# Hard-coded credentials.

Passwords and keys built into the code, or weak credentials. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [PROG MIS｜ERP App - Use of Hard-coded Credentials](https://agentprime.io/advisories/CVE-2026-14807.md)
  `CVE-2026-14807` · CVE record: PROG MIS ERP App · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Jul 2026 · Tags: Hard-coded credentials
- [stale proxy password leak](https://agentprime.io/advisories/CVE-2026-9079.md)
  `CVE-2026-9079` · CVE record: curl curl · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Jul 2026 · Tags: Hard-coded credentials
- [password leak with netrc and user in URL](https://agentprime.io/advisories/CVE-2026-8926.md)
  `CVE-2026-8926` · CVE record: curl curl · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Jul 2026 · Tags: Hard-coded credentials
- [Gardyn IoT Hub Use of Hard-coded Credentials](https://agentprime.io/advisories/CVE-2026-13768.md)
  `CVE-2026-13768` · CVE record: Gardyn Gardyn Home Firmware and 2 more · CVSS 9.5 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Jul 2026 · Tags: Hard-coded credentials
- [WatchGuard Firebox Hardcoded Fallback Encryption Key in Access Portal Resource Credential Database](https://agentprime.io/advisories/CVE-2026-13728.md)
  `CVE-2026-13728` · CVE record: WatchGuard Fireware OS · CVSS 5.9 Medium · Not analysed yet · Published 2 Jul 2026 · Tags: Hard-coded credentials
- [9router's Hardcoded Default fallback JWT Secret Allows Authentication Bypass](https://agentprime.io/advisories/GHSA-jphh-m39h-6gwx.md)
  `GHSA-jphh-m39h-6gwx`, `CVE-2026-49352` · npm `9router`: affected `>=0.2.21, <0.4.45`, fixed in `0.4.45` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Jul 2026 · Tags: Hard-coded credentials
- [LaunchServer FileServerHandler has an unauthenticated path traversal issue](https://agentprime.io/advisories/GHSA-5g75-477j-2c2f.md)
  `GHSA-5g75-477j-2c2f`, `CVE-2026-54617` · Maven `pro.gravit.launcher:launchserver-api`: affected `<=5.7.11`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Jul 2026 · Tags: Path traversal, Information disclosure, Hard-coded credentials
- [joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363)](https://agentprime.io/advisories/GHSA-gg9x-qcx2-xmrh.md)
  `GHSA-gg9x-qcx2-xmrh`, `CVE-2026-49852`, `PYSEC-2026-2528` · PyPI `joserfc`: affected `<1.6.8`, fixed in `1.6.8` · CVSS 8.7 High · Not analysed yet · Published 2 Jul 2026 · Tags: Authentication bypass, Weak cryptography or TLS, Hard-coded credentials
- [Kerberos Hub private key (X-Kerberos-Hub-PrivateKey) leaked to cross-host redirect target due to redirect-following HTTP client without CheckRedirect](https://agentprime.io/advisories/GHSA-h5gx-45rj-2h5j.md)
  `GHSA-h5gx-45rj-2h5j`, `CVE-2026-50192`, `GO-2026-5890` · Go `github.com/kerberos-io/agent/machinery`: affected `<0.0.0-20260528173546-51f1a52e170f`, fixed in `0.0.0-20260528173546-51f1a52e170f` · CVSS 6.9 Medium · Not analysed yet · Published 2 Jul 2026 · Tags: Information disclosure, Hard-coded credentials
- [OpenClaw: message.action forwarding could send Gateway credentials to model-supplied loopback URLs](https://agentprime.io/advisories/GHSA-grc3-2j34-p6gm.md)
  `GHSA-grc3-2j34-p6gm`, `CVE-2026-53827` · npm `openclaw`: affected `<2026.5.2`, fixed in `2026.5.2` · CVSS 6.0 Medium · Not analysed yet · Published 2 Jul 2026 · Tags: Hard-coded credentials, Server-side request forgery (SSRF)
- [OpenClaw MCP SSE redirects could forward Authorization headers](https://agentprime.io/advisories/GHSA-9c3v-684m-579c.md)
