EUVD-2026-88973

The firmware for the EVbee DC-80 has a weak hardcoded root password, which allows attackers to login as root using the SSH daemon that is exposed to the network...

PT-2026-102629

The firmware for the EVbee DC-80 has a weak hardcoded root password, which allows attackers to login as root using the SSH daemon that is exposed to the network...

Harness Hardcoded Password

Harness has a hardcoded password that can be leveraged by an attacker who can reach a Gitspace's published SSH or IDE endpoint. https://packetstorm.news/download/233046...

CVE-2026-37152

TOTOLINK X5000R V9.1.0cu.2415B20250515 was discovered to contain a hardcoded password for root access...

CVE-2026-37152

TOTOLINK X5000R V9.1.0cu.2415B20250515 was discovered to contain a hardcoded password for root access...

PT-2026-92108

TOTOLINK X5000R V9.1.0cu.2415 B20250515 was discovered to contain a hardcoded password for root access...

CVE-2026-37152

The TOTOLINK X5000R running firmware version V9.1.0cu.2415_B20250515 contains a hardcoded password for root access . This vulnerability allows for unauthorized administrative access to the device. While technical exploit details are not provided in the documents, proof-of-concept (PoC) informatio...

EUVD-2026-78811

TOTOLINK X5000R V9.1.0cu.2415B20250515 was discovered to contain a hardcoded password for root access...

CVE-2026-37152

TOTOLINK X5000R V9.1.0cu.2415B20250515 was discovered to contain a hardcoded password for root access...

EUVD-2026-77484

novel-plus through 5.3.3 contains an insecure default cache-management password in the CacheController.refreshCache endpoint that allows anonymous attackers to invalidate portal caches by supplying the hardcoded default value in the URL path. Attackers can trigger unauthorized cache invalidation ...

PT-2026-91244

Name of the Vulnerable Software and Affected Versions novel-plus versions prior to 5.3.4 Description An insecure default cache-management password exists in the 'CacheController.refreshCache' endpoint. Anonymous attackers can invalidate portal caches by providing the hardcoded default value in th...

EUVD-2026-76738

An example environment-configuration file for a bundled inventory-management component ships with a fixed, publicly-known administrative password. A deployment that copies this example file into active configuration without running the setup routine that regenerates credentials will expose that...

CVE-2026-90456

CVE-2026-90456 affects a bundled inventory-management component whose example environment-configuration file ships with a fixed, publicly-known administrative password . If a deployment copies this example file into active configuration without running the setup routine that regenerates credentia...

CVE-2026-71809: Use of Hard-coded Password

Authentication Bypass via Hardcoded Master Verification Code vulnerability in Siam Ordering siam-server 1.0.0 allows remote unauthenticated attackers to log in as any user, merchant, or administrator...

CVE-2026-77012 Icollect <= 1.0.0 - Unauthenticated Arbitrary File Read, SSRF and Path Traversal File Write via Default Publishing Password

The 爱采集数据采集和发布插件 WordPress plugin through 1.0.0 does not require a per-install secret for one of its unauthenticated endpoints, relying on a hardcoded default, and does not validate the URLs or destination paths it is given, allowing unauthenticated attackers to read arbitrary files from the...

CVE-2026-77012

The 爱采集数据采集和发布插件 WordPress plugin (versions

PT-2026-71873

A flaw has been found in Tenda CH, CP and TX3 V21.x/V22.x/V25.x/V26.x/V27.x. Affected by this issue is some unknown functionality of the component SSH. Executing a manipulation can lead to use of hard-coded password. It is possible to launch the attack remotely. The attack requires a high level o...

Malicious code in log-min (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5dc78815e8c40947273929a7224aa04230de911771e62580045fb8bb213468c9 The package publishes as 'log-min' with a description claiming it is a JavaScript library for the Theta Blockchain, while its README identifies the...

MAL-2026-11146 Malicious code in sigchain-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 034ba6bdd11139e40b062606dfa180a60727249035899eded96d34797b63a026 The published dist bundles dist/sigchain-js.cjs.js, dist/sigchain-js.esm.js, dist/sigchain-js.umd.js contain top-level code that reads an encrypted...

Malicious code in chain-analyze (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb22a3b9c64598bc202456844105c3e3e7f7e7185abe335b2694d85deb1b6c9d The published tarball's dist bundles dist/sigchain-js.cjs.js, dist/sigchain-js.esm.js, dist/sigchain-js.umd.js execute at module load: they read an...