1476 matches found
CVE-2026-112014 LobsterAI before 2026.10.16 Hardcoded Password in Provider API Key Export
LobsterAI before 2026.10.16 contains a hardcoded password vulnerability that allows attackers to decrypt exported provider API keys encrypted with the constant 'lobsterai-APP'. Attackers who obtain a providers export file can derive the AES-GCM key via PBKDF2 using the embedded salt and recover...
CVE-2026-112014 LobsterAI before 2026.10.16 Hardcoded Password in Provider API Key Export
LobsterAI before 2026.10.16 contains a hardcoded password vulnerability that allows attackers to decrypt exported provider API keys encrypted with the constant 'lobsterai-APP'. Attackers who obtain a providers export file can derive the AES-GCM key via PBKDF2 using the embedded salt and recover...
EUVD-2026-103467
LobsterAI before 2026.10.16 contains a hardcoded password vulnerability that allows attackers to decrypt exported provider API keys encrypted with the constant 'lobsterai-APP'. Attackers who obtain a providers export file can derive the AES-GCM key via PBKDF2 using the embedded salt and recover...
CVE-2026-112014
LobsterAI before 2026.10.16 contains a hardcoded password vulnerability that allows attackers to decrypt exported provider API keys encrypted with the constant 'lobsterai-APP'. Attackers who obtain a providers export file can derive the AES-GCM key via PBKDF2 using the embedded salt and recover...
CVE-2026-112014 LobsterAI before 2026.10.16 Hardcoded Password in Provider API Key Export
LobsterAI before 2026.10.16 contains a hardcoded password vulnerability that allows attackers to decrypt exported provider API keys encrypted with the constant 'lobsterai-APP'. Attackers who obtain a providers export file can derive the AES-GCM key via PBKDF2 using the embedded salt and recover...
CVE-2026-112014
The software LobsterAI prior to version 2026.10.16 contains a hardcoded password vulnerability (CWE-321). This flaw allows an attacker who obtains an exported provider file to decrypt third-party AI provider API keys. The vulnerability stems from using the constant 'lobsterai-APP' to encrypt keys...
PT-2026-116618
Name of the Vulnerable Software and Affected Versions LobsterAI versions prior to 2026.10.16 Description An issue exists where exported provider API keys are encrypted using a hardcoded password 'lobsterai-APP'. An attacker who obtains a provider export file can use this constant with PBKDF2 a ke...
NetEase Youdao LobsterAI encryption vulnerability
NetEase Youdao LobsterAI versions prior to 2026.10.16 had an encryption vulnerability. This vulnerability stemmed from the use of a hardcoded password when exporting API keys. Attackers could obtain the exported files and utilize the salt values embedded within them to derive AES-GCM keys using...
CVE-2026-85488
Brocade ASCG before 3.5.0 has a well-known Brocade default password embedded in a script distributed to every customer. Any local authenticated user with read access to the installation path can discover this credential and perform privilege escalation on affected Open Virtual Appliance OVA...
EUVD-2026-94455
Homer is open source telecom observability software. Prior to version 11.0.283, on every fresh Homer deployment using internal authentication, the bootstrap process automatically creates an admin account with the password sipcapture stored as a legacy SHA-256 hex hash. There is no first-login...
CVE-2026-62252 Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Login
Homer is open source telecom observability software. Prior to version 11.0.283, on every fresh Homer deployment using internal authentication, the bootstrap process automatically creates an admin account with the password sipcapture stored as a legacy SHA-256 hex hash. There is no first-login...
CVE-2026-62252 Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Login
Homer is open source telecom observability software. Prior to version 11.0.283, on every fresh Homer deployment using internal authentication, the bootstrap process automatically creates an admin account with the password sipcapture stored as a legacy SHA-256 hex hash. There is no first-login...
CVE-2026-62252
Homer , an open-source telecom observability software, contains a hardcoded default admin password vulnerability in versions prior to 11.0.283 . The bootstrap process automatically creates an admin account with the password sipcapture (stored as a legacy SHA-256 hex hash) when using internal auth...
CVE-2026-62252 Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Login
Homer is open source telecom observability software. Prior to version 11.0.283, on every fresh Homer deployment using internal authentication, the bootstrap process automatically creates an admin account with the password sipcapture stored as a legacy SHA-256 hex hash. There is no first-login...
CVE-2026-22094
The firmware for the EVbee DC-80 has a weak hardcoded root password, which allows attackers to login as root using the SSH daemon that is exposed to the network...
EUVD-2026-88973
The firmware for the EVbee DC-80 has a weak hardcoded root password, which allows attackers to login as root using the SSH daemon that is exposed to the network...
PT-2026-102629
The firmware for the EVbee DC-80 has a weak hardcoded root password, which allows attackers to login as root using the SSH daemon that is exposed to the network...
Harness Hardcoded Password
Harness has a hardcoded password that can be leveraged by an attacker who can reach a Gitspace's published SSH or IDE endpoint. https://packetstorm.news/download/233046...