CVE-2026-15469

🔑 CVE-2026-15469 硬编码网状组私钥 — TP-Link Deco XE75 / XE5300 / WE10800 固件中内置了一个共享的 RSA-512 网状组私钥，使局域网邻近的攻击者能够冒充受信任的网状节点、覆盖配置、刷入未签名固件，并在整个网状网络中横向渗透。 English · 한국어 📋 概览 字段| 值 ---|--- CVE ID| CVE-2026-15469 弱点类型| CWE-321 — 使用硬编码加密密钥 攻击模式| CAPEC-115 — 认证绕过 严重性| 7.7 — 高危 CVSS 4.0 攻击向量|...

CVE-2025-56802

CVE-2025-56802 Reolink 桌面应用程序中的 AES-CFB 密钥生成与管理漏洞 1. 概述 名称 : Reolink 桌面应用程序 版本 : 8.18.12 厂商 : Reolink CWE : CWE-321: 使用硬编码加密密钥, CWE-522: 凭据保护不足 CVSS : 5.1 中危 向量字符串 : CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L 2. 摘要 Reolink 桌面应用程序（版本 8.18.12）使用 AES-CFB 算法对配置文件和其他敏感数据进行加密。...

CVE-2024-53522

CVE-2024-53522 CVE-2024-53522 漏洞利用 PoC 本仓库包含 CVE-2024-53522 的概念验证（PoC），该漏洞由 Safecloud Co., Ltd. 发现。有关该漏洞的详细信息，请参阅我们的博客文章：CVE-2024-53522: HOSxP 软件 0day 发现与利用 漏洞概述 CVE-2024-53522 是一个影响 HOSxP XE https://hosxp.net/ 的严重安全问题。该漏洞允许本地攻击者解密特权数据库凭据，原因是应用程序中使用了静态硬编码的私钥-IV 。 免责声明 本 PoC 仅用于教育和研究目的 。严禁将此 PoC...

CVE-2026-14483_exploit

CVE-2026-14483 — Realtyna WPL / Organic IDX 未认证任意文件上传 → RCE 未认证任意文件上传漏洞，可导致 Realtyna WPL / Organic IDX WordPress 插件（real-estate-listing-realtyna-wpl ≤ 5.2.0）中的远程代码执行（RCE）。 该插件在公开的 WordPress init 钩子上注册了一个 “I/O 服务” ，可通过 ?wplview=io&wplformat=io 在站点根目录未认证 访问。唯一的门槛是插件迁移中附带的一对静态硬编码默认密钥 （每个安装环境均相同），且...

CVE-2026-82829

Hitachi Coding Software Suite contains a vulnerability related to Hidden Functionality vulnerability which allows an attacker to gain unauthorized access by exploiting hidden accounts or hard coded credentials. This issue affects Hitachi Coding Software Suite: through 3.3.0...

CVE-2026-82827

Hitachi Coding Software Suite contains a vulnerability related to Use of Hard-coded Cryptographic Key. The Hardcoding of JWT signing secret key allows an attacker to generate unauthorized Bearer tokens and exploit administrative functions. This issue affects Hitachi Coding Software Suite: through...

EUVD-2026-90492

Hitachi Coding Software Suite contains a vulnerability related to Use of Hard-coded Cryptographic Key. The Hardcoding of JWT signing secret key allows an attacker to generate unauthorized Bearer tokens and exploit administrative functions. This issue affects Hitachi Coding Software Suite: through...

CVE-2026-82827 A hard-coded JWT signing secret key may allow administrative functions to be abused using fraudulently generated Bearer tokens

Hitachi Coding Software Suite contains a vulnerability related to Use of Hard-coded Cryptographic Key. The Hardcoding of JWT signing secret key allows an attacker to generate unauthorized Bearer tokens and exploit administrative functions. This issue affects Hitachi Coding Software Suite: through...

