CWE-1188.

KGUARD DVR unauthenticated remote command execution vulnerability

• KGUARD_firmware
• CWE-1188

Information disclosure in Eclipse Foundation Eclipse aeriOS

• Eclipse Foundation Eclipse aeriOS
• Information disclosure
• Authentication bypass

NLTK: Default ENFORCE=False Disables All pathsec Security Controls

• CWE-1188

<3.10.0 · fixed in 3.10.0

Wallos incomplete fix for CVE-2026-33407: unauthenticated httpoxy SSRF still reachable via `endpoints/payments/search.php`

• ellite Wallos
• Server-side request forgery (SSRF)
• CWE-441

oasdiff actions resolve external $refs by default, enabling SSRF and disclosure of structured files on pull-request runs

• oasdiff-action
• Information disclosure
• Server-side request forgery (SSRF)

Eval Injection in google/langfun via default lf.query protocol

• Google langfun
• Code injection
• CWE-1188

mcp-shell has a Secure Mode Allowlist Bypass via Default `/bin/bash` Executable

• Command injection
• CWE-183

<0.6.0 · fixed in 0.6.0

rConfig Core 8.0.0 < 8.2.10 Unauthorized Admin Registration via web.php

• rconfig
• Authentication bypass
• CWE-1188

Duplicate Advisory: [CWE-1188] Default ENFORCE=False Disables All pathsec Security Controls

• CWE-1188

<=3.9.4 · no fixed version yet

Hugo 0.162.0 to 0.164.x - Node Permission Model Bypass via Default TailwindCSS Child-Process Grant

• hugo
• CWE-1188

OpenAM Insecure SSO Cookie Initialization

• CWE-1004
• CWE-1188

<16.1.1 · fixed in 16.1.1

CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 contains a default TPM PCR policy that fails to consider the system boot state.

• CWE-1188

Npcap driver installed without administrator-only access restriction on Windows in Arc before v2.7.0

• Nozomi Networks Arc
• CWE-1188

Sharp Corporation Network Scanner Tool Lite: Network Scanner Tool and Network Scanner Tool Lite provided by Sharp Corporation…

• Sharp Corporation Network Scanner Tool Lite
• Sharp Corporation Network Scanner Tool (Bundled software for Sharpdesk)
• CWE-1188

Sharp and Toshiba Tec MFPs (multifunction printers) for a certain market have been shipped with the user authentication feature disabled in the initial configuration.

• Sharp Corporation Sharp MFPs
• Toshiba Tec Corporation Toshiba Tec MFPs
• CWE-1188

VPS.org one-click Zulip template deployment instance contains multiple vulnerabilities

• VPS.org Zulip template
• Hard-coded credentials
• CWE-1188

VPS.org one-click Supabase template deployment instance contains multiple vulnerabilities

• VPS.org Supabase template
• CWE-1188
• CWE-1327

Juggle 1.6.0 Unauthenticated RCE via Exposed H2 Console

• somta Juggle
• Authentication bypass
• CWE-1188

Active Storage has possible arbitrary file read and remote code execution in Active Storage variant processing

• CWE-1188

<7.2.3.2 || >=8.0.0.beta1, <8.0.5.1 || >=8.1.0.beta1, <8.1.3.1 · fixed in 7.2.3.2, 8.0.5.1, 8.1.3.1

Joomla Extension - joomdle.com - Insecure default configuration allows read/write user account access in Joomdle < 3.1.1

• joomdle.com Joomdle component for Joomla
• Information disclosure
• CWE-1188

MCP Server Exposure via Insecure Default Binding on alibabacloud-rds-openapi-mcp-server

• Alibaba Cloud RDS OpenAPI MCP Server
• CWE-1188

Privacy/configuration issue when adding local data in views through 'unbound-control'

• NLnet Labs Unbound
• CWE-1188

Joomla Extension - joomdonation.com - Insecure default configuration Membership Pro < 4.6.2

• joomdonation.com Membership Pro extension for Joomla
• CWE-1188

Joomla Extension - joomdonation.com - Insecure default configuration Events Booking < 5.8.0

• joomdonation.com Events Booking extension for Joomla
• CWE-1188

Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover

• CWE-1188

<2.58.0 · fixed in 2.58.0

Argo CD Helm Chart < 10.0.0 Missing Network Policy RCE

• argoproj argo-helm
• CWE-1188

Duplicate Advisory: PraisonAI: Prompt Injection Defense Bypassed for HIGH-Level Threats

• CWE-1188

<=4.6.77 · no fixed version yet

SiYuan: Stored XSS to RCE via attribute-view cell rendering in genAVValueHTML()

• Cross-site scripting (XSS)
• CWE-1188

<0.0.0-20260628153353-2d5d72223df4 · fixed in 0.0.0-20260628153353-2d5d72223df4

SiYuan: Stored XSS to RCE via CSS-snippet <style> breakout in renderSnippet()

• Cross-site scripting (XSS)
• CWE-1188

<0.0.0-20260628153353-2d5d72223df4 · fixed in 0.0.0-20260628153353-2d5d72223df4

SiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode arbitrary file─read), Incomplete fix of CVE-2026-41894

• Path traversal
• CWE-1188

<0.0.0-20260628153353-2d5d72223df4 · fixed in 0.0.0-20260628153353-2d5d72223df4

Siemens CPCI85 Central Processing/Communication: A vulnerability has been identified in CPCI85 Central Processing/Communication (All…

