CVE-2026-121144

Hardcoded Credentials Vulnerability in Tata Motors iRA and iRA.ev mobile application

This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to presence of hardcoded service account credentials, API Keys and authorization tokens within the application package. An unauthenticated remote attacker could exploit this vulnerability by downloading application package and extracting embedded sensitive information. Successful exploitation of this vulnerability could allow the attacker to gain unauthorized access to associated backend services and potentially access sensitive information or perform unauthorized operations on the targeted system.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Tata Motors

Products

Tata Motors Ira.ev Tata Motors Ira 2.0

CVE-2026-118601

Alpine iLX-F511 SSH Hard-Coded Credentials Remote Code Execution Vulnerability

Alpine iLX-F511 SSH Hard-Coded Credentials Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SSH service. The issue results from the use of hard-coded credentials. An attacker can leverage this vulnerability to execute code in the context of the telechips user. Was ZDI-CAN-29013.

CVSS 3.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Alpine

Products

Ilx-f511

CVE-2026-18449

Supermicro BMC contains a SMCRAKP Fixed Key vulnerability

The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that execute arbitrary commands on an active session.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Smci

Products

X12spi

CVE-2026-119736

Attendo Admin Android 3.0.13 Hard-coded MQTT Broker Credentials

Attendo (formerly Petpooja Payroll) Admin Android application version 3.0.13 and earlier contains a hard-coded credentials vulnerability that allows attackers to extract production MQTT broker credentials by decompiling the APK's bundled Flutter configuration assets such as production.json and device-command configuration files. Attackers can use the recovered credentials to authenticate to the production MQTT broker over TCP 1883, access messaging topics containing employee attendance records, personal identifiers, Base64-encoded photographs, device telemetry, and authentication material, and publish messages to those topics, resulting in exposure of sensitive data and potential unauthorized message injection.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Petpooja

Products

Munshi

CVE-2026-92450

Kiloview E3 NDI Encoder Use of Hard-coded Credentials

The authentication framework used by affected Kiloview E3 NDI encoder firmware signs session JSON Web Tokens using an HMAC-SHA256 secret hardcoded as a static string within the firmware image, identical across all deployed devices. An attacker with access to the publicly distributed firmware can recover this secret and forge arbitrary session tokens, including administrative tokens, without valid credentials, enabling unauthenticated access to privileged device functions.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Kiloview

Products

E3 Firmware

CVE-2026-111419

Hardcoded API Token in Foxit Official Website

A sensitive information exposure vulnerability exists on the Foxit official website because JavaScript code contains third-party authorization information. This may allow unauthorized parties to obtain or misuse the exposed credentials.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Foxitsoftware

Products

Foxit.com

CVE-2026-119662

Songloft 2.9.0 before 2.13.6 Hardcoded Admin Credentials in Embedded Backend

Songloft 2.9.0 before 2.13.6 contains a hardcoded credentials vulnerability that allows adjacent network attackers to authenticate as administrator using the fixed admin/admin pair. Attackers on the same network can log in via the /api/v1/auth/login endpoint to modify library and configuration settings and install JavaScript plugins running in QuickJS.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Songloft-org

Products

Songloft

CVE-2026-93290

Use of Hard-coded Credentials in Eufy Omni C20

Omni C20 uses hard-coded credentials that could allow an attacker to monitor log files to obtain credentials to access information like mapping data.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Eufy

Products

Omni C20

CVE-2026-59229

Apache IoTDB: Legacy Pipe Privilege Escalation

The Legacy Pipe receiver protocol (handshake / sendPipeData) uses a hardcoded SUPER_USER (root) identity when executing data loading and deletion operations. A user with only SYSTEM-level privileges (such as USE_PIPE or MAINTAIN) who does NOT have WRITE_DATA or DELETE_DATA permissions on target databases can send specially crafted PipeData messages through the Legacy Pipe API, resulting in data loading/deletion operations executed as root — effectively bypassing IoTDB's permission model entirely. This issue affects Apache IoTDB: from 2.0.0 before 2.0.11. Users are recommended to upgrade to version 2.0.11, which fixes the issue.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Iotdb

CVE-2026-54631

Part-DB: Hardcoded APP_SECRET enables forged remember-me cookie

Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the file .env committed in the Part-DB repository contains a fixed value for APP_SECRET (a03498528f5a5fc089273ec9ae5b2849). The official Docker image jbtronics/part-db1 does not override or randomize this value at container start-up. Because Symfony uses APP_SECRET (via kernel.secret) as the HMAC key for signing remember-me cookies, any attacker who knows the secret -- or fetches it from the public repository -- can forge an arbitrary-user remember-me cookie and gain a fully authenticated session with no credentials required. This issue has been patched in version 2.12.1.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Part-db

Products

Part-db

CVE-2026-81964

Windows Update Orchestrator Service Security Feature Bypass Vulnerability

Use of hard-coded credentials in Windows Update Orchestrator Service allows an authorized attacker to bypass a security feature locally.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 21h2 Windows 10 21h2 Windows 10 22h2 and 14 more

