

EUVD-2018-17121

Malware in sbrugna...

EUVD-2008-2050

Malware in sbrugna...

EUVD-2015-1616

Malware in sbrugna...

EUVD-2023-29147

Malicious code in bioql PyPI...

EUVD-2022-0038

Malicious code in bioql PyPI...

CVE-2021-3165

SmartAgent 3.1.0 allows a ViewOnly attacker to create a SuperUser account via the //CampaignManager/users URI...

Hardcoded credentials

Snap One OvrC Pro versions prior to 7.2 have their own locally running web server accessible both from the local network and remotely. OvrC cloud contains a hidden superuser account accessible through hard-coded credentials...

CVE-2023-25183

In Snap One OvrC Pro versions prior to 7.2, when logged into the superuser account, a new functionality appears that could allow users to execute arbitrary commands on the hub device...

CVE-2023-31240

Summary: CVE-2023-31240 affects Snap One OvrC Pro, specifically versions prior to 7.2. The issue is a hard-coded-credentials based hidden superuser account, accessible via the local web server running on affected devices, potentially exposing control to the network and remote access. The Red Hat/...

CVE-2023-31240

Snap One OvrC Pro versions prior to 7.2 have their own locally running web server accessible both from the local network and remotely. OvrC cloud contains a hidden superuser account accessible through hard-coded credentials...

CVE-2023-31240: Use of Weak Credentials

Snap One OvrC Pro versions prior to 7.2 have their own locally running web server accessible both from the local network and remotely. OvrC cloud contains a hidden superuser account accessible through hard-coded credentials...