# Hard-coded credentials. Passwords and keys built into the code, or weak credentials. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [BridgeHead FileStore < 24A Apache Axis2 Default Credentials RCE](https://agentprime.io/advisories/CVE-2026-39920.md) `CVE-2026-39920` · CVE record: BridgeHead Software FileStore · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Apr 2026 · Tags: Hard-coded credentials, CWE-1188 - [SenseLive X3050 Insufficiently Protected Credentials](https://agentprime.io/advisories/CVE-2026-39462.md) `CVE-2026-39462` · CVE record: SenseLive X3050 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Apr 2026 · Tags: Hard-coded credentials - [SenseLive X3050 Use of Hard-coded Credentials](https://agentprime.io/advisories/CVE-2026-35503.md) `CVE-2026-35503` · CVE record: SenseLive X3050 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Apr 2026 · Tags: Hard-coded credentials - [Tanium addressed an information disclosure vulnerability in Tanium Server.](https://agentprime.io/advisories/CVE-2026-6408.md) `CVE-2026-6408` · CVE record: Tanium Tanium Server · CVSS 2.7 Low · Not analysed yet · Published 22 Apr 2026 · Tags: Hard-coded credentials - [Weak Password Policy Vulnerability in Quantum Networks Router QN-I-470](https://agentprime.io/advisories/CVE-2026-41038.md) `CVE-2026-41038` · CVE record: Quantum Networks Router QN-I-470 · CVSS 7.6 High · Not analysed yet · Published 21 Apr 2026 · Tags: Hard-coded credentials - [liangliangyy DjangoBlog File Upload Endpoint settings.py hard-coded key](https://agentprime.io/advisories/CVE-2026-6611.md) `CVE-2026-6611` · CVE record: liangliangyy DjangoBlog · CVSS 2.3 Low · Not analysed yet · Published 20 Apr 2026 · Tags: Hard-coded credentials, CWE-320 - [liangliangyy DjangoBlog Setting settings.py hard-coded credentials](https://agentprime.io/advisories/CVE-2026-6610.md) `CVE-2026-6610` · CVE record: liangliangyy DjangoBlog · CVSS 6.3 Medium · Not analysed yet · Published 20 Apr 2026 · Tags: Hard-coded credentials - [Hard-coded cryptographic key in silex technology, Inc. SD-330AC and others](https://agentprime.io/advisories/CVE-2026-32958.md) `CVE-2026-32958` · CVE record: silex technology, Inc. SD-330AC and 1 more · CVSS 6.9 Medium · Not analysed yet · Published 20 Apr 2026 · Tags: Hard-coded credentials - [liangliangyy DjangoBlog Amap API Call views.py hard-coded key](https://agentprime.io/advisories/CVE-2026-6580.md) `CVE-2026-6580` · CVE record: liangliangyy DjangoBlog · CVSS 6.9 Medium · Not analysed yet · Published 19 Apr 2026 · Tags: Hard-coded credentials, CWE-320 - [liangliangyy DjangoBlog Setting settings.py hard-coded credentials](https://agentprime.io/advisories/CVE-2026-6578.md) `CVE-2026-6578` · CVE record: liangliangyy DjangoBlog · CVSS 6.3 Medium · Not analysed yet · Published 19 Apr 2026 · Tags: Hard-coded credentials - [osuuu LightPicture API Upload Endpoint lp.sql hard-coded credentials](https://agentprime.io/advisories/CVE-2026-6574.md) `CVE-2026-6574` · CVE record: osuuu LightPicture · CVSS 6.9 Medium · Not analysed yet · Published 19 Apr 2026 · Tags: Hard-coded credentials - [go-git: Credential leak via cross-host redirect in smart HTTP transport](https://agentprime.io/advisories/GHSA-3xc5-wrhm-f963.md) `GHSA-3xc5-wrhm-f963`, `CVE-2026-41506`, `GO-2026-5105` · Go `github.com/go-git/go-git/v5` and 1 more: affected `<5.18.0`, fixed in `5.18.0` · CVSS 4.7 Medium · Not analysed yet · Published 17 Apr 2026 · Tags: Hard-coded credentials - [Anviz CX7 Firmware Use of Hard-coded Cryptographic Key](https://agentprime.io/advisories/CVE-2026-32324.md) `CVE-2026-32324` · CVE