  `GHSA-9c3v-684m-579c`, `CVE-2026-62208` · npm `openclaw`: affected `<2026.6.5`, fixed in `2026.6.5` · CVSS 6.0 Medium · Not analysed yet · Published 1 Jul 2026 · Tags: Information disclosure, Hard-coded credentials, Open redirect
- [ORAS Go forwards registry credentials across registry redirects](https://agentprime.io/advisories/GHSA-vh4v-2xq2-g5cg.md)
  `GHSA-vh4v-2xq2-g5cg`, `GO-2026-5884` · Go `oras.land/oras-go/v2`: affected `<2.6.1`, fixed in `2.6.1` · CVSS 4.0, no score published · Not analysed yet · Published 1 Jul 2026 · Tags: Information disclosure, Hard-coded credentials
- [Fleet has PSS Bypass through addLabelsFromOptions in Fleet Agent](https://agentprime.io/advisories/GHSA-864g-863m-vcvq.md)
  `GHSA-864g-863m-vcvq`, `CVE-2026-44938`, `GO-2026-5871` · Go `github.com/rancher/fleet`: affected `>=0.12.0, <0.12.15 || >=0.13.0, <0.13.11 || >=0.14.0, <0.14.6 || >=0.15.0, <0.15.2`, fixed in `0.12.15`, `0.13.11`, `0.14.6`, `0.15.2` · CVSS 8.8 High · Not analysed yet · Published 1 Jul 2026 · Tags: Hard-coded credentials
- [UltraVNC repeater ships hardcoded default admin password allowing unauthenticated admin access](https://agentprime.io/advisories/CVE-2026-7839.md)
  `CVE-2026-7839` · CVE record: uvnc UltraVNC · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Jul 2026 · Tags: Hard-coded credentials
- [Use of Hard-coded Credentials in StoneFly Storage Concentrator](https://agentprime.io/advisories/CVE-2026-50110.md)
  `CVE-2026-50110` · CVE record: StoneFly Storage Concentrator and 1 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Jun 2026 · Tags: Hard-coded credentials
- [Insufficiently protected credentials in Google Chrome](https://agentprime.io/advisories/CVE-2026-14019.md)
  `CVE-2026-14019` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: Hard-coded credentials
- [Weak Password Requirements in KTM System e-BOK](https://agentprime.io/advisories/CVE-2026-35097.md)
  `CVE-2026-35097` · CVE record: KTM System e-BOK · CVSS 6.9 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: Hard-coded credentials
- [Parseable < 2.9.2 - Cleartext Credential Exposure in Notification Target API](https://agentprime.io/advisories/CVE-2026-56783.md)
  `CVE-2026-56783` · CVE record: parseablehq parseable · CVSS 7.1 High · Not analysed yet · Published 29 Jun 2026 · Tags: Hard-coded credentials
- [praisonai-platform: JWT signing key defaults to hardcoded "dev-secret-change-me", allowing token forgery for any user when PLATFORM_ENV is unset](https://agentprime.io/advisories/GHSA-3qg8-5g3r-79v5.md)
  `GHSA-3qg8-5g3r-79v5`, `CVE-2026-47410`, `PYSEC-2026-479` · PyPI `praisonai-platform`: affected `<0.1.4`, fixed in `0.1.4` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jun 2026 · Tags: Hard-coded credentials
- [Information exposure vulnerability in Hitachi Storage Navigator](https://agentprime.io/advisories/CVE-2025-7386.md)
  `CVE-2025-7386` · CVE record: Hitachi Hitachi Virtual Storage Platform 5100, 5200, 5500, 5600, 5100H, 5200H, 5500H, 5600H, VX8 and 1 more · CVSS 6.8 Medium · Not analysed yet · Published 29 Jun 2026 · Tags: Hard-coded credentials
- [pnpm: Repository config can expand victim environment secrets into registry requests before scripts run](https://agentprime.io/advisories/GHSA-3qhv-2rgh-x77r.md)
  `GHSA-3qhv-2rgh-x77r`, `CVE-2026-55180` · npm `pnpm`: affected `<10.34.2 || >=11.0.0, <11.5.3`, fixed in `10.34.2`, `11.5.3` · CVSS 6.5 Medium · Not analysed yet · Published 26 Jun 2026 · Tags: Information disclosure, Hard-coded credentials
