Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 440

Export CSV
CVE-2014-125135

OctoPrint Flask Secret Key hard-coded key

A security vulnerability has been detected in OctoPrint 1.0.0/1.1.0. Affected is an unknown function of the component Flask Secret Key Handler. Such manipulation leads to use of hard-coded cryptographic key . The attack may be performed from remote. Upgrading to version 1.11.1 is able to address this issue. The name of the patch is b4699825d6ab92d5451e5b1e3a06dfb81f86e777. The affected component should be upgraded.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Octoprint
Products
Octoprint
CVE-2026-42518

Information Disclosure Vulnerability in e-Sushrut HMIS

This vulnerability exists in e-Sushrut due to disclosure of sensitive information and hardcoded AES encryption keys in client-side JavaScript. An unauthenticated remote attacker could exploit this vulnerability by accessing the client-side code to extract sensitive information and cryptographic keys. Successful exploitation of this vulnerability could lead to exposure of sensitive data and compromise of cryptographic protections on the targeted system.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Cdac-noida
Products
E-sushrut Hospital Management Information System Hmis
CVE-2026-111633

ZKEACMS through 4.4 Authentication Bypass via Hard-Coded JWT Signing Key

ZKEACMS through 4.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge REST API JWT bearer tokens using a hard-coded HMAC-SHA256 signing key in JwtBearerDefaults.cs. Attackers can sign a token with the Name claim set to 'admin' to call ApiAuthorize endpoints, modifying articles and products and reading form submissions.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Seriawei
Products
Zkeacms
CVE-2026-111636

OpenBMB StaffDeck through 0.5.6 Authentication Bypass via Hard-Coded Session Secret

OpenBMB StaffDeck through 0.5.6 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator session tokens using the hard-coded default app_secret. Attackers can sign an HMAC-SHA256 token for the seeded 'admin' user in 'tenant_demo' to gain full tenant administration, including stored model and channel credentials.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Openbmb
Products
Staffdeck
CVE-2026-111696

data-platform-open through commit efeacd3 Hardcoded AES Key for Datasource Passwords

data-platform-open through commit efeacd3 uses a hardcoded, publicly known default AES key in AesPasswordEncAndDecServiceImpl, allowing authenticated attackers to decrypt stored datasource passwords. Attackers can obtain ciphertext passwords from the datasource detail API, for example via cross-workspace IDOR, and decrypt them offline to recover plaintext database credentials.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Shaiwz
Products
Data-platform-open
CVE-2026-82891

IBM Guardium Data Protection is affected by a security vulnerability

IBM Guardium Data Protection 12.1, and 12.2 could allow a remote attacker to obtain sensitive information due to use of a hard-coded cryptographic key.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Guardium Data Protection
CVE-2026-65198

Huawei Default SNMPv3 USM key

Huawei's openUBMC ships a default SNMPv3 USM key that uses one value for both authentication and privacy. An attacker who holds the key (recoverable from the open-source build) can authenticate SNMPv3 to, and decrypt SNMPv3 traffic from, any unit that still carries the shipped key. The build customization `manifest/build/customization/default_password.lua` sets `AuthenticationKey == EncryptionKey == 7df2f29369e3ac3245b2c9d46b67a0ecd055197e41808a34ef325db2f6422581` for the iBMC product build, and the community seed `account/manufacture/default_password.lua` sets both to `7a2f5b86f20233ec7b7bef49643fbf34d86d0cbf6f1f8f5c52d4f30d4536938b`. These are shipped constants, not per-unit values, and they are not rotated by the Administrator password reset, so they survive account provisioning. This is especially dangerous considering that SNMP access is mapped to full device administration privileges, including system reset and firmware upgrades.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Huawei
Products
Openubmc
CVE-2026-110214

Snowy 3.6.5 Hard-coded Download Signature Key Allows Unauthenticated File Download

Snowy 3.6.5 contains a hard-coded HMAC key vulnerability that allows unauthenticated attackers to forge download signatures for the /dev/file/download endpoint by using the published FILE_DOWNLOAD_SIGN_SECRET constant. Attackers can compute HMAC-SHA256 signatures of guessed file ids offline to download stored files such as avatars, editor images and attachments.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Xiaonuobase
Products
Snowy
CVE-2026-108336

Token Signing Key Allows Unauthenticated Administrative Access

When the default self-signed certificate is used, an attacker could gain administrative access to the application. The SSL certificate for the web interface is used to sign JWT access tokens that are used to validate that the user is logged in. When the default SSL certificate is used, an attacker could have the capability to sign JWT access tokens and bypass login. An attacker could gain administrative access to the application and perform actions like configuring the service or requesting log collection. Device credentials and customer data cannot be accessed with this vulnerability.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Hitachi
Products
Vantara Remote Ops Agent
CVE-2026-103778

