Advisories · Weakness

CWE-320.

Every Advisory and CVE whose sources give the weakness CWE-320, newest first.

CVE-2014-125135 CVE record

CVSS 6.9 Medium

OctoPrint Flask Secret Key hard-coded key
- OctoPrint
- Hard-coded credentials
- CWE-320
Not analysed yet 26 Oct 2026
CVE-2026-113466 CVE record

CVSS 6.9 Medium

MinIO Embedded Console common-main.go SessionTokenAuthenticate hard-coded key
- MinIO
- Hard-coded credentials
- CWE-320
Not analysed yet 20 Oct 2026
CVE-2026-108798 CVE record

CVSS 6.9 Medium

ZKTeco BioTime hard-coded key
- ZKTeco BioTime
- Hard-coded credentials
- CWE-320
Not analysed yet 12 Oct 2026
CVE-2026-105392 CVE record

CVSS 6.9 Medium

Lybbn Django-Vue-Lyadmin JWT Signing settings.py hard-coded key
- Lybbn Django-Vue-Lyadmin
- Hard-coded credentials
- CWE-320
Not analysed yet 5 Oct 2026
CVE-2026-102241 CVE record

CVSS 5.1 Medium

Netcore NAP930 Backup/Restore backup_common.sh hard-coded key
- Netcore NAP930
- Hard-coded credentials
- CWE-320
Not analysed yet 29 Sept 2026
CVE-2026-90510 CVE record

CVSS 6.9 Medium

dromara orion-visor HostKeyServiceImpl.java HostKeyServiceImpl.encryptKey hard-coded key
- dromara orion-visor
- Hard-coded credentials
- CWE-320
Not analysed yet 13 Sept 2026
CVE-2026-86241 CVE record

CVSS 5.3 Medium

liufee FeehiCMS Cookie Validation main-local.php hard-coded key
- liufee FeehiCMS
- Hard-coded credentials
- CWE-320
Not analysed yet 7 Sept 2026
CVE-2026-56254 CVE record

CVSS 8.3 High

capacitor-updater - End-to-End Encryption Bypass via Private Key Distribution
- capacitor-updater
- CWE-320
Not analysed yet 10 Jul 2026
CVE-2026-11505 CVE record

CVSS 2.3 Low

GL.iNet XE3000 glnassys hard-coded key
- GL.iNet A1300
- GL.iNet AX1800
- Hard-coded credentials
- CWE-320
Not analysed yet 8 Jun 2026
CVE-2026-8739 CVE record

CVSS 6.9 Medium

Sanluan PublicCMS SafeConfigComponent.java getSignKey hard-coded key
- Sanluan PublicCMS
- Hard-coded credentials
- CWE-320
Not analysed yet 17 May 2026
CVE-2026-8243 CVE record

CVSS 6.9 Medium

Industrial Application Software IAS Canias ERP JNLP Deployment Endpoint hard-coded key
- Industrial Application Software IAS Canias ERP
- Hard-coded credentials
- CWE-320
Not analysed yet 10 May 2026
CVE-2026-7306 CVE record

CVSS 6.3 Medium

Xuxueli xxl-job OpenAPI Endpoint OpenApiController.java hard-coded key
- Xuxueli xxl-job
- Hard-coded credentials
- CWE-320
Not analysed yet 28 Apr 2026
CVE-2026-7018 CVE record

CVSS 6.3 Medium

Datavane Datavines JWT Token TokenManager.java hard-coded key
- Datavane Datavines
- Hard-coded credentials
- CWE-320
Not analysed yet 26 Apr 2026
CVE-2026-6611 CVE record

CVSS 2.3 Low

liangliangyy DjangoBlog File Upload Endpoint settings.py hard-coded key
- liangliangyy DjangoBlog
- Hard-coded credentials
- CWE-320
Not analysed yet 20 Apr 2026
CVE-2026-6580 CVE record

CVSS 6.9 Medium

liangliangyy DjangoBlog Amap API Call views.py hard-coded key
- liangliangyy DjangoBlog
- Hard-coded credentials
- CWE-320
Not analysed yet 19 Apr 2026
CVE-2026-5622 CVE record