- [pnpm binds unscoped user-level npm auth credentials to a repository-selected registry](https://agentprime.io/advisories/GHSA-cjhr-43r9-cfmw.md)
  `GHSA-cjhr-43r9-cfmw`, `CVE-2026-50017` · npm `pnpm`: affected `<10.34.0 || >=11.0.0, <11.4.0`, fixed in `10.34.0`, `11.4.0` · CVSS 6.9 Medium · Not analysed yet · Published 26 Jun 2026 · Tags: Information disclosure, Hard-coded credentials
- [Daktronics Controller Firmware Use of Hard-coded Credentials](https://agentprime.io/advisories/CVE-2026-31928.md)
  `CVE-2026-31928` · CVE record: Daktronics VFC-DMP-5000 and 2 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Jun 2026 · Tags: Hard-coded credentials
- [regclient may leak authentication credentials to external blob stores](https://agentprime.io/advisories/GHSA-qvqc-4c52-x6qp.md)
  `GHSA-qvqc-4c52-x6qp`, `CVE-2026-49349`, `GO-2026-5822` · Go `github.com/regclient/regclient`: affected `<0.11.5`, fixed in `0.11.5` · CVSS 6.8 Medium · Not analysed yet · Published 26 Jun 2026 · Tags: Hard-coded credentials
- [RustFS: ListRemoteTargetHandler authorization bypass leaks replication target credentials](https://agentprime.io/advisories/CVE-2026-55188.md)
  `CVE-2026-55188` · CVE record: rustfs rustfs · CVSS 8.2 High · Not analysed yet · Published 26 Jun 2026 · Tags: Information disclosure, Hard-coded credentials, Broken access control
- [OpenProject: Pre-authentication RCE in openproject/openproject Docker image via default \`SECRET_KEY_BASE=OVERWRITE_ME\` and \`cookies_serializer = :marshal\`](https://agentprime.io/advisories/CVE-2026-46386.md)
  `CVE-2026-46386` · CVE record: opf openproject · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Jun 2026 · Tags: Insecure deserialization, Hard-coded credentials, CWE-1188, CWE-1392
- [OpenAM Account Takeover via Unverified Password Change in OAuth2 Module](https://agentprime.io/advisories/GHSA-gf57-4mp6-m85x.md)
  `GHSA-gf57-4mp6-m85x`, `CVE-2026-46623` · Maven `org.openidentityplatform.openam:openam-auth-oauth2`: affected `<16.1.1`, fixed in `16.1.1` · CVSS 7.4 High · Not analysed yet · Published 26 Jun 2026 · Tags: Hard-coded credentials, CWE-620
- [Dokku: Git Credentials in .netrc Stored World-Readable Due to Premature touch](https://agentprime.io/advisories/CVE-2026-45407.md)
  `CVE-2026-45407` · CVE record: dokku dokku · CVSS 5.0 Medium · Not analysed yet · Published 26 Jun 2026 · Tags: Hard-coded credentials
- [WordPress Enable CORS plugin <= 2.0.3 - Backdoor vulnerability](https://agentprime.io/advisories/CVE-2026-54833.md)
  `CVE-2026-54833` · CVE record: Dev Kabir Enable CORS · CVSS 7.4 High · Not analysed yet · Published 26 Jun 2026 · Tags: Hard-coded credentials
- [Weak credentials in Reolink Home Hub](https://agentprime.io/advisories/CVE-2026-57473.md)
  `CVE-2026-57473` · CVE record: Reolink Home Hub · CVSS 5.8 Medium · Not analysed yet · Published 26 Jun 2026 · Tags: Hard-coded credentials
- [Lansweeper lsrunase 2.0 and lsencrypt 2.0 use RC4 encryption with a hardcoded 142-byte static key array to encrypt credentials.](https://agentprime.io/advisories/CVE-2026-39031.md)
  `CVE-2026-39031` · CVE record · CVSS 5.5 Medium · Not analysed yet · Published 26 Jun 2026 · Tags: Hard-coded credentials
- [Setracker2 Children's Smartwatch Ecosystem Use of hard-coded cryptographic key](https://agentprime.io/advisories/CVE-2026-9220.md)
  `CVE-2026-9220` · CVE record: Shenzhen i365-Tech Co. Ltd. Setracker2 Parental Control App (Android) package com.tgelec.setracker · CVSS 8.7 High · Not analysed yet · Published 25 Jun 2026 · Tags: Hard-coded credentials
