CVE-2026-103091: Missing Authorization

Missing Authorization CWE-862 and Initialization of a Resource with an Insecure Default CWE-1188 in the MCP proxy HandleStreamPassThrough in mcpservice.go and OIDC registration flow GET /info and POST /register in internal/controlplane/server.go in Google OSS Agent Mesh SAM versions 0.1.0-alpha.1...

CVE-2026-85300: Incorrect Default Permissions

Incorrect Default Permissions vulnerability in Apache Camel PQC component. This issue affects Apache Camel: from 4.12.0 before 4.18.5, from 4.19.0 before 4.22.1. When the component wrote generated key material to disk it did so with the permissions the process default umask produced, rather than...

CVE-2026-112296: Use of Default Credentials

FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super administrator access via the flycms account with password admin123. Attackers can log in through POST /api/auth/login, solving only the image captcha, to obtain...

PT-2026-117210

Name of the Vulnerable Software and Affected Versions Google OSS Agent Mesh SAM versions 0.1.0-alpha.1 through 0.1.0-alpha.8 Description Missing authorization and the use of insecure default resource initialization allow a remote attacker to self-enroll into the mesh and invoke arbitrary tools...

CVE-2026-112030 diem-project diem dmDataLoad.php default password

A vulnerability was found in diem-project diem up to 5.1.3. This vulnerability affects unknown code of the file dmCorePlugin/lib/data/dmDataLoad.php. Performing a manipulation results in use of default password. The attack is possible to be carried out remotely. The exploit has been made public a...

CVE-2026-112030

The diem-project diem software, up to version 5.1.3 , contains a vulnerability in the dmCorePlugin/lib/data/dmDataLoad.php file. An attacker can perform a remote manipulation that results in the use of default passwords (CWE-1393 ). While the project has not yet responded to the initial report, i...

CVE-2026-112030 diem-project diem dmDataLoad.php default password

A vulnerability was found in diem-project diem up to 5.1.3. This vulnerability affects unknown code of the file dmCorePlugin/lib/data/dmDataLoad.php. Performing a manipulation results in use of default password. The attack is possible to be carried out remotely. The exploit has been made public a...

CVE-2026-111998

Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token. Attackers can send the fixed Bearer token to the gateway gRPC proxy port to manage namespaces, eventbuses, users,...

EUVD-2026-103451

Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token. Attackers can send the fixed Bearer token to the gateway gRPC proxy port to manage namespaces, eventbuses, users,...

CVE-2026-111998: Use of Default Credentials

Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token. Attackers can send the fixed Bearer token to the gateway gRPC proxy port to manage namespaces, eventbuses, users,...

CVE-2026-102551

Improper verification of the source of a communication channel in the IPv6 Router Advertisement handler in Amazon FreeRTOS-Plus-TCP before V4.4.2 might allow a remote third-party to influence an endpoint's IPv6 default gateway, on-link prefix, and address configuration via a crafted Router...

Atlassian Questions For Confluence - Hardcoded Credentials

Atlassian Questions For Confluence contains a hardcoded credentials vulnerability. When installing versions 2.7.34, 2.7.35, and 3.0.2, a Confluence user account is created in the confluence-users group with the username disabledsystemuser and a hardcoded password. A remote, unauthenticated attack...

EUVD-2026-102483

JuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow unauthenticated remote attackers to access the admin console on port 8090. Attackers can log in as administrator, even after account deletion since CheckLogin recreates it, to control tenant...

CVE-2026-111693: Use of Default Credentials

DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to gain administrator access using the built-in admin/Databuff@123 account. Attackers can POST these credentials to /webapi/api/v1/auth/login to obtain an administrator...

CVE-2026-92777: Use of Default Cryptographic Key

A potential vulnerability was reported in some Lenovo Tablets that could allow a user with physical access to an unlocked tablet to bypass device protections and execute arbitrary code...

CVE-2026-16755: Use of Default Password

A potential vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that could allow an unauthorized remote user to disclose sensitive information...

CVE-2026-111329

JuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow unauthenticated remote attackers to access the admin console on port 8090. Attackers can log in as administrator, even after account deletion since CheckLogin recreates it, to control tenant...

CVE-2026-111329

The JuggleIM im-server (versions through 1.8.16 ) contains a critical vulnerability where it ships with default administrator credentials (admin/123456). This allows unauthenticated remote attackers to access the admin console on port 8090 . Once authenticated, attackers can control tenant applic...

CVE-2026-111329 JuggleIM im-server through 1.8.16 Default Admin Credentials in Admin Console

JuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow unauthenticated remote attackers to access the admin console on port 8090. Attackers can log in as administrator, even after account deletion since CheckLogin recreates it, to control tenant...

CVE-2026-111329 JuggleIM im-server through 1.8.16 Default Admin Credentials in Admin Console

JuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow unauthenticated remote attackers to access the admin console on port 8090. Attackers can log in as administrator, even after account deletion since CheckLogin recreates it, to control tenant...