record: Anviz Anviz CX7 Firmware · CVSS 7.7 High · Not analysed yet · Published 17 Apr 2026 · Tags: Hard-coded credentials - [Horner Automation Cscape and XL4, XL7 PLC Weak password requirements](https://agentprime.io/advisories/CVE-2026-6284.md) `CVE-2026-6284` · CVE record: Horner Automation Cscape and 2 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Apr 2026 · Tags: Hard-coded credentials - [Sparx Enterprise Architect Client reveals plaintext OAuth2 client secret](https://agentprime.io/advisories/CVE-2025-15622.md) `CVE-2025-15622` · CVE record: Sparx Systems Pty Ltd. Sparx Enterprise Architect · CVSS 6.2 Medium · Not analysed yet · Published 17 Apr 2026 · Tags: Hard-coded credentials - [Insufficiently protected credentials in Dell PowerProtect Data Domain BoostFS](https://agentprime.io/advisories/CVE-2025-36568.md) `CVE-2025-36568` · CVE record: Dell PowerProtect Data Domain BoostFS · CVSS 7.8 High · Not analysed yet · Published 17 Apr 2026 · Tags: Hard-coded credentials - [Weak credentials in Dell PowerProtect Data Domain](https://agentprime.io/advisories/CVE-2026-23853.md) `CVE-2026-23853` · CVE record: Dell PowerProtect Data Domain · CVSS 8.4 High · Not analysed yet · Published 17 Apr 2026 · Tags: Hard-coded credentials - [Flowise: Sensitive Data Leak in public-chatbotConfig](https://agentprime.io/advisories/GHSA-4jpm-cgx2-8h37.md) `GHSA-4jpm-cgx2-8h37`, `CVE-2026-41266` · npm `flowise`: affected `<3.1.0`, fixed in `3.1.0` · CVSS 7.7 High · Not analysed yet · Published 16 Apr 2026 · Tags: Information disclosure, Hard-coded credentials, Broken access control - [Kyverno apiCall automatically forwards ServiceAccount token to external endpoints (credential leak)](https://agentprime.io/advisories/GHSA-8wfp-579w-6r25.md) `GHSA-8wfp-579w-6r25`, `BIT-kyverno-2026-84195`, `CVE-2026-84195`, `GO-2026-5268` · Go `github.com/kyverno/kyverno`: affected `<1.17.0`, fixed in `1.17.0` · CVSS 8.3 High · Not analysed yet · Published 16 Apr 2026 · Tags: Information disclosure, Hard-coded credentials - [Flowise: Weak Default Token Hash Secret](https://agentprime.io/advisories/GHSA-m7mq-85xj-9x33.md) `GHSA-m7mq-85xj-9x33`, `CVE-2026-56269` · npm `flowise`: affected `<3.1.0`, fixed in `3.1.0` · CVSS 4.3 Medium · Not analysed yet · Published 16 Apr 2026 · Tags: Hard-coded credentials - [Flowise: Weak Default Express Session Secret](https://agentprime.io/advisories/GHSA-2qqc-p94c-hxwh.md) `GHSA-2qqc-p94c-hxwh`, `CVE-2026-56278` · npm `flowise`: affected `<3.1.0`, fixed in `3.1.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Apr 2026 · Tags: Hard-coded credentials - [Flowise: Weak Default JWT Secrets](https://agentprime.io/advisories/GHSA-cc4f-hjpj-g9p8.md) `GHSA-cc4f-hjpj-g9p8`, `CVE-2026-56271` · npm `flowise`: affected `<3.1.0`, fixed in `3.1.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Apr 2026 · Tags: Hard-coded credentials, Weak cryptography or TLS - [Dgraph: Unauthenticated /debug/pprof/cmdline discloses admin auth token, enabling unauthorized access to protected Alpha admin endpoints](https://agentprime.io/advisories/GHSA-95mq-xwj4-r47p.md) `GHSA-95mq-xwj4-r47p`, `CVE-2026-40173`, `GO-2026-5274` · Go `github.com/dgraph-io/dgraph` and 2 more: affected `<=1.2.8`, no fixed version yet · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Apr 2026 · Tags: Information disclosure, Hard-coded credentials, CWE-215 - [KnowledgeDeliver deployments before February 24, 2026 use a static ASP.NET/IIS machineKey value](https://agentprime.io/advisories/CVE-2026-5426.md) `CVE-2026-5426` · CVE record: Digital Knowledge KnowledgeDeliver · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Apr 2026 · Tags: Hard-coded credentials, Insecure deserialization - [Sparx Enterprise Architect Client does not verify the receiver of OAuth2 credentials during OpenID authentication](https://agentprime.io/advisories/CVE-2025-15621.md) `CVE-2025-15621` · CVE record: Sparx Systems Pty Ltd. Sparx Enterprise Architect · CVSS 5.7 Medium · Not analysed yet · Published 16 Apr 2026 · Tags: Hard-coded credentials - [Nexus Repository 3 - Hardcoded Credential in Internal Database Component](https://agentprime.io/advisories/CVE-2026-5189.md) `CVE-2026-5189` · CVE record: Sonatype Nexus Repository · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Apr 2026 · Tags: Hard-coded credentials - [Azure Logic Apps Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-32171.md) `CVE-2026-32171` · CVE record: Microsoft Azure Logic Apps · CVSS 8.8 High · Not analysed yet · Published 14 Apr 2026 · Tags: Hard-coded credentials - [Hard-coded cryptographic key in Fortinet FortiClientEMS](https://agentprime.io/advisories/CVE-2026-39810.md) `CVE-2026-39810` · CVE record: Fortinet FortiClientEMS · CVSS 5.2 Medium · Not analysed yet · Published 14 Apr 2026 · Tags: Hard-coded credentials - [Insufficiently protected credentials in Fortinet FortiSandbox and others](https://agentprime.io/advisories/CVE-2026-27316.md) `CVE-2026-27316` · CVE record: Fortinet FortiSandbox and 1 more · CVSS 2.5 Low · Not analysed yet · Published 14 Apr 2026 · Tags: Hard-coded credentials - [Hard-coded credentials in Schneider Electric Easergy MiCOM P14x and others](https://agentprime.io/advisories/CVE-2026-4832.md) `CVE-2026-4832` · CVE record: Schneider Electric Easergy MiCOM P14x and 4 more · CVSS 6.9 Medium · Not analysed yet · Published 14 Apr 2026 · Tags: Hard-coded credentials - [Information Disclosure Vulnerability in SAP HANA Cockpit and HANA Database Explorer](https://agentprime.io/advisories/CVE-2026-34262.md) `CVE-2026-34262` · CVE record: SAP_SE SAP HANA Cockpit and HANA Database Explorer · CVSS 5.0 Medium · Not analysed yet · Published 14 Apr 2026 · Tags: Hard-coded credentials - [An issue was discovered in BMC Control-M/MFT 9.0.20 through 9.0.22.](https://agentprime.io/advisories/CVE-2026-23781.md) `CVE-2026-23781` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Apr 2026 · Tags: Hard-coded credentials - [CTP OS: Configuring password requirements does not work which permits the use of weak passwords](https://agentprime.io/advisories/CVE-2026-33771.md) `CVE-2026-33771` · CVE record: Juniper Networks CTP OS · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Apr 2026 · Tags: Hard-coded credentials - [Apache OpenMeetings Uses Hard-coded Cryptographic Key](https://agentprime.io/advisories/GHSA-wqxq-w68r-wg85.md) `GHSA-wqxq-w68r-wg85`, `CVE-2026-33266` · Maven `org.apache.openmeetings:openmeetings-parent`: affected `>=6.1.0, <9.0.0`, fixed in `9.0.0` · CVSS 7.5 High · Not analysed yet · Published 9 Apr 2026 · Tags: Hard-coded credentials - [Hard-coded password in Siklu EtherHaul 8010](https://agentprime.io/advisories/CVE-2025-57175.md) `CVE-2025-57175` · CVE record: Siklu EtherHaul 8010 · CVSS 6.4 Medium · Not analysed yet · Published 8 Apr 2026 · Tags: Hard-coded credentials - [HAX CMS's public /server-status endpoint exposes authentication tokens, user activity, and client IP addresses](https://agentprime.io/advisories/CVE-2026-35185.md) `CVE-2026-35185` · CVE record: haxtheweb HAXiam · CVSS 8.7 High · Not analysed yet · Published 6 Apr 2026 · Tags: Broken access control, Hard-coded credentials, Information disclosure - [hcengineering Huly Platform JWT Token token.ts hard-coded key](https://agentprime.io/advisories/CVE-2026-5622.md) `CVE-2026-5622` · CVE record: hcengineering Huly Platform · CVSS 6.3 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Hard-coded credentials, CWE-320 - [Tenda AC10 RSA 2048-bit Private Key privkeySrv.pem hard-coded key](https://agentprime.io/advisories/CVE-2026-5549.md) `CVE-2026-5549` · CVE record: Tenda AC10 · CVSS 6.9 Medium · Not analysed yet · Published 5 Apr 2026 · Tags: Hard-coded credentials, CWE-320 - [Tenda 4G03 Pro ECDSA P-256 Private Key server.key hard-coded key](https://agentprime.io/advisories/CVE-2026-5527.md) `CVE-2026-5527` · CVE record: Tenda 4G03 Pro · CVSS 6.9 Medium · Not analysed yet · Published 4 Apr 2026 · Tags: Hard-coded credentials, CWE-320 - [Text to Speech (TTS) by Mementor <= 1.9.8 - Use of Hardcoded Password to Unauthenticated Remote Database Access](https://agentprime.io/advisories/CVE-2026-1233.md) `CVE-2026-1233` · CVE record: mvirik Text to Speech – TTSWP · CVSS 7.5 High · Not analysed yet · Published 4 Apr 2026 · Tags: Hard-coded credentials - [GarrettCom Magnum 6K and 10K Authentication Bypass via Hardcoded String](https://agentprime.io/advisories/CVE-2017-20234.md) `CVE-2017-20234` · CVE record: Belden GarrettCom Magnum 6K and 10K Managed Switches · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Apr 2026 · Tags: Hard-coded credentials - [Hirschmann HiLCOS Hard-coded Credentials SSH SSL Keys](https://agentprime.io/advisories/CVE-2015-10148.md) `CVE-2015-10148` · CVE record: Belden Hirschmann HiLCOS · CVSS 8.8 High · Not analysed yet · Published 3 Apr 2026 · Tags: Hard-coded credentials - [Gardyn Mobile Application and Device Firmware Use Hard-coded Credentials](https://agentprime.io/advisories/CVE-2025-10681.md) `CVE-2025-10681` · CVE record: Gardyn Mobile Application and 1 more · CVSS 8.8 High · Not analysed yet · Published 3 Apr 2026 · Tags: Hard-coded credentials - [Investory Toy Planet Trouble App app.investory.toyfactory google-services-desktop.json hard-coded key](https://agentprime.io/advisories/CVE-2026-5471.md) `CVE-2026-5471` · CVE record: Investory Toy Planet Trouble App · CVSS 4.8 Medium · Not analysed yet · Published 3 Apr 2026 · Tags: Hard-coded credentials, CWE-320 - [Wahoo Fitness SYSTM App com.WahooFitness.SYSTM BuildConfig.java hard-coded key](https://agentprime.io/advisories/CVE-2026-5462.md) `CVE-2026-5462` · CVE record: Wahoo Fitness SYSTM App · CVSS 4.8 Medium · Not analysed yet · Published 3 Apr 2026 · Tags: Hard-coded credentials, CWE-320 - [Noelse Individuals & Pro App com.afone.noelse BuildConfig.java hard-coded key](https://agentprime.io/advisories/CVE-2026-5458.md) `CVE-2026-5458` · CVE record: Noelse Individuals & Pro App · CVSS 4.8 Medium · Not analysed yet · Published 3 Apr 2026 · Tags: Hard-coded credentials, CWE-320 - [PropertyGuru AgentNet Singapore App com.allproperty.android.agentnet BuildConfig.java hard-coded key](https://agentprime.io/advisories/CVE-2026-5457.md) `CVE-2026-5457` · CVE record: PropertyGuru AgentNet Singapore App · CVSS 4.8 Medium · Not analysed yet · Published 3 Apr 2026 · Tags: Hard-coded credentials, CWE-320 - [Align Technology My Invisalign App com.aligntech.myinvisalign.emea BuildConfig.java hard-coded key](https://agentprime.io/advisories/CVE-2026-5456.md) `CVE-2026-5456` · CVE record: Align Technology My Invisalign App · CVSS 4.8 Medium · Not analysed yet · Published 3 Apr 2026 · Tags: Hard-coded credentials, CWE-320 - [Dialogue App ca.diagram.dialogue config.json hard-coded key](https://agentprime.io/advisories/CVE-2026-5455.md) `CVE-2026-5455` · CVE