- [EVoke Systems EVoke CSMS Insufficiently Protected Credentials](https://agentprime.io/advisories/CVE-2026-44622.md)
  `CVE-2026-44622` · CVE record: EVoke EVoke CSMS · CVSS 6.9 Medium · Not analysed yet · Published 25 Jun 2026 · Tags: Hard-coded credentials
- [Insufficiently protected credentials in Schneider Electric EasyLogic T150 (formerly Saitel DR) Remote Terminal Unit &… and others](https://agentprime.io/advisories/CVE-2026-9650.md)
  `CVE-2026-9650` · CVE record: Schneider Electric EasyLogic T150 (formerly Saitel DR) Remote Terminal Unit & Controller and 1 more · CVSS 8.7 High · Not analysed yet · Published 25 Jun 2026 · Tags: Hard-coded credentials
- [NetComm NF20MESH < R6B032 Hardcoded AES Key Authentication Bypass](https://agentprime.io/advisories/CVE-2026-35019.md)
  `CVE-2026-35019` · CVE record: NetComm Wireless Pty Ltd NF20MESH · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Jun 2026 · Tags: Hard-coded credentials
- [motionEye's World-Readable Configuration File Exposes Admin Password Hash](https://agentprime.io/advisories/GHSA-rhgp-6wq6-9j67.md)
  `GHSA-rhgp-6wq6-9j67`, `CVE-2026-32315`, `PYSEC-2026-2666` · PyPI `motioneye`: affected `<0.44.0`, fixed in `0.44.0` · CVSS 5.5 Medium · Not analysed yet · Published 22 Jun 2026 · Tags: Information disclosure, Hard-coded credentials, Broken access control
- [Hardcoded credential in the IBM Storage Protect Snapshot For Windows leads to unauthorized access to system](https://agentprime.io/advisories/CVE-2026-12628.md)
  `CVE-2026-12628` · CVE record: IBM Storage Protect Client and 1 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Jun 2026 · Tags: Hard-coded credentials
- [Hard-coded credentials in bitnami/cassandra](https://agentprime.io/advisories/CVE-2026-47846.md)
  `CVE-2026-47846` · CVE record: Bitnami bitnami/cassandra · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Jun 2026 · Tags: Hard-coded credentials
- [Hard-coded credentials in bitnami/mariadb-galera and others](https://agentprime.io/advisories/CVE-2026-47847.md)
  `CVE-2026-47847` · CVE record: Bitnami bitnami/mariadb-galera and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 18 Jun 2026 · Tags: Hard-coded credentials
- [Grav: Admin Backup Zip File Exposes Account Credentials and Configuration Secrets](https://agentprime.io/advisories/GHSA-2f86-9cp8-6hcf.md)
  `GHSA-2f86-9cp8-6hcf`, `CVE-2026-55885`, `PKSA-wg3b-cs1z-bny5` · Packagist `getgrav/grav`: affected `<1.7.53`, fixed in `1.7.53` · CVSS 6.8 Medium · Not analysed yet · Published 18 Jun 2026 · Tags: Information disclosure, Hard-coded credentials
- [praisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgery](https://agentprime.io/advisories/GHSA-cwj8-7gp2-ggcw.md)
  `GHSA-cwj8-7gp2-ggcw`, `CVE-2026-57147`, `PYSEC-2026-3524` · PyPI `praisonai-platform`: affected `<0.1.6`, fixed in `0.1.6` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Jun 2026 · Tags: Hard-coded credentials, CWE-1188
- [praisonai-platform 0.1.4 still boots on the hardcoded JWT secret dev-secret-change-me (default-open production guard)](https://agentprime.io/advisories/GHSA-f38v-77qj-h4jq.md)
  `GHSA-f38v-77qj-h4jq`, `CVE-2026-57148`, `PYSEC-2026-3525` · PyPI `praisonai-platform`: affected `<0.1.6`, fixed in `0.1.6` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Jun 2026 · Tags: Authentication bypass, Hard-coded credentials, CWE-1188
