10167 matches found
CVE-2026-103097: Use of Hard-coded Credentials
An API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key...
PT-2026-104062
Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description An API key is hardcoded and retrievable from the application package. Because Android applications can be reverse engineered, embedding sensitive API credential...
CVE-2026-55395
Hardcoded passwords in the access control in Teledyne FLIR Aware2 versions through 6.9.0.2 PackBot and 1.7.9 FirstLook allows remote unauthenticated attackers to access and reconfigure Teledyne FLIR PackBot and FirstLook robots running this software via reading the passwords from the firmware or...
CVE-2026-55395
Teledyne FLIR Aware2 software (versions through 6.9.0.2 for PackBot and 1.7.9 for FirstLook) contains hardcoded passwords in the access control mechanism. This vulnerability allows remote unauthenticated attackers to access and reconfigure Teledyne FLIR PackBot and FirstLook robots by extracting ...
CVE-2026-55395 Hardcoded Passwords in Teledyne FLIR Robots running Aware2
Hardcoded passwords in the access control in Teledyne FLIR Aware2 versions through 6.9.0.2 PackBot and 1.7.9 FirstLook allows remote unauthenticated attackers to access and reconfigure Teledyne FLIR PackBot and FirstLook robots running this software via reading the passwords from the firmware or...
EUVD-2026-91052
Hardcoded passwords in the access control in Teledyne FLIR Aware2 versions through 6.9.0.2 PackBot and 1.7.9 FirstLook allows remote unauthenticated attackers to access and reconfigure Teledyne FLIR PackBot and FirstLook robots running this software via reading the passwords from the firmware or...
CVE-2026-55395 Hardcoded Passwords in Teledyne FLIR Robots running Aware2
Hardcoded passwords in the access control in Teledyne FLIR Aware2 versions through 6.9.0.2 PackBot and 1.7.9 FirstLook allows remote unauthenticated attackers to access and reconfigure Teledyne FLIR PackBot and FirstLook robots running this software via reading the passwords from the firmware or...
Rocky Linux 10.2 [CIQ] Security Update: keylime / keylime-base / keylime-registrar / keylime-selinux / etc (crlsa-2026_28582)
The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202628582 advisory. keylime: Keylime: Security bypass due to hardcoded TPM quote nonce CVE-2026-6420 Tenable has extracted the preceding description block directly from the CIQ...
PT-2026-104014
Name of the Vulnerable Software and Affected Versions Teledyne FLIR Aware2 versions through 6.9.0.2 PackBot Teledyne FLIR Aware2 versions through 1.7.9 FirstLook Description Hardcoded passwords in the access control allow remote unauthenticated attackers to access and reconfigure Teledyne FLIR...
Rocky Linux 8 [CIQ] Security Update: cjose / cjose-debuginfo / cjose-debugsource / cjose-devel / etc Multiple Vulnerabilities (crlsa-2022_1823)
The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20221823 advisory. modauthopenidc: open redirect in oidcvalidateredirecturl CVE-2021-32786 modauthopenidc: hardcoded static IV and AAD with a reused key in AES GCM encryption...
CVE-2023-54402 iDocView SSRF via /doc/upload Endpoint Hardcoded Token
iDocView contains a server-side request forgery vulnerability in its /doc/upload endpoint that allows remote unauthenticated attackers to fetch arbitrary URLs by supplying a hardcoded default token value testtoken to bypass authentication. Attackers can exploit the unrestricted URL scheme handlin...
CVE-2023-54402
The software iDocView is vulnerable to a Server-Side Request Forgery (SSRF) flaw in its /doc/upload endpoint. Remote unauthenticated attackers can bypass authentication by using a hardcoded default token value (testtoken ) to fetch arbitrary URLs. Due to unrestricted URL scheme handling, includin...
Malicious code in @zeronexcode/baileys (npm)
makeWASocket in lib/Socket/index.js makes the user's WhatsApp account follow the hardcoded channel 120363427099186895@newsletter whenever a connection opens, with no option to disable it. --- Credit: OpenSSF source...
MAL-2026-17323 Malicious code in cortana-md-engine (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a2de4b6992a1dd7177803253b8c214d1ba7cc911cf0e1e7f800e1e9ff7ab5b1 cortana-md-engine is a Baileys-based WhatsApp bot whose bundled entrypoints dist/hosted.cjs and dist/index.cjs hardcode five...
CVE-2026-100294
In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, the firmware embeds hardcoded cloud‑API credentials that are shared across deployed devices. Anyone obtaining the public firmware package can reuse these values to interact with the cloud service in ways not intended for normal operation...
EUVD-2026-89369
In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, the firmware embeds hardcoded cloud‑API credentials that are shared across deployed devices. Anyone obtaining the public firmware package can reuse these values to interact with the cloud service in ways not intended for normal operation...
Malicious code in @hrmony/pladddform-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9e61c4d5d499198c568d9f255e23b407eb7e47f7272c76bf5f50a0d0db31605 On top-level module load, index.js queries the AWS instance metadata service at 169.254.169.254 IMDSv2, retrieves the instance identity document,...
CVE-2026-22094
The firmware for the EVbee DC-80 has a weak hardcoded root password, which allows attackers to login as root using the SSH daemon that is exposed to the network...