# Hard-coded credentials.

Passwords and keys built into the code, or weak credentials. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Credential Manager Vulnerability Allows Unauthorized Administrative Access](https://agentprime.io/advisories/CVE-2026-73778.md)
  `CVE-2026-73778` · CVE record: Hewlett Packard Enterprise (HPE) AOS-CX · CVSS 8.1 High · Not analysed yet · Published 1 Sept 2026 · Tags: Hard-coded credentials
- [pnpm: Environment secrets exfiltrated via env-placeholder expansion in proxy settings read from an untrusted pnpm-workspace.yaml](https://agentprime.io/advisories/GHSA-vx52-2968-3vc6.md)
  `GHSA-vx52-2968-3vc6`, `CVE-2026-101043` · npm `pnpm`: affected `>=10.7.0, <10.34.5 || >=11.0.0, <11.11.0`, fixed in `10.34.5`, `11.11.0` · CVSS 8.3 High · Not analysed yet · Published 1 Sept 2026 · Tags: Information disclosure, Weak cryptography or TLS, Hard-coded credentials
- [DataEdgePlatform DataMosaix™ Private Cloud](https://agentprime.io/advisories/CVE-2024-7952.md)
  `CVE-2024-7952` · CVE record: Rockwell Automation DataEdgePlatform DataMosaix™ Private Cloud · CVSS 8.7 High · Not analysed yet · Published 1 Sept 2026 · Tags: Hard-coded credentials
- [MySQL2: Auth Plugin Downgrade to mysql_clear_password Leaks Plaintext Credentials](https://agentprime.io/advisories/GHSA-3f6p-5ww8-9rcr.md)
  `GHSA-3f6p-5ww8-9rcr` · npm `mysql2`: affected `<3.22.0`, fixed in `3.22.0` · CVSS 4.0, no score published · Not analysed yet · Published 1 Sept 2026 · Tags: Hard-coded credentials
- [Hardcoded Credentials in TMT Machine's Talassoft Industrial Management Software](https://agentprime.io/advisories/CVE-2026-18931.md)
  `CVE-2026-18931` · CVE record: TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Hard-coded credentials
- [Inbox Foundry ActiveInbox Extension Google OAuth Client Secret service-worker.production-esm.js hard-coded credentials](https://agentprime.io/advisories/CVE-2026-82808.md)
  `CVE-2026-82808` · CVE record: Inbox Foundry ActiveInbox Extension · CVSS 6.9 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Hard-coded credentials
- [Insecure hardcoded credentials in the Admin account of Tenda HG21 V4.0.0-260302 allows attackers to gain root access.](https://agentprime.io/advisories/CVE-2026-38577.md)
  `CVE-2026-38577` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Aug 2026 · Tags: Hard-coded credentials
- [Shinobi before commit 5a76c74f Arbitrary Database Query Execution via Hardcoded Child Node Key](https://agentprime.io/advisories/CVE-2026-82448.md)
  `CVE-2026-82448` · CVE record: Shinobi Systems Shinobi · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Aug 2026 · Tags: Hard-coded credentials
- [org.mariadb:r2dbc-mariadb vulnerable to cleartext password disclosure to a man-in-the-middle server (clear-text auth plugins not gated on a secure transport)](https://agentprime.io/advisories/GHSA-c857-9x2m-cvh2.md)
  `GHSA-c857-9x2m-cvh2`, `CVE-2026-55860` · Maven `org.mariadb:r2dbc-mariadb`: affected `<1.4.1`, fixed in `1.4.1` · CVSS 5.9 Medium · Not analysed yet · Published 28 Aug 2026 · Tags: Weak cryptography or TLS, Hard-coded credentials
- [org.mariadb.jdbc:mariadb-java-client has Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials](https://agentprime.io/advisories/GHSA-qxvw-fvwx-5cp7.md)
