PT-2026-89109

Name of the Vulnerable Software and Affected Versions MaxSite CMS versions prior to 109.7 Description The software contains a hardcoded session encryption key within the application/config/config.php file that remains unchanged after installation. This allows unauthenticated attackers to forge...

CVE-2026-87930: Deserialization of Untrusted Data

MaxSite CMS through 109.6 passes the cisession cookie to unserialize without class restrictions, allowing unauthenticated attackers to inject PHP objects. Attackers can forge valid session cookies using the hardcoded encryption key to trigger magic methods and corrupt application state or achieve...

PT-2026-89150

An issue was discovered in s-pms SPMS-Server through v1.0. The application contains a hardcoded default access token secret within its core configuration file, which is not overridden or removed in the production environment profile. A remote, unauthenticated attacker can locally forge valid...

PT-2026-89181

Authentication Bypass via Hardcoded Master Verification Code vulnerability in Siam Ordering siam-server 1.0.0 allows remote unauthenticated attackers to log in as any user, merchant, or administrator...

CVE-2026-71809

Siam Ordering (siam-server ) version 1.0.0 is vulnerable to an Authentication Bypass caused by a hardcoded master verification code . This security flaw allows remote unauthenticated attackers to gain unauthorized access to the system, enabling them to log in as any user, merchant, or administrat...

CVE-2026-71801

The s-pms SPMS-Server (through v1.0) is vulnerable to an authentication bypass due to a hardcoded default access token secret within its core configuration file. Because this secret is not removed or overridden in production profiles, a remote, unauthenticated attacker can forge valid administrat...

CVE-2026-71809

Authentication Bypass via Hardcoded Master Verification Code vulnerability in Siam Ordering siam-server 1.0.0 allows remote unauthenticated attackers to log in as any user, merchant, or administrator...

CVE-2026-71801

An issue was discovered in s-pms SPMS-Server through v1.0. The application contains a hardcoded default access token secret within its core configuration file, which is not overridden or removed in the production environment profile. A remote, unauthenticated attacker can locally forge valid...

CVE-2026-71809

Authentication Bypass via Hardcoded Master Verification Code vulnerability in Siam Ordering siam-server 1.0.0 allows remote unauthenticated attackers to log in as any user, merchant, or administrator...

MAL-2026-16058 Malicious code in vinzz-wcli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8dec0212466f7170f1e00ecbfe3f846cbf5d211917c3831a6ee162ca6d44ec10 vinzz-wcli is a WhatsApp CLI whose main entry index.js sets global.ownerr = "[email protected]" and treats any incoming WhatsApp message...

Malicious code in vinzz-wcli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8dec0212466f7170f1e00ecbfe3f846cbf5d211917c3831a6ee162ca6d44ec10 vinzz-wcli is a WhatsApp CLI whose main entry index.js sets global.ownerr = "[email protected]" and treats any incoming WhatsApp message...

Gladinet CentreStack & Triofox - Hardcoded Credentials

Gladinet CentreStack and Triofox 16.12.10420.56791 contain a hardcoded credentials vulnerability caused by use of hardcoded AES cryptoscheme values, letting attackers perform arbitrary local file inclusion without authentication, potentially leading to full system compromise. id: CVE-2025-14611...

PT-2026-88450

🔴 CISA flags hardcoded credential flaw in CareCam Pro IP cameras deployed globally ANJIA AJL33PC0801 IP camera firmware linuxlinux202008261138 svn13796, U-Boot 2010.06 compiled Aug 26 2020 contains hardcoded bootloader credentials. An attacker with physical access can exploit CVE-2026-85083 to ga...

NewStart CGSL MAIN 7.02 : cloud-init Vulnerability (NS-SA-2026-0114)

The remote NewStart CGSL host, running version MAIN 7.02, has cloud-init packages installed that are affected by a vulnerability: - When a non-x86 platform is detected, cloud-init grants root access to a hardcoded url with a local IP address. To prevent this, cloud-init default configurations...

Malicious code in eth-lib-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea8d2399c30a7656138ab2024250aeb8814c3ccd32e0104f87933eece367a829 The package presents itself as an Ethereum balance helper, but on the first call to the advertised getEthLibBalance API it invokes...

MAL-2026-15981 Malicious code in eth-lib-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea8d2399c30a7656138ab2024250aeb8814c3ccd32e0104f87933eece367a829 The package presents itself as an Ethereum balance helper, but on the first call to the advertised getEthLibBalance API it invokes...

Malicious code in eth-query-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55a24a29ae503dbb2bc291fcbd2d7eafdc92a6927a9a91bbda677e9b9b9b8c22 Package presents itself as an Ethereum RPC query helper but src/envcheck.cjs walks the caller's project tree on first use of the advertised...

MAL-2026-15982 Malicious code in eth-query-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55a24a29ae503dbb2bc291fcbd2d7eafdc92a6927a9a91bbda677e9b9b9b8c22 Package presents itself as an Ethereum RPC query helper but src/envcheck.cjs walks the caller's project tree on first use of the advertised...

jimureport-2.5.1-rce

JimuReport 2.5.1 Unauthorized Remote Code Execution Vulnerabil...

CVE-2026-55513

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.3.0 to before version 0.5.0, the nebula-mgmt Web UI host-creation path ignores both the server-wide enrollmenttokenttl security setting and per-network networkconfig.enrollmenttokenttl overrides. API host creatio...