CVE-2026-120209

CVE-2025-6254 Doctreat Core = 1.6.8 - Unauthenticated Privilege Escalation | RCE CVE-2026-120209 AJ-Report Pre-Auth RCE — JWT Forgery + Groovy Code Execution Full-chain exploit for AJ-Report ≤ 1.7.1 — from unauthenticated access to remote code execution, web shell deployment, domain extraction, a...

Moxa AIG-302 sysman Buffer Overflow

The vulnerability in the sysman utility /usr/bin/sysman of the Moxa AIG-302 industrial programmable IIoT gateways is related to the use of a hard-coded cryptographic key. Exploitation of this vulnerability could allow a remote attacker to compromise the confidentiality and integrity of protected...

CVE-2026-19124

IBM API Connect 10.0.8.0 through 10.0.8.12 could allow an attacker with access to stored data to decrypt sensitive credentials due to the use of a hard-coded cryptographic key. The key protecting stored credentials is built into the product, so credentials could be decrypted if the stored data is...

CVE-2026-17356

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a local attacker to obtain sensitive information due to the use of a hard-coded cryptographic key...

CVE-2026-17310

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to the use of a hard-coded cryptographic key...

CVE-2026-19124

IBM API Connect versions 10.0.8.0 through 10.0.8.12 are vulnerable to the decryption of sensitive credentials. The root cause is the use of a hard-coded cryptographic key built into the product to protect stored data. An attacker who obtains access to this stored data can use the hard-coded key t...

CVE-2026-19124 Multiple Vulnerabilities in IBM API Connect

IBM API Connect 10.0.8.0 through 10.0.8.12 could allow an attacker with access to stored data to decrypt sensitive credentials due to the use of a hard-coded cryptographic key. The key protecting stored credentials is built into the product, so credentials could be decrypted if the stored data is...

EUVD-2026-118925

IBM API Connect 10.0.8.0 through 10.0.8.12 could allow an attacker with access to stored data to decrypt sensitive credentials due to the use of a hard-coded cryptographic key. The key protecting stored credentials is built into the product, so credentials could be decrypted if the stored data is...

CVE-2026-17356 Multiple Vulnerabilities in IBM API Connect

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a local attacker to obtain sensitive information due to the use of a hard-coded cryptographic key...

EUVD-2026-118741

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a local attacker to obtain sensitive information due to the use of a hard-coded cryptographic key...

CVE-2026-17356

IBM API Connect versions 12.1.0.0 through 12.1.1.2 are vulnerable to multiple issues where a local attacker could obtain sensitive information . This is caused by the use of a hard-coded cryptographic key (CWE-321). No specific exploit details or remediation steps are provided in the documents.

CVE-2026-17310

IBM API Connect versions 12.1.0.0 through 12.1.1.2 are impacted by a vulnerability that could allow a remote attacker to obtain sensitive information . The root cause is the use of a hard-coded cryptographic key . No specific exploit details or remediation steps are provided in the documents.

CVE-2026-17310 Multiple Vulnerabilities in IBM API Connect

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to the use of a hard-coded cryptographic key...

EUVD-2026-118701

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to the use of a hard-coded cryptographic key...

CVE-2026-115739

Hard-coded Cryptographic Key vulnerability exists in the DLP on-prem extensions version 11.13.1 and earlier allows a remote attacker to decrypt credentials and evidence files...

CVE-2026-115739

Hard-coded Cryptographic Key vulnerability exists in the DLP on-prem extensions version 11.13.1 and earlier allows a remote attacker to decrypt credentials and evidence files...

EUVD-2026-117542

Hard-coded Cryptographic Key vulnerability exists in the DLP on-prem extensions version 11.13.1 and earlier allows a remote attacker to decrypt credentials and evidence files...

CVE-2026-115739

A hard-coded cryptographic key vulnerability exists in DLP on-prem extensions version 11.13.1 and earlier . This flaw allows a remote attacker to decrypt sensitive credentials and evidence files . The vulnerability is associated with CWE-321 and has a CVSS 4.0 base score of 6.0 (MEDIUM) . No spec...

CVE-2026-105330

Use of Hard-coded Cryptographic Key in JWT token authentication in Apache OFBiz 24.09.06 and 24.09.07 on all platforms allows an unauthenticated, network-reachable attacker to obtain full administrative access via a forged JWT signed with the factory-default security.token.key value that...

CVE-2026-105330 Apache OFBiz: Use of Hard-coded Cryptographic Key in JWT Token Authentication Enables Unauthenticated Administrative Access

Use of Hard-coded Cryptographic Key in JWT token authentication in Apache OFBiz 24.09.06 and 24.09.07 on all platforms allows an unauthenticated, network-reachable attacker to obtain full administrative access via a forged JWT signed with the factory-default security.token.key value that...