# Hard-coded credentials. Passwords and keys built into the code, or weak credentials. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [rclone: http backend forwards custom/auth headers to a different host on redirect](https://agentprime.io/advisories/GHSA-486v-q2wf-fp2r.md) `GHSA-486v-q2wf-fp2r`, `BIT-rclone-2026-88013`, `CVE-2026-88013`, `GO-2026-6463` · Go `github.com/rclone/rclone`: affected `>=1.49.0, <1.75.1`, fixed in `1.75.1` · CVSS 3.7 Low · Not analysed yet · Published 10 Sept 2026 · Tags: Information disclosure, Weak cryptography or TLS, Hard-coded credentials - [Hard-coded credentials in Lenovo Health Application](https://agentprime.io/advisories/CVE-2026-75940.md) `CVE-2026-75940` · CVE record: Lenovo Health Application · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Sept 2026 · Tags: Hard-coded credentials - [Hard-coded credentials in Hikvision DS-KV9503 and others](https://agentprime.io/advisories/CVE-2026-85544.md) `CVE-2026-85544` · CVE record: Hikvision DS-KV9503 and 4 more · CVSS 6.1 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Hard-coded credentials, CWE-1310 - [Use of Hard-coded Credentials in drEryk Gabinet](https://agentprime.io/advisories/CVE-2026-17038.md) `CVE-2026-17038` · CVE record: drEryk drEryk Gabinet · CVSS 6.9 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Hard-coded credentials - [Nuxt Ollama: Public Runtime Config Exposes Ollama API Key to Browser Clients](https://agentprime.io/advisories/GHSA-fxg7-897c-57mp.md) `GHSA-fxg7-897c-57mp`, `CVE-2026-59158` · npm `nuxt-ollama`: affected `>=1.2.26, <1.3.1`, fixed in `1.3.1` · CVSS 7.5 High · Not analysed yet · Published 9 Sept 2026 · Tags: Hard-coded credentials - [MaxSite CMS through 109.6 Authentication Bypass via Hardcoded Encryption Key](https://agentprime.io/advisories/CVE-2026-87929.md) `CVE-2026-87929` · CVE record: MaxSite MaxSite CMS · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Sept 2026 · Tags: Hard-coded credentials - [Softish C6 Ear Camera and EarVision Android Application Use of Hard-coded Credentials](https://agentprime.io/advisories/CVE-2026-81640.md) `CVE-2026-81640` · CVE record: Softish EarVision Android application and 1 more · CVSS 8.7 High · Not analysed yet · Published 9 Sept 2026 · Tags: Hard-coded credentials - [Hard-coded cryptographic key in Dell Secure Connect Gateway 5.0 - Application and others](https://agentprime.io/advisories/CVE-2026-79735.md) `CVE-2026-79735` · CVE record: Dell Secure Connect Gateway 5.0 - Application and 1 more · CVSS 4.4 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: Hard-coded credentials - [Hard-coded credentials in Dell Secure Connect Gateway 5.0 - Application and others](https://agentprime.io/advisories/CVE-2026-79731.md) `CVE-2026-79731` · CVE record: Dell Secure Connect Gateway 5.0 - Application and 1 more · CVSS 4.4 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: Hard-coded credentials - [Hard-coded credentials in Dell Secure Connect Gateway 5.0 - Application and others](https://agentprime.io/advisories/CVE-2026-79950.md) `CVE-2026-79950` · CVE record: Dell Secure Connect Gateway 5.0 - Application and 1 more · CVSS 7.5 High · Not analysed yet · Published 9 Sept 2026 · Tags: Hard-coded credentials - [Hard-coded credentials in Dell Secure Connect Gateway 5.0 - Application and others](https://agentprime.io/advisories/CVE-2026-79740.md) `CVE-2026-79740` · CVE record: Dell Secure Connect Gateway 5.0 - Application and 1 more · CVSS 7.5 High · Not analysed yet · Published 9 Sept 2026 · Tags: Hard-coded credentials - [Hard-coded credentials in Dell Secure Connect Gateway 5.0 - Application and