Home / CVEs
CVE Database
Published vulnerabilities with severity, known exploitation and official sources.
CVE-2026-37152
Critical · 9.8
CWE-798 Sep 15, 2026
TOTOLINK X5000R V9.1.0cu.2415_B20250515 was discovered to contain a hardcoded password…
TOTOLINK X5000R V9.1.0cu.2415_B20250515 was discovered to contain a hardcoded password for root access.
CVE-2026-57147
Critical · 9.8
CWE-798 Sep 15, 2026
praisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgery
PraisonAI is a multi-agent teams system. Prior to 0.1.6, praisonai_platform/services/auth_service.py assigns the public dev-secret-change-me value to JWT_SECRET when PLATFORM_JWT_SECRET is unset, and its production guard does not run when PLATFORM_ENV is also unset because that setting defaults to dev. A remote unauthenticated attacker can mint an HS256 token with an arbitrary sub and email, and the platform's AuthService._verify_token() and get_current_user dependency accept the forged identity for protected API routes. This vulnerability is fixed in praisonai-platform 0.1.6.
CVE-2026-79396
Critical · 9.8
CWE-798 Sep 11, 2026
Use of hardcoded default credentials in Xiongmai IP Camera XM530 firmware…
Use of hardcoded default credentials in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier stores static account credentials in unencrypted plaintext within bin/config.xml and compiled into the Sofia executable, allowing remote attackers to gain full administrative control over the camera.
CVE-2026-85083
Medium · 6.8
CWE-798 Sep 11, 2026
CareCam Pro IP Cameras Use of Hard-coded Credentials
The ANJIA AJL33PC0801 IP camera uses a hard-coded credential for bootloader authentication. An attacker with physical access to the device may leverage this weakness to gain privileged bootloader access, allowing unauthorized modification of firmware and system configuration and potentially resulting in complete device compromise.
CVE-2026-75940
Critical · 9.1
CWE-798 Sep 10, 2026
Use of Hard-coded Credentials in Lenovo Health Application
A vulnerability was reported in Lenovo Health Android Application, distributed exclusively in the Chinese market, that could allow an attacker to access sensitive health-related information.
CVE-2026-85544
Medium · 6.1
CWE-798 Sep 10, 2026
Use of Hard-coded Credentials in Hikvision DS-KV9503
Some Hikvision intercom products utilize an immutable factory value which should be obtained from local network or physical interaction with the device within their main card, which may allow attackers to forge a legitimate main card, thereby gaining the permission to issue cards.
CVE-2026-17038
Medium · 6.9
CWE-798 Sep 10, 2026
Use of Hard-coded Credentials in drEryk Gabinet
DrEryk Gabinet before 11.5.0 uses hard-coded API credentials in its ticket reporting component. These credentials can be used to authenticate directly to the ticket system API. This allows an attacker to perform privileged operations beyond what is offered by the application, including reading and modifying tickets.
CVE-2026-71801
Critical · 9.8
CWE-798 Sep 9, 2026
An issue was discovered in s-pms SPMS-Server through v1.0. The application contains a…
An issue was discovered in s-pms SPMS-Server through v1.0. The application contains a hardcoded default access token secret within its core configuration file, which is not overridden or removed in the production environment profile. A remote, unauthenticated attacker can locally forge valid administrative session tokens to completely bypass the authentication mechanism gaining full unauthorized access to protected backend APIs.
CVE-2026-81640
High · 8.8
CWE-798 Sep 9, 2026
Softish C6 Ear Camera and EarVision Android Application Use of Hard-coded Credentials
An attacker could derive the camera's Wi-Fi password and connect to its wireless network. This weakens or eliminates the security value of the access-point password and may expose the live video stream, device services, status interfaces, and firmware-update functionality.
CVE-2026-79950
High · 7.5
CWE-798 Sep 9, 2026
Use of Hard-coded Credentials in Dell Secure Connect Gateway
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Credentials vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure.