• Siemens CPCI85 Central Processing/Communication
• Siemens SICORE Base system
• CWE-1188

Better Auth has insecure cryptographic defaults in oidcProvider: alg=none advertised and plain PKCE accepted by default

• Weak cryptography or TLS
• CWE-757

<1.6.11 · fixed in 1.6.11

Sssd: sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• CWE-1188

Nitter - Server-Side Request Forgery in /video Media Proxy Endpoint

• zedeus nitter
• Server-side request forgery (SSRF)
• CWE-1188

nono-py vulnerable to authorization bypass / policy confusion

• CWE-1188

<0.11.0 · fixed in 0.11.0

OpenProject: Pre-authentication RCE in openproject/openproject Docker image via default `SECRET_KEY_BASE=OVERWRITE_ME` and `cookies_serializer = :marshal`

• opf openproject
• Insecure deserialization
• Hard-coded credentials

OpenAM Authentication Bypass via MSISDN LDAP Injection

• Other injection
• CWE-1188

<16.1.1 · fixed in 16.1.1

MessagePack-CSharp: ASP.NET Core MessagePackInputFormatter defaults to TrustedData for HTTP request bodies

• CWE-1188

<2.5.301 || >=3.0, <3.1.7 · fixed in 2.5.301, 3.1.7

MessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflows

• Memory corruption
• Denial of service

>=3.0, <3.1.7 · fixed in 3.1.7

Appsmith: Caddy admin API exposed without authentication

• appsmith
• CWE-749
• CWE-1188

Kozou: Unauthenticated MCP HTTP server and bundled dev-stack hardening (DNS-rebinding, request-body limits, read-only reads, default network exposure)

• Denial of service
• CWE-272

<1.8.1 · fixed in 1.8.1

Microsoft Visual Studio Code CoPilot Chat Security Feature Bypass Vulnerability

• Microsoft GitHub Copilot Chat
• CWE-1188

praisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgery

• Hard-coded credentials
• CWE-1188

<0.1.6 · fixed in 0.1.6

praisonai-platform 0.1.4 still boots on the hardcoded JWT secret dev-secret-change-me (default-open production guard)

• Authentication bypass
• Hard-coded credentials

<0.1.6 · fixed in 0.1.6

npm PraisonAI MCPServer exposes unauthenticated HTTP tools/call

• Authentication bypass
• Broken access control

>=1.5.0, <1.7.2 · fixed in 1.7.2

praisonai: recipe serve auth middleware silently disables itself when no secret is set

• Authentication bypass
• CWE-1188

<4.6.59 · fixed in 4.6.59

Insecure Default Domain Allowlist in Splunk AI Toolkit

• Splunk AI Toolkit
• CWE-1188

In PostWipeData of recovery_ui.cpp, there is a possible data persistence issue after a factory reset due to a logic error in the code.

• Google Android
• CWE-1188

Use of a non-secure protocol as the default FTP configuration in Canon EOS Network Setting Tool Version 1.5.0 or earlier

• Canon Inc. EOS Network Setting Tool for Windows
• Canon Inc. EOS Network Setting Tool for macOS
• CWE-1188

MISP automation endpoints may be exposed to CSRF when Sec-Fetch-Site protection is disabled by default

• misp
• Cross-site request forgery (CSRF)
• CWE-1188

Spring Web Services: Wss4jSecurityInterceptor disables WS-I BSP validation by default

• CWE-1188

>=5.0.0, <5.0.2 || >=4.1.0, <4.1.4 || >=4.0.0, <=4.0.18 || >=3.1.0, <=3.1.8 · fixed in 5.0.2, 4.1.4

Netty has a Vulnerable Default Configuration Which Leads to Denial of Service via Unbounded HTTP/3 Header Size

• Denial of service
• CWE-1188

>=4.2.0.Final, <4.2.15.Final · fixed in 4.2.15.Final

DbGate: Unauthenticated Remote Code Execution via JSON Script Runner

• Code injection
• CWE-20

<7.1.9 · fixed in 7.1.9

Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 contains hardcoded WiFi driver credentials including a RADIUS shared secret, WPS test key, and default PSK embedded in the production firmware…

• Hard-coded credentials
• CWE-1188

Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 enables WPS 2.0 by default with a weak lockout policy (60-second lockout after 10 attempts).

• Authentication bypass
• CWE-1188

Apache Solr has hardcoded credentials in the Basic Authentication setup tool

• Hard-coded credentials
• CWE-1188

>=9.4.0, <=9.10.1 · no fixed version yet

PraisonAI `deploy --type api` emits a Flask server with authentication disabled by default

• Authentication bypass
• CWE-1188

<4.6.40 · fixed in 4.6.40

Initialization of a resource with an insecure default in XCharge C6

• XCharge C6
• CWE-1188

NVIDIA Display Driver for Linux contains a vulnerability in the Multi-Instance GPU (MIG) partition management, where an insecure default initialization of memory subsystem routing resources could lea…

• NVIDIA GeForce
• NVIDIA RTX, Quadro, NVS
• CWE-1188

lmdeploy: Hardcoded trust_remote_code=True is an implicit unsafe remote-code load path with no user opt-out

• Code injection
• Broken access control

<0.13.0 · fixed in 0.13.0