CVE-2026-82808 Inbox Foundry ActiveInbox Extension Google OAuth Client Secret service-worker.production-esm.js hard-coded credentials

A vulnerability was identified in Inbox Foundry ActiveInbox Extension up to 7.10.24 on Chrome. Impacted is an unknown function of the file dist/service-worker.production-esm.js of the component Google OAuth Client Secret. Such manipulation leads to hard-coded credentials. The attack can be execut...

CVE-2026-82808

Inbox Foundry ActiveInbox Extension (up to version 7.10.24 , Chrome) ships a hard-coded Google OAuth Client Secret in the file dist/service-worker.production-esm.js . The vulnerability allows remote, unauthenticated attackers with no user interaction to leverage the exposed credential. The exploi...

EUVD-2026-68655

A vulnerability was identified in Inbox Foundry ActiveInbox Extension up to 7.10.24 on Chrome. Impacted is an unknown function of the file dist/service-worker.production-esm.js of the component Google OAuth Client Secret. Such manipulation leads to hard-coded credentials. The attack can be execut...

CVE-2026-82808: Use of Hard-coded Credentials

A vulnerability was identified in Inbox Foundry ActiveInbox Extension up to 7.10.24 on Chrome. Impacted is an unknown function of the file dist/service-worker.production-esm.js of the component Google OAuth Client Secret. Such manipulation leads to hard-coded credentials. The attack can be execut...

PT-2026-83895

A vulnerability was identified in Inbox Foundry ActiveInbox Extension up to 7.10.24 on Chrome. Impacted is an unknown function of the file dist/service-worker.production-esm.js of the component Google OAuth Client Secret. Such manipulation leads to hard-coded credentials. The attack can be execut...

CVE-2026-82448: Use of Hard-coded Credentials

Shinobi before commit 5a76c74f contains a hardcoded connection key in the child node service that allows unauthenticated attackers to execute arbitrary database queries. Attackers reaching the child node port can present the hardcoded key during WebSocket handshake, then dispatch SQL queries...

EUVD-2026-66418

The vulnerability allows the unauthorised generation of physical access QR codes due to the use of hard-coded credentials within the application. The generation mechanism uses the 'badgenumber' parameter as the HMAC private key, the value of which remains static and is accessible via the API usin...

EUVD-2026-67314

Bendix EC80 Brake ECU uses hard-coded credentials, which could allow an attacker to disable automatic traction control...

CVE-2026-71396

Bendix EC80 Brake ECU uses hard-coded credentials, which could allow an attacker to disable automatic traction control...

CVE-2026-19412: Use of Hard-coded Credentials

This vulnerability exists in the CP Plus CP-XR-DE21-S Router due to the presence of hardcoded HTTP Digest authentication credentials in the firmware that are identical across all devices running the affected firmware. An attacker with access to the local network could exploit this vulnerability b...

CVE-2026-71396: Use of Hard-coded Credentials

Bendix EC80 Brake ECU uses hard-coded credentials, which could allow an attacker to disable automatic traction control...

CVE-2026-71396

CVE-2026-71396 affects the Bendix EC80 Brake ECU , which embeds hard-coded credentials that an attacker could leverage to disable automatic traction control . The vulnerability is rated MEDIUM (CVSS 3.1: 5.4; CVSS 4.0: 5.3) with an adjacent-network attack vector, low complexity , and no privilege...

CVE-2026-71396 Use of Hard-coded Credentials in Bendix EC80 Brake ECU

Bendix EC80 Brake ECU uses hard-coded credentials, which could allow an attacker to disable automatic traction control...

CVE-2026-71396 Use of Hard-coded Credentials in Bendix EC80 Brake ECU

Bendix EC80 Brake ECU uses hard-coded credentials, which could allow an attacker to disable automatic traction control...

...[ More ]

kamalpanse18 EmpManageX, a Flask-based employee management application, ships hard-coded administrative credentials in its authentication logic. The username admin and the plaintext password admin123 are module-level constants in app.py, compared directly against the values submitted to the...

CVE-2026-37012: Use of Hard-coded Credentials

A vulnerability in pentestgpt/core/langfuse.py in PentestGPT 1.0.0 allows remote attackers to disclose sensitive user telemetry data via hardcoded API credentials...

CVE-2026-78251: Use of Hard-coded Credentials

DJI drones contain an FTP service that uses hardcoded credentials shared across affected models and permits authenticated users to upload files without limits on file size, file count, or total storage consumed in /blackbox/upgrade/, as well as overwrite existing files in that directory. An...

PT-2026-82779

Bendix EC80 Brake ECU uses hard-coded credentials, which could allow an attacker to disable automatic traction control...

Security Bulletin: QRadar contains hard-coded credentials

Summary QRadar contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. Vulnerability Details CVEID:CVE-2026-5522 DESCRIPTION: QRadar contains hard-cod...

CVE-2026-75896

Use of Hard-coded Credentials vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Liderahenk allows Try Common or Default Usernames and Passwords. This issue affects Liderahenk: before 3.5.5...