CVSS 6.3 Medium

hcengineering Huly Platform JWT Token token.ts hard-coded key
- hcengineering Huly Platform
- Hard-coded credentials
- CWE-320
Not analysed yet 6 Apr 2026
CVE-2026-5549 CVE record

CVSS 6.9 Medium

Tenda AC10 RSA 2048-bit Private Key privkeySrv.pem hard-coded key
- Tenda AC10
- Hard-coded credentials
- CWE-320
Not analysed yet 5 Apr 2026
CVE-2026-5527 CVE record

CVSS 6.9 Medium

Tenda 4G03 Pro ECDSA P-256 Private Key server.key hard-coded key
- Tenda 4G03 Pro
- Hard-coded credentials
- CWE-320
Not analysed yet 4 Apr 2026
CVE-2026-5471 CVE record

CVSS 4.8 Medium

Investory Toy Planet Trouble App app.investory.toyfactory google-services-desktop.json hard-coded key
- Investory Toy Planet Trouble App
- Hard-coded credentials
- CWE-320
Not analysed yet 3 Apr 2026
CVE-2026-5462 CVE record

CVSS 4.8 Medium

Wahoo Fitness SYSTM App com.WahooFitness.SYSTM BuildConfig.java hard-coded key
- Wahoo Fitness SYSTM App
- Hard-coded credentials
- CWE-320
Not analysed yet 3 Apr 2026
CVE-2026-5458 CVE record

CVSS 4.8 Medium

Noelse Individuals & Pro App com.afone.noelse BuildConfig.java hard-coded key
- Noelse Individuals & Pro App
- Hard-coded credentials
- CWE-320
Not analysed yet 3 Apr 2026
CVE-2026-5457 CVE record

CVSS 4.8 Medium

PropertyGuru AgentNet Singapore App com.allproperty.android.agentnet BuildConfig.java hard-coded key
- PropertyGuru AgentNet Singapore App
- Hard-coded credentials
- CWE-320
Not analysed yet 3 Apr 2026
CVE-2026-5456 CVE record

CVSS 4.8 Medium

Align Technology My Invisalign App com.aligntech.myinvisalign.emea BuildConfig.java hard-coded key
- Align Technology My Invisalign App
- Hard-coded credentials
- CWE-320
Not analysed yet 3 Apr 2026
CVE-2026-5455 CVE record

CVSS 4.8 Medium

Dialogue App ca.diagram.dialogue config.json hard-coded key
- Dialogue App
- Hard-coded credentials
- CWE-320
Not analysed yet 3 Apr 2026
CVE-2026-5454 CVE record

CVSS 4.8 Medium

GRID Organiser App co.gridapp.organiser app.json hard-coded key
- GRID Organiser App
- Hard-coded credentials
- CWE-320
Not analysed yet 3 Apr 2026
CVE-2026-5453 CVE record

CVSS 4.8 Medium

Rico só vantagem pra investir App br.com.rico.mobile SegmentSettingsModule.java hard-coded key
- Rico só vantagem pra investir App
- Hard-coded credentials
- CWE-320
Not analysed yet 3 Apr 2026
CVE-2026-5452 CVE record

CVSS 4.8 Medium

UCC CampusConnect App campusconnect.ucc BuildConfig.java hard-coded key
- UCC CampusConnect App
- Hard-coded credentials
- CWE-320
Not analysed yet 3 Apr 2026
CVE-2026-5420 CVE record

CVSS 2.0 Low

Shinrays Games Goods Triple App cats.goods.sort.sorting.games jRwTX.java hard-coded key
- Shinrays Games Goods Triple App
- Hard-coded credentials
- CWE-320
Not analysed yet 2 Apr 2026
CVE-2026-5310 CVE record

CVSS 2.0 Low

Enter Software Iperius Backup IperiusAccounts.ini hard-coded key
- Enter Software Iperius Backup
- Hard-coded credentials
- CWE-320
Not analysed yet 1 Apr 2026
CVE-2026-4588 CVE record

