CVE-2023-53983

Anevia Flamingo XL/XS 3.6.20 Default Credentials Authentication Bypass

Anevia Flamingo XL/XS 3.6.20 contains a critical vulnerability with weak default administrative credentials that can be easily guessed. Attackers can leverage these hard-coded credentials to gain full remote system control without complex authentication mechanisms.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Ateme

Products

Flamingo Flamingo Xl Flamingo Xl Firmware and 4 more

CVE-2022-50696

SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Hardcoded Credentials Authentication Bypass

SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain hardcoded credentials embedded in server binaries that cannot be modified through normal device operations. Attackers can leverage these static credentials to gain unauthorized access to the device across Linux and Windows distributions without requiring user interaction.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Linux Microsoft Sound4

Products

Linux Windows Big Voice2 and 20 more

CVE-2017-20234

GarrettCom Magnum 6K and 10K Authentication Bypass via Hardcoded String

GarrettCom Magnum 6K and 10K managed switches contain an authentication bypass vulnerability that allows unauthenticated attackers to gain unauthorized access by exploiting a hardcoded string in the authentication mechanism. Attackers can bypass login controls to access administrative functions and sensitive switch configuration without valid credentials.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Belden Garrettcom

Products

Garrettcom Magnum 6k And 10k Managed Switches Magnum Managed Networks Software-6k

CVE-2026-81440

Hard‑Coded Credentials Allow Remote Unauthorized Access in Dell OpenManage Server Administrator

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use of Hard-coded Credentials vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Dell

Products

Dell Openmanage Server Administrator Managed Node For Rhel 8.10 Dell Openmanage Server Administrator Managed Node For Rhel 9.4 Dell Openmanage Server Administrator Managed Node For Sles 15 and 3 more

CVE-2026-74893

openssl_encrypt before 1.4.0 JWT Token Forgery via Hardcoded Secrets

openssl_encrypt versions before 1.4.0 contain hardcoded default JWT signing secrets in config.py that pass validation checks. Attackers with access to source code can forge valid JWT tokens for any client_id to gain authenticated access to keyserver and telemetry APIs.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Jahlives

Products

Openssl Encrypt

CVE-2026-74892

openssl_encrypt before 1.4.0 Hardcoded Secret Key

openssl_encrypt versions before 1.4.0 contain a hardcoded default secret key in the standalone telemetry server configuration that is used for API key hashing. Attackers who know this default value can predict or forge API key hashes to compromise telemetry API authentication.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Jahlives

Products

Openssl Encrypt

CVE-2026-74891

openssl_encrypt before 1.4.0 Hardcoded Database Credentials

openssl_encrypt versions before 1.4.0 contain hardcoded database credentials in standalone server configuration files. Attackers on the same network can access PostgreSQL databases using well-known default credentials to retrieve sensitive data.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Jahlives

Products

Openssl Encrypt

CVE-2026-100294

Use of Hard-coded Credentials in Anjvision YSSD-RTMP-H5

In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, the firmware embeds hardcoded cloud‑API credentials that are shared across deployed devices. Anyone obtaining the public firmware package can reuse these values to interact with the cloud service in ways not intended for normal operation.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Anjvision

Products

Yssd-rtmp-h5

CVE-2026-96587

Use of Hard-coded Credentials in Viidure Dashcam Android Application

The Viidure Android application embeds permanent, plaintext cloud storage credentials within its compiled code. These credentials provide full access to critical platform storage, including the ability to read, modify, or delete operational files such as firmware and application binaries.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Viidure

Products

Dashcam Android Application

CVE-2026-65113

Hard‑Coded Credentials in NVIDIA Infrastructure Controller Allow Privilege Escalation

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause use of hard-coded credentials. A successful exploit of this vulnerability might lead to escalation of privileges, data tampering, denial of service, and information disclosure.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Linux Nvidia

Products

Linux Kernel Infra Controller Infrastructure Controller

CVE-2026-7193

Multiple vulnerabilities in the T-CPE301K 4G Mini WiFi Router from Shenzhen Dbit Network Equipment

A vulnerability relating to the use of predefined credentials in the Dbit T-CPE301K 4G WiFi mini-router allows an attacker connected to the same network to gain full root access to the device via the Telnet service (port 23) using static credentials.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Shenzhen Dbit Network Equipment