record: Dialogue App · CVSS 4.8 Medium · Not analysed yet · Published 3 Apr 2026 · Tags: Hard-coded credentials, CWE-320 - [GRID Organiser App co.gridapp.organiser app.json hard-coded key](https://agentprime.io/advisories/CVE-2026-5454.md) `CVE-2026-5454` · CVE record: GRID Organiser App · CVSS 4.8 Medium · Not analysed yet · Published 3 Apr 2026 · Tags: Hard-coded credentials, CWE-320 - [Rico só vantagem pra investir App br.com.rico.mobile SegmentSettingsModule.java hard-coded key](https://agentprime.io/advisories/CVE-2026-5453.md) `CVE-2026-5453` · CVE record: Rico só vantagem pra investir App · CVSS 4.8 Medium · Not analysed yet · Published 3 Apr 2026 · Tags: Hard-coded credentials, CWE-320 - [OpenClaw: Media download follows cross-origin redirects with Authorization headers intact](https://agentprime.io/advisories/GHSA-68v4-hmwv-f43h.md) `GHSA-68v4-hmwv-f43h`, `CVE-2026-41345` · npm `openclaw`: affected `<2026.3.31`, fixed in `2026.3.31` · CVSS 6.0 Medium · Not analysed yet · Published 3 Apr 2026 · Tags: Hard-coded credentials - [UCC CampusConnect App campusconnect.ucc BuildConfig.java hard-coded key](https://agentprime.io/advisories/CVE-2026-5452.md) `CVE-2026-5452` · CVE record: UCC CampusConnect App · CVSS 4.8 Medium · Not analysed yet · Published 3 Apr 2026 · Tags: Hard-coded credentials, CWE-320 - [Private Key stored as extractable in browser IndexeDB](https://agentprime.io/advisories/CVE-2026-35467.md) `CVE-2026-35467` · CVE record: CERT/CC cveClient/encrypt-storage.js · CVSS 7.5 High · Not analysed yet · Published 2 Apr 2026 · Tags: Hard-coded credentials - [Shinrays Games Goods Triple App cats.goods.sort.sorting.games jRwTX.java hard-coded key](https://agentprime.io/advisories/CVE-2026-5420.md) `CVE-2026-5420` · CVE record: Shinrays Games Goods Triple App · CVSS 2.0 Low · Not analysed yet · Published 2 Apr 2026 · Tags: Hard-coded credentials, CWE-320 - [Enter Software Iperius Backup IperiusAccounts.ini hard-coded key](https://agentprime.io/advisories/CVE-2026-5310.md) `CVE-2026-5310` · CVE record: Enter Software Iperius Backup · CVSS 2.0 Low · Not analysed yet · Published 1 Apr 2026 · Tags: Hard-coded credentials, CWE-320 - [Credential Exposure vulnerability in MEPIS RM](https://agentprime.io/advisories/CVE-2026-25601.md) `CVE-2026-25601` · CVE record: Metronik d.o.o. MEPIS RM · CVSS 6.4 Medium · Not analysed yet · Published 1 Apr 2026 · Tags: Hard-coded credentials - [Nautobot: Management of users via REST API does not apply configured password validators](https://agentprime.io/advisories/GHSA-xmpv-j7p2-j873.md) `GHSA-xmpv-j7p2-j873`, `CVE-2026-34203`, `PYSEC-2026-2224` · PyPI `nautobot`: affected `<2.4.30 || >=3.0.0, <3.0.10`, fixed in `2.4.30`, `3.0.10` · CVSS 2.7 Low · Not analysed yet · Published 31 Mar 2026 · Tags: Hard-coded credentials - [Search Guard audit logs can contain under certain conditions user credentials](https://agentprime.io/advisories/CVE-2026-4819.md) `CVE-2026-4819` · CVE record: floragunn Search Guard FLX · CVSS 4.9 Medium · Not analysed yet · Published 31 Mar 2026 · Tags: Hard-coded credentials, Information disclosure - [FHIR Validator HTTP service has SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token Theft](https://agentprime.io/advisories/GHSA-vr79-8m62-wh98.md) `GHSA-vr79-8m62-wh98`, `CVE-2026-34361` · Maven `ca.uhn.hapi.fhir:org.hl7.fhir.validation`: affected `<6.9.4`, fixed in `6.9.4` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Mar 2026 · Tags: Hard-coded credentials, Information disclosure Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .