MAL-2026-13339 Malicious code in dolyame-boxy-mobile-bnpl-card-panel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 81f9a7ce9653fe40c88e75d2eebba37ae255fd0eb7e71cd9e962d34db491a218 On require, bootstrap.js downloads a platform-specific binary from hardcoded Cloudflare Workers endpoints oob-worker.cf103-070.workers.dev,...

Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints

Summary A workspace tool shared with a read grant returned its full Python source to the recipient. Any authenticated non-admin who could use a shared tool could also read its source, including any user on the instance when a tool was shared publicly. Source is meant to be a writer-only tier: the...

CVE-2026-14804

Use of hard-coded cryptographic key vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Read Sensitive Constants Within an Executable. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...

CVE-2026-14804

Use of hard-coded cryptographic key vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Read Sensitive Constants Within an Executable. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...

EUVD-2026-52651

Use of hard-coded cryptographic key vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Read Sensitive Constants Within an Executable. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...

CVE-2025-15627

A cryptographic weakness exists in the Omada adoption protocol. The protocol relies on hard-coded cryptographic keys to establish trust and protect authentication exchanges between controllers and managed devices during device adoption. An attacker may be able to impersonate trusted controllers o...

EUVD-2025-210609

A cryptographic weakness exists in the Omada adoption protocol. The protocol relies on hard-coded cryptographic keys to establish trust and protect authentication exchanges between controllers and managed devices during device adoption. An attacker may be able to impersonate trusted controllers o...

PT-2026-67458

A cryptographic weakness exists in the Omada adoption protocol. The protocol relies on hard-coded cryptographic keys to establish trust and protect authentication exchanges between controllers and managed devices during device adoption. An attacker may be able to impersonate trusted controllers o...

Security Bulletin: IBM Storage Protect Client and Virtual Environments are vulnerable to weaker than expected security controls in IBM WebSphere Application Server Liberty (CVE-2025-14923)

Summary IBM Storage Protect Client and Virtual Environments include IBM WebSphere Application Server Liberty as part of its web application runtime. A vulnerability in the Liberty Security Utility could result in weaker than expected security controls during security administration. IBM Storage...

CVE-2026-65313 Use of hard-coded VNC credentials in the engineering-workstation provisioning

A provisioning script used when installing HIPASE-250 formerly 250 SCALA engineering workstations sets a fixed, hard-coded x11vnc password. Because the same credential is applied to every workstation provisioned this way, an attacker with adjacent-network access who knows the password can gain VN...

CVE-2026-65313

HIPASE-250 (formerly 250 SCALA) engineering workstations are provisioned by a script that uses a fixed, hard-coded x11vnc password. This enables an adjacent-network attacker who knows the credential to gain VNC access to affected workstations. Affected component: the provisioning script; root cau...

CVE-2026-18452

DMS+ Non-Mobile developed by Rich Source has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can exploit a fixed API key to gain control over all installed DMS+ devices...

EUVD-2026-51406

DMS+ Non-Mobile developed by Rich Source has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can exploit a fixed API key to gain control over all installed DMS+ devices...

CVE-2026-18452

CVE-2026-18452 affects DMS+ (Non-Mobile) by Rich Source and is due to use of hard-coded credentials (a fixed API key). Unauthenticated remote attackers can exploit this to gain control over all installed DMS+ devices. The provided metrics indicate a critical impact (CVSS v4.0 10.0; CVSS v3.1 10.0...

CVE-2026-18452 Rich Source｜DMS+ (Non-Mobile) - Use of Hard-coded Credentials

DMS+ Non-Mobile developed by Rich Source has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can exploit a fixed API key to gain control over all installed DMS+ devices...

Cisco Secure Firewall Management Center Software Static Credentials (cisco-sa-fmc-static-cred-BET3Cjh)

A vulnerability in the web interface of Cisco Secure Firewall Management Center FMC Software could allow an unauthenticated, remote attacker to log in to an affected device using a static, low-privileged account and access sensitive data within the impacted system. This vulnerability is due to th...

CVE-2026-5846

The affected Watchfire Controller Software contains self-signed hard-coded RSA private keys and corresponding X.509 certificates used for authenticating and encrypting HTTPS/TLS connections to the controller's built-in web management interface. These keys are embedded in plaintext within the...

CVE-2026-5846 Hard-coded Cryptographic Key in Watchfire Controllers

The affected Watchfire Controller Software contains self-signed hard-coded RSA private keys and corresponding X.509 certificates used for authenticating and encrypting HTTPS/TLS connections to the controller's built-in web management interface. These keys are embedded in plaintext within the...

CVE-2026-5846

The CVE-2026-5846 entry concerns Watchfire Controller Software, where self-signed hard-coded RSA private keys and X.509 certificates are embedded in plaintext in the firmware patch binaries from Watchfire’s Remote Support filestore. This exposes TLS/HTTPS authentication and encryption for the con...

CVE-2026-5846

The affected Watchfire Controller Software contains self-signed hard-coded RSA private keys and corresponding X.509 certificates used for authenticating and encrypting HTTPS/TLS connections to the controller's built-in web management interface. These keys are embedded in plaintext within the...