  `GHSA-qxvw-fvwx-5cp7`, `CVE-2026-55857` · Maven `org.mariadb.jdbc:mariadb-java-client`: affected `<2.7.14 || >=3.0.0, <3.3.5 || >=3.4.0, <3.4.3 || >=3.5.0, <3.5.9`, fixed in `2.7.14`, `3.3.5`, `3.4.3`, `3.5.9` · CVSS 5.9 Medium · Not analysed yet · Published 28 Aug 2026 · Tags: Weak cryptography or TLS, Hard-coded credentials
- [MariaDB has cleartext password disclosure to a MITM on the initial-handshake](https://agentprime.io/advisories/GHSA-g9jj-cgmh-9f38.md)
  `GHSA-g9jj-cgmh-9f38`, `CVE-2026-55856` · Maven `org.mariadb.jdbc:mariadb-java-client`: affected `<2.7.14 || >=3.0.0, <3.3.5 || >=3.4.0, <3.4.3 || >=3.5.0, <3.5.9`, fixed in `2.7.14`, `3.3.5`, `3.4.3`, `3.5.9` · CVSS 5.9 Medium · Not analysed yet · Published 28 Aug 2026 · Tags: Hard-coded credentials
- [MariaDB has Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials](https://agentprime.io/advisories/GHSA-42r5-vhpq-m858.md)
  `GHSA-42r5-vhpq-m858`, `BIT-mariadb-2026-55854`, `BIT-mariadb-min-2026-55854`, `BIT-mysql-client-2026-55854`, `CVE-2026-55854` · npm `mariadb`: affected `<3.2.4 || >=3.3.0, <3.3.3 || >=3.4.0, <3.4.6 || >=3.5.0, <3.5.3`, fixed in `3.2.4`, `3.3.3`, `3.4.6`, `3.5.3` · CVSS 5.9 Medium · Not analysed yet · Published 28 Aug 2026 · Tags: Weak cryptography or TLS, Hard-coded credentials
- [MariaDB's connector leaks the cleartext password to an MitM despite \`ssl: true\`](https://agentprime.io/advisories/GHSA-cqhc-2h57-wpxf.md)
  `GHSA-cqhc-2h57-wpxf`, `BIT-mariadb-2026-55215`, `BIT-mariadb-min-2026-55215`, `BIT-mysql-client-2026-55215`, `CVE-2026-55215` · npm `mariadb`: affected `<3.2.4 || >=3.3.0, <3.3.3 || >=3.4.0, <3.4.6 || >=3.5.0, <3.5.3`, fixed in `3.2.4`, `3.3.3`, `3.4.6`, `3.5.3` · CVSS 7.5 High · Not analysed yet · Published 28 Aug 2026 · Tags: Weak cryptography or TLS, Hard-coded credentials
- [Stable Diffusion WebUI Credential Disclosure via /sdapi/v1/cmd-flags](https://agentprime.io/advisories/CVE-2026-82288.md)
  `CVE-2026-82288` · CVE record: AUTOMATIC1111 stable-diffusion-webui · CVSS 8.7 High · Not analysed yet · Published 28 Aug 2026 · Tags: Hard-coded credentials
- [Hardcoded Credentials Vulnerability in CP Plus CP-XR-DE21-S Router](https://agentprime.io/advisories/CVE-2026-19412.md)
  `CVE-2026-19412` · CVE record: CP Plus CP-XR-DE21-S Router · CVSS 8.7 High · Not analysed yet · Published 28 Aug 2026 · Tags: Hard-coded credentials
- [gitoxide before 0.37.1 HTTP Basic credential leak via URL parsing](https://agentprime.io/advisories/CVE-2026-82247.md)
  `CVE-2026-82247` · CVE record: GitoxideLabs gitoxide · CVSS 8.7 High · Not analysed yet · Published 28 Aug 2026 · Tags: Hard-coded credentials
- [Wazuh discloses cleartext cluster key to low-privilege API users via GET /cluster/local/config](https://agentprime.io/advisories/CVE-2026-61802.md)
  `CVE-2026-61802` · CVE record: wazuh wazuh · CVSS 6.5 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: Information disclosure, Hard-coded credentials
- [Fireware OS Stack-Based Buffer Overflow in Mobile Security epm Endpoint](https://agentprime.io/advisories/CVE-2026-13086.md)
  `CVE-2026-13086` · CVE record: WatchGuard Fireware OS · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Aug 2026 · Tags: Memory corruption, Hard-coded credentials
- [Ebyte NE2-D11 Insufficiently Protected Credentials](https://agentprime.io/advisories/CVE-2026-73839.md)