- [Hardcoded cloud credentials in Worksnaps client application binaries expose production cloud resources](https://agentprime.io/advisories/CVE-2025-10560.md)
  `CVE-2025-10560` · CVE record: Silver Leaf Technologies, Inc. Worksnaps.net Worksnaps · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Jun 2026 · Tags: Hard-coded credentials
- [OpenClaw: MCP Streamable HTTP redirects could forward configured custom headers to another origin](https://agentprime.io/advisories/GHSA-rjxq-qqhf-8hwh.md)
  `GHSA-rjxq-qqhf-8hwh`, `CVE-2026-53840` · npm `openclaw`: affected `<2026.5.12`, fixed in `2026.5.12` · CVSS 6.0 Medium · Not analysed yet · Published 17 Jun 2026 · Tags: Information disclosure, Hard-coded credentials
- [Information Disclosure, Information Tampering, or Denial-of-Service (DoS) Vulnerability in Multiple Home Appliances](https://agentprime.io/advisories/CVE-2026-5667.md)
  `CVE-2026-5667` · CVE record: Mitsubishi Electric Corporation Room Air Conditioners (for Japan) MSZ-BKR2223-W and 4 more · CVSS 7.2 High · Not analysed yet · Published 17 Jun 2026 · Tags: Hard-coded credentials
- [Duplicate Advisory: MCP Streamable HTTP redirects could forward configured custom headers to another origin](https://agentprime.io/advisories/GHSA-x7cf-6gp3-q5f8.md)
  `GHSA-x7cf-6gp3-q5f8` · PyPI `openclaw`: affected `*`, no fixed version yet · CVSS 7.1 High · Withdrawn · Not analysed yet · Published 16 Jun 2026 · Tags: Hard-coded credentials
- [Crawl4AI: LLM credential exfiltration in Docker server via request base_url and env: token resolution](https://agentprime.io/advisories/GHSA-f989-c77f-r2cq.md)
  `GHSA-f989-c77f-r2cq`, `CVE-2026-56259`, `PYSEC-2026-3448` · PyPI `crawl4ai`: affected `<0.8.8`, fixed in `0.8.8` · CVSS 8.8 High · Not analysed yet · Published 16 Jun 2026 · Tags: Information disclosure, Hard-coded credentials, Server-side request forgery (SSRF)
- [Crawl4AI: Multiple Docker API Vulnerabilities - File Write, SSRF, Auth Bypass, XSS, JS Execution](https://agentprime.io/advisories/GHSA-365w-hqf6-vxfg.md)
  `GHSA-365w-hqf6-vxfg`, `CVE-2026-56260`, `CVE-2026-56261`, `CVE-2026-56262`, `CVE-2026-56263`, `CVE-2026-56264`, `CVE-2026-56265`, `CVE-2026-56266`, `GHSA-53rg-46cm-4g2v`, `GHSA-8qrg-7j2f-rf2h`, `GHSA-f23g-2f38-gg94`, `GHSA-g2pv-76hm-j4x9`, `GHSA-r9hw-78q5-478g`, `GHSA-xrfj-6m49-wfmm`, `PYSEC-2026-229`, `PYSEC-2026-230`, `PYSEC-2026-239`, `PYSEC-2026-3443`, `PYSEC-2026-3449`, `PYSEC-2026-596`, `PYSEC-2026-798` · PyPI `crawl4ai`: affected `<0.8.7`, fixed in `0.8.7` · CVSS 8.8 High · Not analysed yet · Published 16 Jun 2026 · Tags: Path traversal, Cross-site scripting (XSS), Code injection, Authentication bypass
- [Use of Hard-coded Credentials Vulnerability in Radiflow iSAP Smart Collector](https://agentprime.io/advisories/CVE-2026-22312.md)
  `CVE-2026-22312` · CVE record: Radiflow iSAP Smart Collector · CVSS 8.6 High · Not analysed yet · Published 16 Jun 2026 · Tags: Hard-coded credentials
- [Hard-coded cryptographic key in Canon Inc. EOS Network Setting Tool for Windows and others](https://agentprime.io/advisories/CVE-2026-9260.md)
  `CVE-2026-9260` · CVE record: Canon Inc. EOS Network Setting Tool for Windows and 1 more · CVSS 6.9 Medium · Not analysed yet · Published 15 Jun 2026 · Tags: Hard-coded credentials
- [aiohttp: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges](https://agentprime.io/advisories/GHSA-hpj7-wq8m-9hgp.md)
  `GHSA-hpj7-wq8m-9hgp`, `CVE-2026-54276`, `PYSEC-2026-2109` · PyPI `aiohttp`: affected `<3.14.1`, fixed in `3.14.1` · CVSS 6.3 Medium · Not analysed yet · Published 15 Jun 2026 · Tags: Information disclosure, Hard-coded credentials