Products

T-cpe301k 4g Mini Wifi Router

CVE-2026-101052

refly-ai refly JWT Token app.config.ts hard-coded credentials

A security vulnerability has been detected in refly-ai refly up to 1.1.0. This issue affects some unknown processing of the file apps/api/src/modules/config/app.config.ts of the component JWT Token Handler. The manipulation with the input test leads to hard-coded credentials. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Refly-ai

Products

Refly

CVE-2026-76708

Unauthenticated Remote Unauthorized Access Vulnerability in HPE Networking Analytics and Location Engine (ALE)

A vulnerability exists in the Analytics and Location Engine (ALE) where the application and underlying operating system use default, hard-coded credentials for several administrative and system accounts. An unauthenticated remote attacker could exploit this vulnerability by attempting to log in using these known default credentials. Successful exploitation could result in an attacker gaining unauthorized access to the application's management interface and the underlying operating system, potentially leading to full system compromise.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Arubanetworks Hewlett Packard Enterprise (hpe)

Products

Analytics And Location Engine Ale

CVE-2026-79959

Botslab G980H Dashcams Use of Hard-coded Credentials

The Botslab G980H dash camera firmware contains a hard-coded root account password that cannot be changed by the user. An attacker who obtains the firmware or has physical access to the device could recover the credential and use it to obtain root access through the UART interface.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

Botslab

Products

G980h

CVE-2026-96548

sfturing hosp_order jdbc.properties hard-coded credentials

A flaw has been found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. This affects an unknown part of the file ssm_pro/src/main/resources/jdbc.properties. This manipulation causes hard-coded credentials. It is possible to initiate the attack remotely. The attack's complexity is rated as high. It is indicated that the exploitability is difficult. The exploit has been published and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Sfturing

Products

Hosp Order

CVE-2026-93970

aiyiyi121 SxDevOps Settings settings.py hard-coded credentials

A security flaw has been discovered in aiyiyi121 SxDevOps 1.0/1.1. This issue affects some unknown processing of the file backend/sxdevops/settings.py of the component Settings Handler. The manipulation results in hard-coded credentials. The attack may be performed from remote. The patch is identified as 2b4bf8585c3e731e7a8af30801ea46680bc783f9. Applying a patch is advised to resolve this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Aiyiyi121

Products

Sxdevops

CVE-2026-47116

LTSecurity LTK3500SF Hard-coded Credentials via Telnet/SSH

LTSecurity LTK3500SF contains a hard-coded credentials vulnerability where the root and guest account passwords are stored in /etc/shadow as weak hashes recoverable with dictionary-based cracking tools. The recovered credentials authenticate against the device's Telnet and SSH services and grant root-level access to the operating system. These services are not confirmed to start automatically at boot, so exploitation requires Telnet or SSH to be running, whether enabled by the device configuration or started manually.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Ltsecurity

Products

Ltk3500sf

CVE-2026-92928

Hardcoded Recovery Account Allows Unauthenticated Password Reset in OpenEye Apex NVR

OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 contains a hardcoded, undocumented recovery account with a shared credential that cannot be changed, disabled, or rotated. An unauthenticated remote attacker can use the account to authenticate to the password-reset workflow. The account does not provide normal administrator access; additional vulnerabilities are required to obtain an administrator takeover. The underlying design has been present since at least firmware 2.2.3.4. Upgrade to version 3.5.4.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Openeye

Products

Apex Network Video Recorder (nvr)

CVE-2026-93969

aiyiyi121 SxDevOps services.py ensure_default_superuser hard-coded credentials

A vulnerability was identified in aiyiyi121 SxDevOps 1.0/1.1. This vulnerability affects the function ensure_default_superuser of the file rbac/services.py. The manipulation leads to hard-coded credentials. The attack is possible to be carried out remotely. The identifier of the patch is 2b4bf8585c3e731e7a8af30801ea46680bc783f9. It is recommended to apply a patch to fix this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Aiyiyi121

Products

Sxdevops

CVE-2026-86555

Hardcoded Key Vulnerability in ZTE SmartLife APP

The ZTE SmartLife application has a hardcoded key. The key used to decrypt account server information is stored in plaintext in the code. Once the key is obtained, the server information can be decrypted, thus exposing it.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed

Vendors

Zte

Products

Smartlife