  `CVE-2026-73839` · CVE record: Ebyte Ebyte NE2-D11 Firmware · CVSS 5.1 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: Hard-coded credentials
- [Use of Hard-coded Credentials in Bendix EC80 Brake ECU](https://agentprime.io/advisories/CVE-2026-71396.md)
  `CVE-2026-71396` · CVE record: Bendix EC80ESP+ J1708 and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: Hard-coded credentials
- [Zbtlink MQWrt infosrvd Command Injection](https://agentprime.io/advisories/CVE-2026-74233.md)
  `CVE-2026-74233` · CVE record: Zbtlink WE1326 and 4 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Aug 2026 · Tags: Command injection, Hard-coded credentials
- [A vulnerability in pentestgpt/core/langfuse.py in PentestGPT 1.0.0 allows remote attackers to disclose sensitive user telemetry data via hardcoded API credentials.](https://agentprime.io/advisories/CVE-2026-37012.md)
  `CVE-2026-37012` · CVE record · CVSS 7.5 High · Not analysed yet · Published 27 Aug 2026 · Tags: Hard-coded credentials
- [Insufficiently protected credentials in Veeam ONE](https://agentprime.io/advisories/CVE-2026-64632.md)
  `CVE-2026-64632` · CVE record: Veeam ONE · CVSS 8.5 High · Not analysed yet · Published 26 Aug 2026 · Tags: Hard-coded credentials
- [Trojanized pantheon-agents 0.6.1 and 0.6.2 on PyPI ship a credential stealer (supply-chain account compromise)](https://agentprime.io/advisories/GHSA-93qj-5q5v-3c2h.md)
  `GHSA-93qj-5q5v-3c2h` · PyPI `pantheon-agents`: affected `>=0.6.1, <0.6.4`, fixed in `0.6.4` · No CVSS score · Not analysed yet · Published 26 Aug 2026 · Tags: Hard-coded credentials, CWE-506
- [Use of Hard-coded LDAP Credentials in TÜBİTAK BİLGEM's Liderahenk](https://agentprime.io/advisories/CVE-2026-75896.md)
  `CVE-2026-75896` · CVE record: TÜBİTAK BİLGEM Software Technologies Research Institute Liderahenk · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: Hard-coded credentials
- [Insufficiently Protected Credentials in Rently Smart Home](https://agentprime.io/advisories/CVE-2026-75960.md)
  `CVE-2026-75960` · CVE record: Rently Smart Home · CVSS 8.7 High · Not analysed yet · Published 26 Aug 2026 · Tags: Hard-coded credentials
- [Embedded credentials in Virtuagym](https://agentprime.io/advisories/CVE-2026-12587.md)
  `CVE-2026-12587` · CVE record: Resamania Virtuagym · CVSS 8.6 High · Not analysed yet · Published 26 Aug 2026 · Tags: Hard-coded credentials
- [NVIDIA NemoClaw contains a vulnerability where an attacker could cause](https://agentprime.io/advisories/PYSEC-2026-3782.md)
  `PYSEC-2026-3782`, `CVE-2026-65087` · PyPI `uff`: affected `<=0.0.1`, no fixed version yet · CVSS 5.6 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Hard-coded credentials
- [urllib's cross-origin redirects preserve credential-bearing request headers, leading to potential credential leakage](https://agentprime.io/advisories/GHSA-hq3h-g68c-hp78.md)
  `GHSA-hq3h-g68c-hp78`, `CVE-2026-55553` · npm `urllib`: affected `<2.44.1 || >=3.0.0, <4.9.1`, fixed in `2.44.1`, `4.9.1` · CVSS 7.5 High · Not analysed yet · Published 25 Aug 2026 · Tags: Information disclosure, Hard-coded credentials
- [Hard-coded cryptographic key in NVIDIA Unified Fabric Manager Enterprise - GA and others](https://agentprime.io/advisories/CVE-2026-24166.md)
  `CVE-2026-24166` · CVE record: NVIDIA Unified Fabric Manager Enterprise - GA and 3 more · CVSS 5.1 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Hard-coded credentials
- [Hard-coded credentials in FURUNO ELECTRIC CO., LTD. FA-50](https://agentprime.io/advisories/CVE-2026-59769.md)
  `CVE-2026-59769` · CVE record: FURUNO ELECTRIC CO., LTD. FA-50 · CVSS 8.8 High · Not analysed yet · Published 25 Aug 2026 · Tags: Hard-coded credentials
- [Duplicate Advisory: Grav: config_denied_paths default list omits \`system\`, exposing real secrets (e.g. system.cache.redis.password) via the Twig sandbox when config_access is enabled](https://agentprime.io/advisories/GHSA-crrc-vpp2-f5x7.md)
  `GHSA-crrc-vpp2-f5x7` · Packagist `getgrav/grav`: affected `*`, no fixed version yet · CVSS 7.5 High · Withdrawn · Not analysed yet · Published 25 Aug 2026 · Tags: Hard-coded credentials
- [Duplicate Advisory: Grav: UserInterface offsetget/offsetexists allow-listed in Twig sandbox let editor-authored content leak hashed_password and 2FA secrets via offsetGet()](https://agentprime.io/advisories/GHSA-8vp7-8q4w-vv7m.md)
  `GHSA-8vp7-8q4w-vv7m` · Packagist `getgrav/grav`: affected `*`, no fixed version yet · CVSS 6.5 Medium · Withdrawn · Not analysed yet · Published 25 Aug 2026 · Tags: Hard-coded credentials
- [RansomLook API Key Disclosure Through /admin/apikeys HTML Source](https://agentprime.io/advisories/CVE-2026-78555.md)
  `CVE-2026-78555` · CVE record: ransomlook ransomlook · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Aug 2026 · Tags: Information disclosure, Hard-coded credentials
- [Dolibarr < 24.0.0 Members REST API Sensitive Data Exposure via Member Endpoints](https://agentprime.io/advisories/CVE-2026-71511.md)
  `CVE-2026-71511` · CVE record: Dolibarr dolibarr · CVSS 7.1 High · Not analysed yet · Published 24 Aug 2026 · Tags: Hard-coded credentials
- [Hard-coded Mesh Group Private Key in TP-Link Deco XE75, XE5300, and WE10800](https://agentprime.io/advisories/CVE-2026-15469.md)
  `CVE-2026-15469` · CVE record: TP-Link Systems Inc. Deco XE75 v3 / XE5300 v3.6/ WE10800 v3.6 · CVSS 7.7 High · Not analysed yet · Published 24 Aug 2026 · Tags: Hard-coded credentials
- [act 0.2.81 through 0.2.89 Missing Authorization in the Artifacts V4 Backend](https://agentprime.io/advisories/CVE-2026-76847.md)
  `CVE-2026-76847` · CVE record: nektos act · CVSS 8.7 High · Not analysed yet · Published 24 Aug 2026 · Tags: Hard-coded credentials, Broken access control
- [DJI Drone FTP Service Allows Unrestricted Storage Consumption of the /blackbox Directory](https://agentprime.io/advisories/CVE-2026-78251.md)
  `CVE-2026-78251` · CVE record: DJI Neo and 4 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Aug 2026 · Tags: Hard-coded credentials
- [vas3k TaxHacker JWT Secret config.ts envSchema.parse hard-coded credentials](https://agentprime.io/advisories/CVE-2026-78062.md)
  `CVE-2026-78062` · CVE record: vas3k TaxHacker · CVSS 6.9 Medium · Not analysed yet · Published 23 Aug 2026 · Tags: Hard-coded credentials
- [Checkmate: Sensitive Bearer Token Exposure via Public Status Pages When showURL Setting is Enabled](https://agentprime.io/advisories/CVE-2026-71862.md)
  `CVE-2026-71862` · CVE record: bluewave-labs Checkmate · CVSS 7.5 High · Not analysed yet · Published 21 Aug 2026 · Tags: Information disclosure, Hard-coded credentials
- [Hard-coded credentials in Yamaha Corporation VOCALOID6](https://agentprime.io/advisories/CVE-2026-76131.md)