others](https://agentprime.io/advisories/CVE-2026-79738.md) `CVE-2026-79738` · CVE record: Dell Secure Connect Gateway 5.0 - Application and 1 more · CVSS 7.5 High · Not analysed yet · Published 9 Sept 2026 · Tags: Hard-coded credentials - [Hard-coded cryptographic key in Dell Secure Connect Gateway 5.0 - Application and others](https://agentprime.io/advisories/CVE-2026-78486.md) `CVE-2026-78486` · CVE record: Dell Secure Connect Gateway 5.0 - Application and 1 more · CVSS 4.4 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: Hard-coded credentials - [Hard-coded cryptographic key in Dell Secure Connect Gateway 5.0 - Application and others](https://agentprime.io/advisories/CVE-2026-78481.md) `CVE-2026-78481` · CVE record: Dell Secure Connect Gateway 5.0 - Application and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: Hard-coded credentials - [Authentication Bypass via Hardcoded Master Verification Code vulnerability in Siam Ordering (siam-server) 1.0.0 allows remote unauthenticated attackers to log in as any user, merchant, or administrat…](https://agentprime.io/advisories/CVE-2026-71809.md) `CVE-2026-71809` · CVE record · CVSS 8.1 High · Not analysed yet · Published 9 Sept 2026 · Tags: Hard-coded credentials - [An issue was discovered in s-pms SPMS-Server through v1.0.](https://agentprime.io/advisories/CVE-2026-71801.md) `CVE-2026-71801` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Sept 2026 · Tags: Hard-coded credentials - [OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption](https://agentprime.io/advisories/CVE-2026-53939.md) `CVE-2026-53939` · CVE record: OpenIDC cjose · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Hard-coded credentials, Weak cryptography or TLS - [Information disclosure in Eclipse Foundation Eclipse aeriOS](https://agentprime.io/advisories/CVE-2026-86464.md) `CVE-2026-86464` · CVE record: Eclipse Foundation Eclipse aeriOS · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Information disclosure, Authentication bypass, Hard-coded credentials, CWE-1188 - [Infracost: Terraform Cloud and registry token disclosure via unvalidated hostname](https://agentprime.io/advisories/GHSA-6x6c-w9w9-hv4h.md) `GHSA-6x6c-w9w9-hv4h`, `CVE-2026-71494`, `GO-2026-6437` · Go `github.com/infracost/infracost`: affected `<0.10.45`, fixed in `0.10.45` · CVSS 5.9 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Hard-coded credentials - [ningzichun Student Management System Database Connection database.php mysqli_connect hard-coded credentials](https://agentprime.io/advisories/CVE-2026-86673.md) `CVE-2026-86673` · CVE record: ningzichun Student Management System · CVSS 6.9 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Hard-coded credentials - [AVEVA Pipeline Integrity Monitor Use of hard-coded cryptographic key](https://agentprime.io/advisories/CVE-2026-81821.md) `CVE-2026-81821` · CVE record: AVEVA Pipeline Integrity Monitor · CVSS 8.3 High · Not analysed yet · Published 8 Sept 2026 · Tags: Hard-coded credentials - [.NET Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-69805.md) `CVE-2026-69805` · CVE record: Microsoft Microsoft Visual Studio 2022 version 17.14 and 2 more · CVSS 7.5 High · Not analysed yet · Published 8 Sept 2026 · Tags: Path traversal, Information disclosure, Hard-coded credentials - [Microsoft Office Spoofing Vulnerability](https://agentprime.io/advisories/CVE-2026-64918.md) `CVE-2026-64918` · CVE record: Microsoft Microsoft 365 Apps for Enterprise · CVSS 6.5 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Hard-coded credentials - [GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-81381.md) `CVE-2026-81381` · CVE