Use of Hard‑coded Cryptographic Key in Dell Command | Configure Leading to Information Disclosure

Dell Command | Configure (DCC), versions prior to 5.2.3.35 contain a Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Information disclosure.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed
Vendors
Dell
Products
Command\|configure Command|configure
CVE-2026-113466

MinIO Embedded Console common-main.go SessionTokenAuthenticate hard-coded key

A security vulnerability has been detected in MinIO up to RELEASE.2025-10-15T17-29-55Z. This issue affects the function globalDeploymentID/SessionTokenAuthenticate of the file cmd/common-main.go of the component Embedded Console. Such manipulation leads to use of hard-coded cryptographic key . It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. This vulnerability only affects products that are no longer supported by the maintainer.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Minio
Products
Minio
CVE-2026-112014

LobsterAI before 2026.10.16 Hardcoded Password in Provider API Key Export

LobsterAI before 2026.10.16 contains a hardcoded password vulnerability that allows attackers to decrypt exported provider API keys encrypted with the constant 'lobsterai-APP'. Attackers who obtain a providers export file can derive the AES-GCM key via PBKDF2 using the embedded salt and recover every third-party AI provider API key.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Netease-youdao
Products
Lobsterai
CVE-2026-111690

Simple Admin Core through 1.8.7 Hard-Coded JWT Secret Authentication Bypass

Simple Admin Core through 1.8.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge super administrator tokens by using the hard-coded Auth.AccessSecret in api/etc/core.yaml. Attackers can sign a JWT with the public secret and roleId claim 001 to gain full administrative control over users, roles, menus, API authorities, configuration and tokens.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Suyuan32
Products
Simple-admin-core
CVE-2026-107171

Hardcoded Cryptographic Key Enables Local Database Decryption in Trellix Agent

An Hardcoded Cryptographic Key vulnerability existed in Trellix Agent 5.8.4 via mfecryptc.dll leads to Database Decryption by Regular Users.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Trellix
Products
Agent
CVE-2026-105035

EnergizeLab FirmwareUpdater Universal Hard-Coded AES Key

The EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the CDN bin.zip) uses a single hard-coded AES key shared by all installations. An attacker who recovers the key from the updater can decrypt and forge firmware packages for any device that trusts it.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Energizelab
Products
Firmwareupdater
CVE-2026-111612

netdisk-fast-download through 0.4.8 Credential Disclosure via /v2/randomAuth

netdisk-fast-download through 0.4.8 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve donated netdisk credentials via the /v2/randomAuth endpoint in ParserApi. Attackers can repeatedly call the endpoint and decrypt the encryptedAuth blob using the hard-coded AES key nfd_auth_key2026 to recover other users' cloud-drive cookies, tokens, or passwords.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Qaiu
Products
Netdisk-fast-download
CVE-2026-111692

DataBuff ai-apm-web through 0.1.10 Authentication Bypass via Hardcoded HMAC Secret

DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin session tokens by using the hardcoded HMAC secret in JwtTokenService. Attackers can sign a payload of admin and a future expiry with the default dev-secret to gain full administrative access to protected /webapi routes, including the Doris SQL query API.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Databufflabs
Products
Databuff
CVE-2026-111347

go-ldap-admin through 0.6.2 Hard-Coded RSA Private Key via /base/decryptpwd

go-ldap-admin through 0.6.2 embeds a hard-coded RSA private key, published in the public repository, that protects encrypted login passwords. Unauthenticated attackers who capture encrypted passwords can decrypt them offline or via the /base/decryptpwd endpoint, recovering cleartext LDAP credentials for reuse.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Opsre
Products
Go-ldap-admin
CVE-2026-109813

Shared Hard-coded Root CA Private Key

A hard-coded cryptographic key vulnerability exists in the `/usr/bin/sysman` of some of Moxa's industrial computing products. An unauthenticated attacker with adjacent network access could exploit the exposed private key material to compromise the confidentiality and integrity of communications.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Moxa
Products
Aig-302 Series
CVE-2026-53709

MCP Context Forge: Hardcoded default JWT_SECRET_KEY shipped in source and .env.example enables pre-authentication platform admin token forgery

MCP Context Forge is an MCP gateway and administrative platform. Prior to 1.0.2, mcpgateway/config.py and .env.example ship a known JWT_SECRET_KEY, while verify_jwt_token() accepts HS256 tokens signed with that key and get_current_user() creates a platform administrator when the token subject matches PLATFORM_ADMIN_EMAIL and REQUIRE_USER_IN_DB is false. A remote unauthenticated attacker can therefore mint accepted administrator tokens without a database account. While the vulnerable signing key remains configured and the platform-admin bootstrap remains enabled, forged access survives password rotation, account deletion, and session revocation, allowing administrative disclosure, modification, and service disruption. This issue is fixed in version 1.0.2.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—