  `CVE-2026-76131` · CVE record: Yamaha Corporation VOCALOID6 · CVSS 6.9 Medium · Not analysed yet · Published 21 Aug 2026 · Tags: Hard-coded credentials
- [CloudNativePG: Cleartext role passwords recorded in pg_stat_statements allow privileged tenant roles to recover the PostgreSQL superuser credential and achieve RCE in the database pod](https://agentprime.io/advisories/CVE-2026-55765.md)
  `CVE-2026-55765` · CVE record: cloudnative-pg cloudnative-pg · CVSS 8.5 High · Not analysed yet · Published 20 Aug 2026 · Tags: Hard-coded credentials, CWE-256
- [libgit2: HTTP transport can leak credentials to an offsite redirect target](https://agentprime.io/advisories/CVE-2026-53586.md)
  `CVE-2026-53586` · CVE record: libgit2 libgit2 · CVSS 6.5 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Information disclosure, Hard-coded credentials, Open redirect
- [Use of Hard-coded Credentials in Container Connections in Splunk AI Toolkit](https://agentprime.io/advisories/CVE-2026-76392.md)
  `CVE-2026-76392` · CVE record: Splunk Splunk AI Toolkit · CVSS 5.4 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Hard-coded credentials
- [Use of Hard-coded Cryptographic Key through Companion App Registration in Splunk Secure Gateway](https://agentprime.io/advisories/CVE-2026-76258.md)
  `CVE-2026-76258` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Hard-coded credentials
- [Cisco Crosswork Security Hardening Release: August 2026](https://agentprime.io/advisories/CVE-2026-20359.md)
  `CVE-2026-20359` · CVE record: Cisco Cisco Crosswork Planning · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Aug 2026 · Tags: Hard-coded credentials
- [Cudy WR3000 2.0 Hard-coded JWT Secret Authentication Bypass via MQTT](https://agentprime.io/advisories/CVE-2026-71960.md)
  `CVE-2026-71960` · CVE record: Shenzhen Cudy Technology Co., Ltd. WR3000 2.0 and 1 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Aug 2026 · Tags: Hard-coded credentials
- [HDD Password leakage vulnerability](https://agentprime.io/advisories/CVE-2026-8810.md)
  `CVE-2026-8810` · CVE record: Insyde Software InsydeH2O, InsydeH2O ARM · CVSS 6.9 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Hard-coded credentials
- [Blueprint Studio terminal SSH private key written to disk](https://agentprime.io/advisories/CVE-2026-53456.md)
  `CVE-2026-53456` · CVE record: ha-china blueprint-studio · CVSS 5.6 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: Hard-coded credentials
- [Blueprint Studio stored Git credentials in plaintext Git credential store](https://agentprime.io/advisories/CVE-2026-53454.md)
  `CVE-2026-53454` · CVE record: ha-china blueprint-studio · CVSS 6.9 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: Hard-coded credentials
- [\`HTTPPasswordMgr\` can send saved HTTPS credentials via HTTP because of incorrect scheme matching](https://agentprime.io/advisories/CVE-2026-15806.md)
  `CVE-2026-15806` · CVE record: Python Software Foundation CPython · CVSS 6.0 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: Weak cryptography or TLS, Hard-coded credentials
- [Hardcoded session key in Zabbix 7.4](https://agentprime.io/advisories/CVE-2026-23933.md)
  `CVE-2026-23933` · CVE record: Zabbix Zabbix · CVSS 7.7 High · Not analysed yet · Published 18 Aug 2026 · Tags: Hard-coded credentials