- [launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows](https://agentprime.io/advisories/GHSA-v6wh-96g9-6wx3.md)
  `GHSA-v6wh-96g9-6wx3`, `CVE-2026-53632` · npm `launch-editor` and 2 more: affected `<2.14.1`, fixed in `2.14.1` · CVSS 5.5 Medium · Not analysed yet · Published 15 Jun 2026 · Tags: Path traversal, Hard-coded credentials
- [Mattermost Desktop App fails to restrict the allow list of domains which NTLM credentials are passed](https://agentprime.io/advisories/CVE-2026-6517.md)
  `CVE-2026-6517` · CVE record: Mattermost Mattermost · CVSS 6.3 Medium · Not analysed yet · Published 15 Jun 2026 · Tags: Hard-coded credentials
- [Hard-coded cryptographic key in Wertheim SafeController Software allows decryption of sensitive configuration data](https://agentprime.io/advisories/CVE-2026-34029.md)
  `CVE-2026-34029` · CVE record: Wertheim GmbH Wertheim SafeController Software for VAULT ROOMS (Safe Deposit Locker System) · CVSS 6.8 Medium · Not analysed yet · Published 15 Jun 2026 · Tags: Hard-coded credentials
- [Weak custom cryptography and hard-coded keys in Wertheim SafeController 65000 allow traffic decryption](https://agentprime.io/advisories/CVE-2026-34022.md)
  `CVE-2026-34022` · CVE record: Wertheim GmbH Wertheim SafeController Family 65000 Hardware for VAULT ROOMS (Safe Deposit Locker System - Microcontroller) · CVSS 7.1 High · Not analysed yet · Published 15 Jun 2026 · Tags: Hard-coded credentials
- [Naxclow IoT Platform Use of hard-coded cryptographic key](https://agentprime.io/advisories/CVE-2026-28742.md)
  `CVE-2026-28742` · CVE record: Naxclow Smart Doorbell X3 and 3 more · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Jun 2026 · Tags: Hard-coded credentials
- [Aqara Home Android SDK hardcoded keys](https://agentprime.io/advisories/CVE-2026-50091.md)
  `CVE-2026-50091` · CVE record: Aqara com.lumiunited.aqarahome · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Jun 2026 · Tags: Hard-coded credentials
- [Aqara hardcoded OAuth client credentials](https://agentprime.io/advisories/CVE-2026-50083.md)
  `CVE-2026-50083` · CVE record: Aqara Aquara IAM/SSO Gateway · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Jun 2026 · Tags: Hard-coded credentials
- [Yarbo Android/iOS Mobile Application and Cloud Infrastructure Use of Hard-coded Credentials](https://agentprime.io/advisories/CVE-2026-10557.md)
  `CVE-2026-10557` · CVE record: Yarbo Yarbo Android/IOS mobile application and 1 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Jun 2026 · Tags: Hard-coded credentials
- [IEI Integration Corp｜iRM-IEI Remote Management - Hard-coded Credentials](https://agentprime.io/advisories/CVE-2026-11849.md)
  `CVE-2026-11849` · CVE record: IEI Integration Corp iRM-TSi410X · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Jun 2026 · Tags: Hard-coded credentials

Newest: <https://agentprime.io/advisories/tag/hard-coded-credentials.md>
Older: <https://agentprime.io/advisories/tag/hard-coded-credentials.md?cursor=WyIyMDI2LTA2LTEyVDA5OjQ3OjU5LjAwODAwMFoiLCJDVkUtMjAyNi0xMTg0OSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=hard-coded-credentials&cursor=WyIyMDI2LTA3LTA2VDA4OjEyOjQ5LjU3MTAwMFoiLCJDVkUtMjAyNi0xNDMzIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/hard-coded-credentials/?cursor=WyIyMDI2LTA3LTA2VDA4OjEyOjQ5LjU3MTAwMFoiLCJDVkUtMjAyNi0xNDMzIl0>. Everything for agents: <https://agentprime.io/llms.txt>.