Base de CVEs

CVE-2026-12587 Alta · 8.6 CWE-798 26/08/2026

Embedded credentials in Virtuagym

The vulnerability allows the unauthorised generation of physical access QR codes due to the use of hard-coded credentials within the application. The generation mechanism uses the 'badge_number' parameter as the HMAC private key, the value of which remains static and is accessible via the API using the endpoint '/club/_id_club_/member/_id_member_/resamania_qr_info'. An attacker with access to this value and to the application’s cryptographic logic, which can be extracted by reverse engineering the APK as there is no code obfuscation, could generate valid QR codes indefinitely, even after the user has changed their password or logged out.

CVE-2026-59769 Crítica · 9.1 CWE-798 25/08/2026

Use of Hard-coded Credentials em FURUNO ELECTRIC CO., LTD. FA-50

FA-50 all versions contain hard-coded credentials. An attacker, who knows the credentials and has access to the vessel's internal network, can operate the settings screen using that credentials to alter the identification number.

CVE-2026-76131 Média · 5.3 CWE-798 21/08/2026

Use of Hard-coded Credentials em Yamaha Corporation VOCALOID6

Use of hard-coded credentials issue exists in VOCALOID6 , which may allow an attacker to impersonate a legitimate VOCALOID6 Editor and gain access to Yamaha's activation and content servers.

CVE-2026-76392 Média · 5.4 CWE-798 19/08/2026

Use of Hard-coded Credentials in Container Connections in Splunk AI Toolkit

In Splunk AI Toolkit versions below 6.0.0, a user who does not hold the "admin" or "power" Splunk roles could obtain predictable or default credentials for connected container services. The use of hard-coded credentials is possible because Splunk AI Toolkit generates or stores credentials for connected container services using predictable or hard-coded default values. For more information see Connections tab in the AI Toolkit (https://help.splunk.com/en/splunk-cloud-platform/apply-machine-learning/use-ai-toolkit/5.7.2/ai-toolkit-commands-macros-and-visualizations/connections-tab-in-the-ai-toolkit) in the Splunk documentation.

CVE-2026-71960 Crítica · 9.1 CWE-798 19/08/2026

Cudy WR3000 2.0 Hard-coded JWT Secret Authentication Bypass via MQTT

Cudy WR3000 2.0 running firmware before 2.5.24 contains a hard-coded JWT HMAC signing secret vulnerability in the Mosquitto MQTT broker's authentication plugin that allows unauthenticated attackers to forge valid JWT tokens by extracting the secret from the firmware image. Attackers can use the extracted secret to craft arbitrary JWT tokens and authenticate to the MQTT broker without legitimate credentials, gaining unauthorized access to the device's mesh networking interface.

CVE-2021-43717 Crítica · 9.8 CWE-798 18/08/2026

An issue exists in pson EH-TW5350 Epson iProjection.apk v3.2.6. If you identify a…

An issue exists in pson EH-TW5350 Epson iProjection.apk v3.2.6. If you identify a projector equipped with an iProjection function, you can access the projector using hard-coded authentication information and control the projector maliciously.

CVE-2026-74893 Alta · 8.8 CWE-798 17/08/2026

openssl_encrypt before 1.4.0 JWT Token Forgery via Hardcoded Secrets

openssl_encrypt versions before 1.4.0 contain hardcoded default JWT signing secrets in config.py that pass validation checks. Attackers with access to source code can forge valid JWT tokens for any client_id to gain authenticated access to keyserver and telemetry APIs.

CVE-2026-74892 Alta · 7.5 CWE-798 17/08/2026

openssl_encrypt before 1.4.0 Hardcoded Secret Key

openssl_encrypt versions before 1.4.0 contain a hardcoded default secret key in the standalone telemetry server configuration that is used for API key hashing. Attackers who know this default value can predict or forge API key hashes to compromise telemetry API authentication.

CVE-2026-74891 Crítica · 9.8 CWE-798 17/08/2026

openssl_encrypt before 1.4.0 Hardcoded Database Credentials

openssl_encrypt versions before 1.4.0 contain hardcoded database credentials in standalone server configuration files. Attackers on the same network can access PostgreSQL databases using well-known default credentials to retrieve sensitive data.

CVE-2026-50601 Média · 6.6 CWE-798 17/08/2026

Planet9 Hardcoded Credentials Vulnerability Information

A security vulnerability has been identified in the Planet9 desktop application where a hardcoded read-only API key permitted unauthorized access to internal repositories. An attacker could exploit this access to extract embedded administrative keys and secrets, potentially allowing them to gain administrative access to repository infrastructure and modify software source code. To mitigate this security risk, Acer has released an update to resolve the issue.

CVE-2026-63702 Média · 5.5 CWE-798 14/08/2026

Use of Hard-coded Credentials em Dell Wyse Management Suite

Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain a Use of Hard-coded Credentials vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access.

CVE-2026-19871 Crítica · 9.3 CWE-798 14/08/2026

Use of hard-coded credentials in Prospero Flow CRM employee onboarding

Use of Hard-coded Credentials in the human resources component in Roskus Prospero Flow CRM before 5.15.9 allows unauthenticated remote attackers to authenticate as any employee onboarded through the standard flow, knowing only their email address, because the employee save controller falls back to the literal password "changeme" and the onboarding form provides no password field.

