# CWE-1394.

Every Advisory and CVE whose sources give the weakness CWE-1394, newest first.

## Records, newest first

- [About Time Technologies｜Herowatch Go - Security Misconfiguration](https://agentprime.io/advisories/CVE-2026-121818.md)
  `CVE-2026-121818` · CVE record: About Time Technologies Herowatch Go · CVSS 8.5 High · Not analysed yet · Published 4 Nov 2026 · Tags: CWE-1394
- [ape-volo-admin before 3.6.1 Hardcoded JWT Signing Key Authentication Bypass](https://agentprime.io/advisories/CVE-2026-120442.md)
  `CVE-2026-120442` · CVE record: xianhc ape-volo-admin · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-1394
- [MuseBot before 2.0.0 Authentication Bypass via Hard-Coded Session Key](https://agentprime.io/advisories/CVE-2026-119660.md)
  `CVE-2026-119660` · CVE record: yincongcyincong MuseBot · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: CWE-1394
- [A potential vulnerability was reported in some Lenovo Tablets that could allow a user with physical access to an unlocked tablet to bypass device protections and execute arbitrary code.](https://agentprime.io/advisories/CVE-2026-92777.md)
  `CVE-2026-92777` · CVE record: Lenovo Idea Tab Pro (TB373FU) and 4 more · CVSS 5.4 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: CWE-1394
- [BillionMail through 4.9 Forgeable JWTs via Default Signing Key](https://agentprime.io/advisories/CVE-2026-111367.md)
  `CVE-2026-111367` · CVE record: aaPanel BillionMail · CVSS 6.9 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: CWE-1394
- [Gravitee API Management through 4.12.22 Default JWT Secret Authentication Bypass](https://agentprime.io/advisories/CVE-2020-37281.md)
  `CVE-2020-37281` · CVE record: Gravitee Gravitee API Management · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: CWE-1394
- [Siemens SIMATIC IPC BX-21A: A vulnerability has been identified in SIMATIC IPC BX-21A (All versions < V31.01.13)…](https://agentprime.io/advisories/CVE-2026-72895.md)
  `CVE-2026-72895` · CVE record: Siemens SIMATIC IPC BX-21A and 2 more · CVSS 8.4 High · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-1394
- [Express Gateway through 1.16.11 Hardcoded Default cipherKey Exposes OAuth Tokens](https://agentprime.io/advisories/CVE-2026-107177.md)
  `CVE-2026-107177` · CVE record: ExpressGateway express-gateway · CVSS 7.4 High · Not analysed yet · Published 7 Oct 2026 · Tags: CWE-1394
- [Punk versions before 0.18 for Perl allow session cookie forgery via an empty default HMAC key when a session is declared without a secret](https://agentprime.io/advisories/CVE-2026-75870.md)
  `CVE-2026-75870` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Aug 2026 · Tags: CWE-1394
- [DTLS server cookie bypass during startup window due to empty initial cookie secret](https://agentprime.io/advisories/CVE-2026-54887.md)
  `CVE-2026-54887` · CVE record: Erlang OTP · CVSS 6.3 Medium · Not analysed yet · Published 2 Jul 2026 · Tags: CWE-1394
- [Predictable Default Cryptographic Key Used for DES Encryption in TP-Link TL-WL841N](https://agentprime.io/advisories/CVE-2026-5039.md)
  `CVE-2026-5039` · CVE record: TP-Link Systems Inc. TL-WL841N v13 · CVSS 6.1 Medium · Not analysed yet · Published 23 Apr 2026 · Tags: CWE-1394
- [Intel(R) Pentium(R) Processor Silver Series…: Use of Default Cryptographic Key in the hardware for some Intel(R) Pentium(R) Processor…](https://agentprime.io/advisories/CVE-2026-20709.md)
  `CVE-2026-20709` · CVE record: Intel(R) Pentium(R) Processor Silver Series, Intel(R) Celeron(R) Processor J Series, Intel(R) Celeron(R) Processor N Series may allow an escalation of privilege. Hardware reverse engineer adversary with a privileged user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via physical access when attack requirements are present with special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (none) impacts. · CVSS 5.8 Medium · Not analysed yet · Published 8 Apr 2026 · Tags: CWE-1394