CVSS 6.3 Medium

kalcaddle kodbox Site-level API key shareOut.class.php shareSafeGroup hard-coded key
- kalcaddle kodbox
- Hard-coded credentials
- CWE-320
Not analysed yet 23 Mar 2026
CVE-2026-4477 CVE record

CVSS 2.3 Low

Yi Technology YI Home Camera WPA/WPS hard-coded key
- Yi Technology YI Home Camera
- Hard-coded credentials
- CWE-320
Not analysed yet 20 Mar 2026
CVE-2026-3963 CVE record

CVSS 6.3 Medium

perfree go-fastdfs-web Apache Shiro RememberMe ShiroConfig.java rememberMeManager hard-coded key
- perfree go-fastdfs-web
- Hard-coded credentials
- CWE-320
Not analysed yet 11 Mar 2026
openclaw npm

CVSS 6.3 Medium

OpenClaw reuses the gateway auth token in the owner ID prompt hashing fallback
- Hard-coded credentials
- CWE-320
<2026.2.22 · fixed in 2026.2.22

GHSA-v6x2-2qvm-6gv8 · CVE-2026-32897 Not analysed yet 3 Mar 2026
github.com/actiontech/sqle Go

CVSS 6.3 Medium

SQLE's JWT Secret Handler can be manipulated to use hard-coded cryptographic key in github.com/actiontech/sqle
- Hard-coded credentials
- CWE-320
* · no fixed version yet

GHSA-43h9-hc38-qph5 · CVE-2025-15107 Not analysed yet 12 Jan 2026
CVE-2025-15108 CVE record

CVSS 6.3 Medium

PandaXGO PandaX JWT Secret config.yml hard-coded key
- PandaX
- Hard-coded credentials
- CWE-320
Not analysed yet 27 Dec 2025
CVE-2025-15105 CVE record

CVSS 6.3 Medium

getmaxun auth.ts hard-coded key
- maxun
- Hard-coded credentials
- CWE-320
Not analysed yet 27 Dec 2025
CVE-2025-15005 CVE record

CVSS 6.3 Medium

CouchCMS reCAPTCHA config.example.php hard-coded key
- CouchCMS
- Hard-coded credentials
- CWE-320
Not analysed yet 22 Dec 2025
CVE-2025-14651 CVE record

CVSS 6.3 Medium

MartialBE one-hub docker-compose.yml hard-coded key
- MartialBE one-hub
- Hard-coded credentials
- CWE-320
Not analysed yet 14 Dec 2025
CVE-2024-40593 CVE record

CVSS 5.9 Medium

Fortinet FortiAnalyzer: A key management errors vulnerability in Fortinet FortiAnalyzer 7.4.0 through 7.4.2…
- Fortinet FortiAnalyzer
- Fortinet FortiPortal
- CWE-320
Not analysed yet 11 Dec 2025
@nocobase/auth npm

CVSS 6.3 Medium

Authentication Bypass via Default JWT Secret in NocoBase docker-compose Deployments
- Hard-coded credentials
- CWE-320
<1.9.0-beta.18 || >=1.9.0, <1.9.23 || >=2.0.0-alpha.1, <2.0.0-alpha.52 · fixed in 1.9.0-beta.18, 1.9.23, 2.0.0-alpha.52

GHSA-mv7p-34fv-4874 · CVE-2025-13877 Not analysed yet 9 Dec 2025
CVE-2025-13948 CVE record

CVSS 6.3 Medium

opsre go-ldap-admin JWT docker-compose.yaml hard-coded key
- opsre go-ldap-admin
- Hard-coded credentials
- CWE-320
Not analysed yet 3 Dec 2025
CVE-2025-6666 CVE record

CVSS 1.0 Low

motogadget mo.lock Ignition Lock NFC hard-coded key
- motogadget mo.lock Ignition Lock
- Hard-coded credentials
- CWE-320
Not analysed yet 29 Nov 2025
CVE-2025-12615 CVE record

CVSS 2.3 Low

PHPGurukul News Portal settings.py hard-coded key
- PHPGurukul News Portal
- Hard-coded credentials
- CWE-320
Not analysed yet 3 Nov 2025
CVE-2025-11609 CVE record