CVE-2026-114119

Best Practice Software Bp Premier before 1.14.1.1128 Hardcoded SQL Server Administrative Credential

Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server administrative password that is shared across all installations and cannot be changed without breaking the application. Attackers with network access to the database instance can authenticate as sysadmin, bypass application authentication, and execute operating system commands as SYSTEM.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Best Practice Software

Products

Bp Premier

CVE-2026-114088

Trigger.dev before 4.5.4 Hardcoded Coordinator Secret Authentication Bypass via Socket.IO

Trigger.dev before 4.5.4 contains a hardcoded default secret vulnerability in the /coordinator Socket.IO namespace that allows unauthenticated attackers to connect using the published coordinator-secret value. Attackers can emit READY_FOR_EXECUTION to retrieve decrypted run environment variables or send TASK_RUN_FAILED_TO_RUN and similar events to tamper with arbitrary runs.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Triggerdotdev

Products

Trigger.dev

CVE-2026-109566

Rapyd Admin 9.0.0 before 9.20.0 Hard-Coded Super-Admin Credentials via AuthSeeder

Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerability that allows remote unauthenticated attackers to gain super-admin access through an AuthSeeder-created admin@laravel account with password admin. The account is seeded by the setup installer and silently re-created on every rpd:make run, letting attackers log in as a global super admin bypassing per-record authorization and tenant scoping.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Zofe

Products

Rapyd-admin

CVE-2026-61684

FastGPT: Unauthenticated cross-tenant data access via forgeable plugin-invoke JWT (default INVOKE_TOKEN_SECRET='token')

FastGPT is a knowledge-based AI application platform. In 4.15.0-beta4, FastGPT plugin invoke reverse-call endpoints under /api/invoke/* authenticate only by verifying a JWT signed with INVOKE_TOKEN_SECRET, which defaults to the constant string token and was not set in official deployment templates. An unauthenticated attacker can self-sign an HS256 JWT and reach /api/invoke/userInfo to disclose cross-tenant user PII by attacker-supplied tmbId values, or /api/invoke/fileUpload to write attacker-controlled content into chat files. This issue is fixed in version 4.15.0-beta5.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Labring

Products

Fastgpt

CVE-2026-58245

Hard-coded Credentials in SAP Advanced Planning and Optimization (Model Mix Planning)

SAP Advanced Planning and Optimization (Model Mix Planning) contains a hardcoded credential within the source code of the application to perform authorization check to access certain functionalities in the application. An attacker with high privileges could leverage this hardcoded credential to bypass authorization and delete specific planning-related restrictions in the application. Successful exploitation could result in a low impact on confidentiality and integrity, with no impact on availability of the application.

CVSS 3.1 · 3.8 Low EPSS < 1% KEV · Not listed

Vendors

Sap Se

Products

Sap Advanced Planning And Optimization (model Mix Planning)

CVE-2026-76466

Cisco Expressway Series Remote Code Execution Vulnerability

A vulnerability in the database service feature of Cisco Expressway Series could allow an unauthenticated, remote attacker with network access to a Cisco Expressway device to execute arbitrary operating system commands as&nbsp;root. This vulnerability is due to the use of persistent cookies. Additionally, there is insufficient validation of client certificates when the TLS Verify Mode is set to Enabled for clustering, which means that client certificates are not validated. An attacker with possession of the cookies could exploit this vulnerability by connecting to the database service and invoking specific remote procedure call (RPC) commands. A successful exploit could allow the attacker to execute arbitrary commands as root on the underlying operating system of an affected device. Note: Cisco Expressway Series refers to Cisco Expressway Core (Expressway-C) devices and Cisco Expressway Edge (Expressway-E) devices.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Expressway Series

CVE-2026-77427

FileRise: Insecure default cryptographic key fallback in manual installs

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. From 3.9.0 until 3.22.0, pristine manual FileRise installations without PERSISTENT_TOKENS_KEY or metadata/persistent_tokens.key can activate a published legacy compatibility key. If an attacker separately obtains ciphertext-bearing account or configuration files, the known fallback key can enable decryption of TOTP secrets or credentials. Docker installations already generated a unique persistent key, and existing installations are not automatically rotated because doing so could make encrypted state unreadable. This issue is fixed in version 3.22.0.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Error311

Products

Filerise

CVE-2026-114219

NewType Infortech｜NT OneAPP - Hard-coded Credentials

NT OneAPP developed by NewType Infortech has a Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the hard-coded cryptographic key and decrypt login request contents, thereby obtaining users' plaintext account credentials and device information.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Newtype Infortech

Products

Nt Oneapp

CVE-2026-87950

SAML SSO - Service Provider - Moderately critical - Embedded credentials - SA-CONTRIB-2026-148

Use of Hard-coded Credentials vulnerability in Drupal SAML SSO - Service Provider allows Retrieve Embedded Sensitive Data. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Saml Sso - Service Provider