CVE-2026-82827

The Hitachi Coding Software Suite (versions through 3.3.0 ) is vulnerable to a Use of Hard-coded Cryptographic Key flaw. The software uses a hard-coded JWT signing secret key , which enables an attacker to generate unauthorized Bearer tokens . By using these fraudulent tokens, an attacker can exp...

CVE-2026-82827 A hard-coded JWT signing secret key may allow administrative functions to be abused using fraudulently generated Bearer tokens

Hitachi Coding Software Suite contains a vulnerability related to Use of Hard-coded Cryptographic Key. The Hardcoding of JWT signing secret key allows an attacker to generate unauthorized Bearer tokens and exploit administrative functions. This issue affects Hitachi Coding Software Suite: through...

CVE-2026-82829

The Hitachi Coding Software Suite (affected versions through 3.3.0 ) contains a Hidden Functionality vulnerability. An attacker can exploit hidden accounts or hard-coded credentials to gain unauthorized access without undergoing the legitimate authentication process. The impact is categorized as ...

EUVD-2026-90490

Hitachi Coding Software Suite contains a vulnerability related to Hidden Functionality vulnerability which allows an attacker to gain unauthorized access by exploiting hidden accounts or hard coded credentials. This issue affects Hitachi Coding Software Suite: through 3.3.0...

PT-2026-103686

Name of the Vulnerable Software and Affected Versions Hitachi Coding Software Suite versions prior to 3.3.0 Description The software contains a flaw involving the use of a hard-coded cryptographic key. Specifically, the JWT JSON Web Token signing secret key is hard-coded, which allows an attacker...

PT-2026-104020

Name of the Vulnerable Software and Affected Versions EasyIO FS32 versions prior to 3.0b63 Description Johnson Controls EasyIO FS32 contains hard-coded credentials, which allows an attacker to exploit these default credentials to gain unauthorized access to the system. Recommendations Update Easy...

PT-2026-104023

Name of the Vulnerable Software and Affected Versions EasyIO FS32 versions prior to 3.0b63 Description Johnson Controls EasyIO FS32 contains a hard-coded cryptographic key, which is a fixed secret used for encryption or decryption. This flaw allows an attacker to retrieve embedded sensitive data...

CVE-2026-103055 AiSOC 7.5.0 before 12.0.0 Authentication Bypass via Hard-coded JWT Secret

AiSOC versions 7.5.0 before 12.0.0 use a hard-coded constant for JWT verification in the realtime WebSocket and SSE service when the AISOCREALTIMEJWTSECRET environment variable is not set. Unauthenticated attackers can forge subscription tickets with arbitrary tenant identifiers to access...

CVE-2026-103055 AiSOC 7.5.0 before 12.0.0 Authentication Bypass via Hard-coded JWT Secret

AiSOC versions 7.5.0 before 12.0.0 use a hard-coded constant for JWT verification in the realtime WebSocket and SSE service when the AISOCREALTIMEJWTSECRET environment variable is not set. Unauthenticated attackers can forge subscription tickets with arbitrary tenant identifiers to access...

CVE-2026-96587 Use of Hard-coded Credentials in Viidure Dashcam Android Application

The Viidure Android application embeds permanent, plaintext cloud storage credentials within its compiled code. These credentials provide full access to critical platform storage, including the ability to read, modify, or delete operational files such as firmware and application binaries...

CVE-2026-96587

The Viidure Dashcam Android application contains a critical vulnerability where permanent, plaintext cloud storage credentials are embedded within its compiled code. This flaw allows unauthorized entities to gain full access to critical platform storage, enabling them to read, modify, or delete o...

CVE-2026-96587 Use of Hard-coded Credentials in Viidure Dashcam Android Application

The Viidure Android application embeds permanent, plaintext cloud storage credentials within its compiled code. These credentials provide full access to critical platform storage, including the ability to read, modify, or delete operational files such as firmware and application binaries...