CVSS 6.3 Medium

code-projects Hospital Management System express-session hard-coded key
- code-projects Hospital Management System
- Hard-coded credentials
- CWE-320
Not analysed yet 11 Oct 2025
CVE-2025-11290 CVE record

CVSS 6.3 Medium

CRMEB JWT HMAC Secret hard-coded key
- CRMEB
- Hard-coded credentials
- CWE-320
Not analysed yet 5 Oct 2025
CVE-2025-10250 CVE record

CVSS 2.3 Low

DJI Mavic Spark/Mavic Air/Mavic Mini Telemetry Channel hard-coded key
- DJI Mavic Spark
- DJI Mavic Air
- Hard-coded credentials
- CWE-320
Not analysed yet 11 Sept 2025
CVE-2025-10080 CVE record

CVSS 2.3 Low

running-elephant Datart API AESUtil.java getTokensecret hard-coded key
- running-elephant Datart
- Hard-coded credentials
- CWE-320
Not analysed yet 8 Sept 2025
CVE-2025-9604 CVE record

CVSS 6.3 Medium

coze-studio aes.go hard-coded key
- coze-studio
- Hard-coded credentials
- CWE-320
Not analysed yet 29 Aug 2025
CVE-2025-8759 CVE record

CVSS 6.3 Medium

TRENDnet TN-200 Lighttpd hard-coded key
- TRENDnet TN-200
- Hard-coded credentials
- CWE-320
Not analysed yet 9 Aug 2025
CVE-2025-6669 CVE record

CVSS 6.3 Medium

gooaclok819 sublinkX jwt.go hard-coded key
- gooaclok819 sublinkX
- Hard-coded credentials
- CWE-320
Not analysed yet 25 Jun 2025
CVE-2025-5164 CVE record

CVSS 6.3 Medium

PerfreeBlog JWT JwtUtil hard-coded key
- PerfreeBlog
- Hard-coded credentials
- CWE-320
Not analysed yet 26 May 2025
CVE-2025-3177 CVE record

CVSS 2.3 Low

FastCMS JWT hard-coded key
- FastCMS
- Hard-coded credentials
- CWE-320
Not analysed yet 3 Apr 2025
CVE-2025-2220 CVE record

CVSS 4.8 Medium

Odyssey CMS reCAPTCHA odyssey_contact_form.php key management
- Odyssey CMS
- CWE-320
Not analysed yet 12 Mar 2025
CVE-2024-10920 CVE record

CVSS 2.3 Low

mariazevedo88 travels-java-api JWT Secret JwtAuthenticationTokenFilter.java doFilterInternal hard-coded key
- mariazevedo88 travels-java-api
- Hard-coded credentials
- CWE-320
Not analysed yet 6 Nov 2024
CVE-2024-36391 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

MileSight DeviceHub - CWE-320: Key Management Errors
- MileSight DeviceHub
- CWE-320
Not analysed yet 2 Jun 2024
CVE-2023-21652 CVE record

CVSS 7.7 High

Key Management Errors in HLOS
- Qualcomm, Inc. Snapdragon
- CWE-320
Not analysed yet 8 Aug 2023
CVE-2023-21626 CVE record

CVSS 7.1 High

Improper Authentication in HLOS.
- Qualcomm, Inc. Snapdragon
- CWE-320
Not analysed yet 8 Aug 2023
CVE-2021-26322 CVE record

Persistent platform private key may not be protected with a random IV leading to a potential “two time pad attack”.
- 1st Gen AMD EPYC™
- 2nd Gen AMD EPYC™
- CWE-320
Not analysed yet 16 Nov 2021
CVE-2020-1688 CVE record

CVSS 6.5 Medium

Junos OS: SRX and NFX Series: Insufficient Web API private key protection
- Juniper Networks Junos OS
- Information disclosure
- Hard-coded credentials
Not analysed yet 16 Oct 2020
CVE-2019-12621 CVE record

CVSS 6.8 Medium

Cisco HyperFlex Static SSL Key Vulnerability
- Cisco HyperFlex HX-Series
- CWE-320
Not analysed yet 21 Aug 2019