- [Email media OAuth secret leak to Super Admin](https://agentprime.io/advisories/CVE-2026-23922.md)
  `CVE-2026-23922` · CVE record: Zabbix Zabbix · CVSS 2.1 Low · Not analysed yet · Published 18 Aug 2026 · Tags: Hard-coded credentials
- [An issue exists in pson EH-TW5350 Epson iProjection.apk v3.2.6.](https://agentprime.io/advisories/CVE-2021-43717.md)
  `CVE-2021-43717` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Aug 2026 · Tags: Hard-coded credentials
- [Stirling-PDF: Internal Service Account API Key Disclosure via Pipeline Endpoint](https://agentprime.io/advisories/CVE-2026-57485.md)
  `CVE-2026-57485` · CVE record: Stirling-Tools Stirling-PDF · CVSS 8.5 High · Not analysed yet · Published 17 Aug 2026 · Tags: Information disclosure, Hard-coded credentials
- [Sensitive Data Exposure in Innotim Software's Logsign SIEM](https://agentprime.io/advisories/CVE-2026-14564.md)
  `CVE-2026-14564` · CVE record: Innotim Software Telecommunications and Consulting Trade Ltd. Co. Logsign SIEM · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Aug 2026 · Tags: Hard-coded credentials
- [openssl_encrypt versions before 1.4.0 contain hardcoded default JWT signing secrets in config.py that pass validation checks. Attackers with access to source code can forge valid JWT tokens for any...](https://agentprime.io/advisories/GHSA-qc6h-gfjh-7qqg.md)
  `GHSA-qc6h-gfjh-7qqg`, `CVE-2026-74893`, `PYSEC-2026-3768` · PyPI `openssl-encrypt`: affected `<1.4.0`, fixed in `1.4.0` · CVSS 8.7 High · Not analysed yet · Published 17 Aug 2026 · Tags: Hard-coded credentials
- [openssl_encrypt versions before 1.4.0 contain a hardcoded default secret key in the standalone telemetry server configuration that is used for API key hashing. Attackers who know this default value...](https://agentprime.io/advisories/GHSA-p926-6hjp-w9jw.md)
  `GHSA-p926-6hjp-w9jw`, `CVE-2026-74892`, `PYSEC-2026-3746` · PyPI `openssl-encrypt`: affected `<1.4.0`, fixed in `1.4.0` · CVSS 8.7 High · Not analysed yet · Published 17 Aug 2026 · Tags: Hard-coded credentials
- [openssl_encrypt versions before 1.4.0 contain hardcoded database credentials in standalone server configuration files. Attackers on the same network can access PostgreSQL databases using well-known...](https://agentprime.io/advisories/GHSA-v4vm-4xf2-fhqj.md)
  `GHSA-v4vm-4xf2-fhqj`, `CVE-2026-74891`, `PYSEC-2026-3767` · PyPI `openssl-encrypt`: affected `<1.4.0`, fixed in `1.4.0` · CVSS 8.7 High · Not analysed yet · Published 17 Aug 2026 · Tags: Hard-coded credentials
- [Planet9 Hardcoded Credentials Vulnerability Information](https://agentprime.io/advisories/CVE-2026-50601.md)
  `CVE-2026-50601` · CVE record: Acer Planet9 desktop application · CVSS 6.6 Medium · Not analysed yet · Published 17 Aug 2026 · Tags: Hard-coded credentials

Newest: <https://agentprime.io/advisories/tag/hard-coded-credentials.md>
Older: <https://agentprime.io/advisories/tag/hard-coded-credentials.md?cursor=WyIyMDI2LTA4LTE3VDAyOjAyOjQwLjUwODAwMFoiLCJDVkUtMjAyNi01MDYwMSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=hard-coded-credentials&cursor=WyIyMDI2LTA5LTAxVDIyOjI1OjM1Ljc0OTAwMFoiLCJDVkUtMjAyNi04NDQ4MyJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/hard-coded-credentials/?cursor=WyIyMDI2LTA5LTAxVDIyOjI1OjM1Ljc0OTAwMFoiLCJDVkUtMjAyNi04NDQ4MyJd>. Everything for agents: <https://agentprime.io/llms.txt>.