CVE-2026-79740
High · 7.5
CWE-798 Sep 9, 2026
Use of Hard-coded Credentials in Dell Secure Connect Gateway
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Credentials vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure.
CVE-2026-79738
High · 7.5
CWE-798 Sep 9, 2026
Use of Hard-coded Credentials in Dell Secure Connect Gateway
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Credentials vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure.
CVE-2026-79731
Medium · 4.4
CWE-798 Sep 9, 2026
Use of Hard-coded Credentials in Dell Secure Connect Gateway
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Credentials vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure.
CVE-2026-80170
Medium · 6.5
CWE-798 Sep 7, 2026
Use of Hard-coded Credentials in Dell Secure Connect Gateway
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Credentials vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to protection mechanism bypass.
CVE-2026-80134
High · 7.7
CWE-798 Sep 7, 2026
Use of Hard-coded Credentials in Dell Secure Connect Gateway
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Credentials vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.
CVE-2026-77847
Medium · 6.5
CWE-798 Sep 4, 2026
Tycon Systems TPDIN-Monitor-WEB3 Use of Hard-coded Credentials
Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a use of hard-coded credential vulnerability. This could allow an attacker to intercept sensitive information or credentials.
CVE-2026-5522
Medium · 6.7
CWE-798 Sep 4, 2026
QRadar contains hard-coded credentials
IBM QRadar 7.5.0 through 7.5.0 UP15 Interim Fix 005 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.
CVE-2026-85149
Medium · 5.3
CWE-798 Sep 4, 2026
Lightstar｜SmartIT Desktop Manager - Use of Hard-coded Credentials
SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the SFTP service credentials of the SmartIT Agent application from the source code, thereby browsing the file system of the user's host.
CVE-2026-85148
Critical · 9.8
CWE-798 Sep 4, 2026
Lightstar｜SmartIT Desktop Manager - Use of Hard-coded Credentials
SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can exploit a fixed password to remotely access user hosts.
CVE-2026-85146
Critical · 9.8
CWE-798 Sep 4, 2026
Lightstar｜SmartIT Desktop Manager - Use of Hard-coded Credentials
SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the SSH service account credentials and passwords for the SmartIT Agent directly from the application source code.
CVE-2026-85451
High · 7.1
CWE-798 Sep 3, 2026
MOOS core-moos through 10.4.0 Remote Process Termination via Hard-Coded Multicast Passphrase
MOOS core-moos through 10.4.0 contains a remote process termination vulnerability in the SuicidalSleeper component that uses a hard-coded passphrase for multicast command authorization. Any multicast-reachable peer can enumerate MOOS processes and send termination commands to trigger process shutdown by exploiting the default multicast group and port with the known passphrase.
CVE-2026-85391
Critical · 9.8
CWE-798 Sep 3, 2026
Peppermint through 0.5.5 Use of Hard-coded JWT Signing Secret in docker-compose.yml
Peppermint through 0.5.5 contains a hardcoded JWT signing secret in docker-compose.yml that allows unauthenticated attackers to forge session tokens for any account. Attackers can use the published secret to mint valid tokens for arbitrary user IDs and access protected endpoints without credentials.
CVE-2024-7952
High · 8.7
CWE-798 Sep 1, 2026
DataEdgePlatform DataMosaix™ Private Cloud
A data exposure vulnerability exists in the affected product. There are hardcoded links in the source code that lead to JSON files that can be reached without authentication. If exploited, a threat actor could view customer data.
CVE-2026-18931
Critical · 9.1
CWE-798 Sep 1, 2026
Hardcoded Credentials in TMT Machine's Talassoft Industrial Management Software
Use of Hard-coded Credentials vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software allows Retrieve Embedded Sensitive Data.
This issue affects Talassoft Industrial Management Software: from V.4 before V.16.
CVE-2026-38577
Critical · 9.8
CWE-798 Aug 31, 2026
Insecure hardcoded credentials in the Admin account of Tenda HG21 V4.0.0-260302 allows…
Insecure hardcoded credentials in the Admin account of Tenda HG21 V4.0.0-260302 allows attackers to gain root access.