CVE-2026-18164 Alta · 8.1 CWE-798 13/08/2026

Flow Neuroscience FL-100 Use of Hard-coded Credentials

An undocumented hard-coded credential, shared by all device units, is authorized to bypass authentication. This allows an attacker within Bluetooth range to arbitrarily manipulate brain stimulation parameters and state.

CVE-2026-13460 Alta · 7.5 CWE-798 13/08/2026

The following vulnerabilities that can affect IBM Storage Scale and the Management GUI are now fixed in 5.2.3.9 or higher and 6.0.1.1 or higher

IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.0.0 through 6.0.1.0 GUI contains a hardcoded token in the source code, which was used for inter-node cluster communication and REST API authentication between GUI.

CVE-2026-67614 Crítica · 9.8 CWE-798 13/08/2026

CyberPanel < 3.0.0 Hard-coded JWT Secret Authentication Bypass via WebTerminal

CyberPanel before 3.0.0 contains a hard-coded JWT secret vulnerability in the WebTerminal FastAPI SSH service that allows unauthenticated remote attackers to forge valid authentication tokens and obtain an interactive root shell via WebSocket on port 8888. Attackers can craft a forged JWT signed with the hardcoded secret value, specifying ssh_user=root, to authenticate to the terminal service without any valid credentials and receive a root shell.

CVE-2026-59507 Crítica · 9.3 CWE-798 13/08/2026

Priority – CWE-798: Use of Hard-coded Credentials CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-284: Improper Access Control

: Use of Hard-coded Credentials : Exposure of Sensitive Information to an Unauthorized Actor : Improper Access Control vulnerability in Priority Portal Generator addon to Priority ERP (developed by Soft Solutions). This issue affects Portal Generator addon to Priority ERP (developed by Soft Solutions): All versions without Priwall v3.

CVE-2026-73519 Crítica · 9.8 CWE-798 12/08/2026

WolfStack < 25.9.2 Hard-coded Secret Authentication Bypass via X-WolfStack-Secret

WolfStack before 25.9.2 contains a hard-coded cluster-authentication secret compiled into every build and published as a constant in src/auth/mod.rs, allowing remote unauthenticated attackers to bypass authentication by supplying this value in the X-WolfStack-Secret header to the require_auth() gate without any session, API key, or user account. Attackers can reach an affected node's management port to enumerate all Docker and LXC containers on the host and execute arbitrary commands as root inside any container via the POST /api/containers/{runtime}/{id}/exec endpoint.

CVE-2026-14866 Alta · 7.1 CWE-798 12/08/2026

IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities

IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to injection of rogue certificate authority due to publicly writeable truststore.

CVE-2026-67568 Crítica · 9.1 CWE-798 11/08/2026

Mira Hormone Monitor, Mira Android App Use of Hard-coded Credentials

The distributed Mira Android APK v4.5.15.4 allows an attacker read/write access to reproductive health profiles from internet connected hosts, which could result in forgery, deletion, or destruction of health information.

CVE-2026-69102 Crítica · 9.8 CWE-798 11/08/2026

MaxKey Hard-coded JWT Secret Unauthorized Access via /login/jwt/trust

MaxKey contains an unauthorized access vulnerability due to a hard-coded JWT signing secret in application-maxkey.properties that allows unauthenticated attackers to forge valid JWT tokens and authenticate as any user by exploiting the password-skipped login endpoint. Attackers can craft a JWT token signed with the publicly known default secret, submit it to the /sign/login/jwt/trust endpoint, and obtain a fully authenticated admin session with access to SSO application configuration and downstream application secrets.

CVE-2026-58245 Baixa · 3.8 CWE-798 10/08/2026

Hard-coded Credentials in SAP Advanced Planning and Optimization (Model Mix Planning)

SAP Advanced Planning and Optimization (Model Mix Planning) contains a hardcoded credential within the source code of the application to perform authorization check to access certain functionalities in the application. An attacker with high privileges could leverage this hardcoded credential to bypass authorization and delete specific planning-related restrictions in the application. Successful exploitation could result in a low impact on confidentiality and integrity, with no impact on availability of the application.

CVE-2025-13293 Crítica · 9.3 CWE-798 10/08/2026

Backdoor / default root credentials

A hard-coded or default root account credential in TBEA TLogger V2.1.0.0B0.0.0.0 allows an unauthenticated remote attacker to obtain root-level access to the device via the exposed SSH service. The root password can be recovered from the password hash stored in /etc/shadow and used to authenticate to the SSH service. Successful exploitation provides full administrative control of the affected device.

CVE-2026-6374 Alta · 7.3 CWE-798 10/08/2026

Hardcoded Credentials in Zyxel WAH7601 Router

Use of Hard-coded Credentials vulnerability in Zyxel Networks WAH7601 allows Read Sensitive Constants Within an Executable. This issue affects WAH7601: through 20.07.2026.

CVE-2026-49007 Alta · 7.5 CWE-798 07/08/2026

Information leakage vulnerability in ZTE F689 product

By accessing unencrypted information in the device firmware, an attacker can obtain the initial login credentials for the device's web interface.

CVE-2025-63823 Crítica · 9.8 CWE-798 05/08/2026

My Safetipin Android Application 5.2.1 contains Hardcoded credentials in the…

My Safetipin Android Application 5.2.1 contains Hardcoded credentials in the authentication module, which allows remote attackers to bypass authentication and gain unauthorized access to user accounts via predictable OTP values.