9987 matches found
CVE-2026-13446
Langflow OSS 1.0.0–1.10.1 is affected by CVE-2026-13446 due to hard-coded credentials used for inbound authentication, outbound communication, or data encryption. The IBM bulletin and NVD entry specify a critical CVSS v3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) affecting Langflow OSS ...
CVE-2026-13446 Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints
IBM Langflow OSS 1.0.0 through 1.10.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data...
GO-2026-6014 ZPan Uses Hard-Coded Password in github.com/saltbo/zpan
ZPan Uses Hard-Coded Password in github.com/saltbo/zpan...
CVE-2026-50163
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/utils.go:262-275 validates a hardlink target relative to the extract base but returns the unresolved target, causing os.Link"victim.secret", "/payload.tar.gz/evilcwdlink" to resolve header.Linkname...
EUVD-2026-45085
clawvet self-hosted API server apps/api before 0.7.5 hard-codes a fallback JWT secret 'clawvet-dev-secret-change-me' in auth.ts and ships it as the default in .env.example. Because GET /api/v1/scans returns scan records containing userId values without authentication, a remote unauthenticated...
CVE-2026-62241 clawvet < 0.7.5 Hard-coded JWT Secret Session Forgery
clawvet self-hosted API server apps/api before 0.7.5 hard-codes a fallback JWT secret 'clawvet-dev-secret-change-me' in auth.ts and ships it as the default in .env.example. Because GET /api/v1/scans returns scan records containing userId values without authentication, a remote unauthenticated...
CVE-2026-62241 clawvet < 0.7.5 Hard-coded JWT Secret Session Forgery
clawvet self-hosted API server apps/api before 0.7.5 hard-codes a fallback JWT secret 'clawvet-dev-secret-change-me' in auth.ts and ships it as the default in .env.example. Because GET /api/v1/scans returns scan records containing userId values without authentication, a remote unauthenticated...
CVE-2026-62241
CVE-2026-62241 affects the clawvet self-hosted API server (apps/api) prior to 0.7.5. The vulnerability arises from a hard-coded fallback JWT secret ('clawvet-dev-secret-change-me') implemented in auth.ts and shipped as the default in .env.example. Because GET /api/v1/scans returns scan records co...
PT-2026-60879
Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.10.1 Description The software contains hard-coded credentials, such as passwords or cryptographic keys. These credentials are used for inbound authentication, outbound communication with external...
Use of Hard-coded Credentials
Overview Affected versions of this package are vulnerable to Use of Hard-coded Credentials via the PASSWORD authentication process. An attacker can gain full administrative access, execute arbitrary commands, and read or modify files by authenticating with the hardcoded default credentials. This ...
CVE-2026-45336
HireFlow is a web-based interview management system for managing candidates, scheduling interviews, and tracking hiring progress. In 1.2 and earlier, app.py assigns a hard-coded Flask secretkey used to sign session cookies, allowing unauthenticated attackers who know the public source value to...
CVE-2026-45336 HireFlow: Use of Hard-coded Credentials
HireFlow is a web-based interview management system for managing candidates, scheduling interviews, and tracking hiring progress. In 1.2 and earlier, app.py assigns a hard-coded Flask secretkey used to sign session cookies, allowing unauthenticated attackers who know the public source value to...
CVE-2026-45336 HireFlow: Use of Hard-coded Credentials
HireFlow is a web-based interview management system for managing candidates, scheduling interviews, and tracking hiring progress. In 1.2 and earlier, app.py assigns a hard-coded Flask secretkey used to sign session cookies, allowing unauthenticated attackers who know the public source value to...
CVE-2026-45336
CVE-2026-45336 affects HireFlow’s web-based interview management system. In 1.2 and earlier, the Flask session handling used a hard-coded secret_key in app.py, allowing unauthenticated attackers who know the public source value to forge cookies containing role=admin and user_id values and bypass ...
MAL-2026-10684 Malicious code in react-hook-scripts (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52d4b717c5de5139b732e16ea9eca2654947ecf17e919334a6dd039c5b60e059 The package's default export getPlugin fetches a JSON document from the hardcoded endpoint https://svganchordev.net/icons/108 and passes the returned...
CVE-2026-53486
A flaw was found in the decompress package for Node.js. A remote attacker can exploit this vulnerability by crafting a malicious archive. When the archive is extracted, it can create files and links outside the intended directory, leading to unauthorized reading or writing of files. This is due t...
Gladinet CentreStack < 16.4.10315.56368 Use of Hard-coded Key Leads to Unauthenticated RCE
Gladinet CentreStack through 16.1.10296.56315 fixed in 16.4.10315.56368 has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited in the wild in March 2025. This enables threat actors who know the machineKey to serialize a payload for server-side...
CVE-2026-58601
Heap-based buffer overflow in Virtual Hard Disk VHD Miniport Driver allows an authorized attacker to elevate privileges locally...
CVE-2026-58601
CVE-2026-58601 describes a heap-based buffer overflow in the Virtual Hard Disk (VHD) Miniport Driver that allows an authorized, local attacker to elevate privileges. The available description specifies a local-privelege-escalation impact, but does not provide product/version specifics, exploitati...