- [rachelos WeRSS we-mp-rss JWT auth.py default key](https://agentprime.io/advisories/CVE-2026-2215.md)
  `CVE-2026-2215` · CVE record: rachelos WeRSS we-mp-rss · CVSS 6.3 Medium · Not analysed yet · Published 9 Feb 2026 · Tags: CWE-1394
- [Fortinet FortiOS: Fortinet FortiOS through 7.6.6 allows attackers to decrypt LDAP credentials stored in…](https://agentprime.io/advisories/CVE-2026-25815.md)
  `CVE-2026-25815` · CVE record: Fortinet FortiOS · CVSS 3.2 Low · Not analysed yet · Published 5 Feb 2026 · Tags: CWE-1394
- [Sprecher Automation: SPRECON-E series has a critical vulnerability due to the use of static cryptographic keys in system components](https://agentprime.io/advisories/CVE-2025-41742.md)
  `CVE-2025-41742` · CVE record: Sprecher Automation SPRECON-E-C and 2 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Dec 2025 · Tags: CWE-1394
- [Sprecher Automation: SPRECON-E series has static default key material for TLS connections](https://agentprime.io/advisories/CVE-2025-41744.md)
  `CVE-2025-41744` · CVE record: Sprecher Automation SPRECON-E-C and 2 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Dec 2025 · Tags: CWE-1394
- [Use of Default Cryptographic Key (CWE-1394)](https://agentprime.io/advisories/CVE-2025-55049.md)
  `CVE-2025-55049` · CVE record: Baicells NEUTRINO430 · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Sept 2025 · Tags: CWE-1394
- [RUCKUS SmartZone: RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build has a hardcoded SSH private key for a…](https://agentprime.io/advisories/CVE-2025-44954.md)
  `CVE-2025-44954` · CVE record: RUCKUS SmartZone · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Aug 2025 · Tags: CWE-1394
- [System configuration password reset](https://agentprime.io/advisories/CVE-2025-1688.md)
  `CVE-2025-1688` · CVE record: Milestone Systems XProtect VMS · CVSS 5.5 Medium · Not analysed yet · Published 15 Apr 2025 · Tags: CWE-1394
- [There is a Hard-coded Cryptographic Key in Docusnap 13.0.1440.24261, and earlier and later versions.](https://agentprime.io/advisories/CVE-2025-26849.md)
  `CVE-2025-26849` · CVE record: Docusnap Docusnap · CVSS 4.3 Medium · Not analysed yet · Published 4 Mar 2025 · Tags: CWE-1394
- [Serviceware Processes 6.0 through 7.3 before 7.4 allows attackers without valid authentication to send a specially crafted HTTP request to a service endpoint resulting in remote code execution.](https://agentprime.io/advisories/CVE-2024-48956.md)
  `CVE-2024-48956` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Dec 2024 · Tags: CWE-1394
- [macrozheng mall JWT Token default key](https://agentprime.io/advisories/CVE-2024-11619.md)
  `CVE-2024-11619` · CVE record: macrozheng mall · CVSS 2.3 Low · Not analysed yet · Published 22 Nov 2024 · Tags: CWE-1394
- [Cosmote Greece What's Up App Realm Database RealmDB.java default key](https://agentprime.io/advisories/CVE-2024-10748.md)
  `CVE-2024-10748` · CVE record: Cosmote Greece What's Up App · CVSS 2.0 Low · Not analysed yet · Published 4 Nov 2024 · Tags: CWE-1394
- [Vulnerability in Baxter Welch Allyn Connex Spot Monitor](https://agentprime.io/advisories/CVE-2024-1275.md)
  `CVE-2024-1275` · CVE record: Baxter Welch Allyn Connex Spot Monitor · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 May 2024 · Tags: CWE-1394
- [Default secret use for initial deployment](https://agentprime.io/advisories/CVE-2024-29037.md)
  `CVE-2024-29037` · CVE record: acryldata datahub-helm · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Mar 2024 · Tags: CWE-1394
- [Publicly Known Cryptographic Machine Key In Procura Portal Application](https://agentprime.io/advisories/CVE-2023-6451.md)
  `CVE-2023-6451` · CVE record: AlayaCare Procura Portal · CVSS 8.6 High · Not analysed yet · Published 16 Feb 2024 · Tags: CWE-1394

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-1394>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-1394/>. Everything for agents: <https://agentprime.io/llms.txt>.