record: Microsoft Visual Studio Code · CVSS 6.5 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Hard-coded credentials - [Azure CycleCloud Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-77909.md) `CVE-2026-77909` · CVE record: Microsoft Azure CycleCloud 8.9.2 · CVSS 7.7 High · Not analysed yet · Published 8 Sept 2026 · Tags: Hard-coded credentials - [Insufficiently Protected Credentials in MongoDB Server Diagnostic Reporting Interface](https://agentprime.io/advisories/CVE-2026-82070.md) `CVE-2026-82070` · CVE record: MongoDB MongoDB Server · CVSS 7.1 High · Not analysed yet · Published 8 Sept 2026 · Tags: Hard-coded credentials - [Workload identity attestation generated before login host validation in Snowflake drivers](https://agentprime.io/advisories/CVE-2026-86600.md) `CVE-2026-86600` · CVE record: Snowflake Snowflake Connector for Python and 4 more · CVSS 8.2 High · Not analysed yet · Published 8 Sept 2026 · Tags: Hard-coded credentials, CWE-441 - [AVideo through 29.0 Information Disclosure via restreamsActive.json.php](https://agentprime.io/advisories/CVE-2026-86726.md) `CVE-2026-86726` · CVE record: WWBN AVideo · CVSS 7.1 High · Not analysed yet · Published 8 Sept 2026 · Tags: Hard-coded credentials - [Netis NX10 Credential Disclosure via sysinfo Diagnostic Endpoint](https://agentprime.io/advisories/CVE-2026-61516.md) `CVE-2026-61516` · CVE record: Netis Systems NX10 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Hard-coded credentials - [@sap/cds-mtx: Credential disclosure in multitenant applications using SAP Cloud Application Programming Model (CAP)](https://agentprime.io/advisories/GHSA-955m-rr6m-2f9v.md) `GHSA-955m-rr6m-2f9v`, `CVE-2026-76969` · npm `@sap/cds-mtxs`: affected `<1.18.4 || >=2.0.2, <2.7.7 || >=3.0.1, <3.9.7 || >=4.0.1, <4.0.3`, fixed in `1.18.4`, `2.7.7`, `3.9.7`, `4.0.3` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Hard-coded credentials - [Hard-coded cryptographic key in Dell Secure Connect Gateway 5.0 - Application and others](https://agentprime.io/advisories/CVE-2026-80167.md) `CVE-2026-80167` · CVE record: Dell Secure Connect Gateway 5.0 - Application and 1 more · CVSS 5.5 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Hard-coded credentials - [Hard-coded cryptographic key in Dell Secure Connect Gateway 5.0 - Application and others](https://agentprime.io/advisories/CVE-2026-80057.md) `CVE-2026-80057` · CVE record: Dell Secure Connect Gateway 5.0 - Application and 1 more · CVSS 5.5 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Hard-coded credentials - [Hard-coded credentials in Dell Secure Connect Gateway 5.0 - Application and others](https://agentprime.io/advisories/CVE-2026-80170.md) `CVE-2026-80170` · CVE record: Dell Secure Connect Gateway 5.0 - Application and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Hard-coded credentials - [Hard-coded cryptographic key in Dell Secure Connect Gateway 5.0 - Application and others](https://agentprime.io/advisories/CVE-2026-78487.md) `CVE-2026-78487` · CVE record: Dell Secure Connect Gateway 5.0 - Application and 1 more · CVSS 5.5 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Hard-coded credentials - [Hard-coded credentials in Dell Secure Connect Gateway 5.0 - Application and others](https://agentprime.io/advisories/CVE-2026-80134.md) `CVE-2026-80134` · CVE record: Dell Secure Connect Gateway 5.0 - Application and 1 more · CVSS 7.7 High · Not analysed yet · Published 7 Sept 2026 · Tags: Hard-coded credentials - [SourceCodester Syllabus-Aligned Learning Management & Examination System db.php hard-coded credentials](https://agentprime.io/advisories/CVE-2026-86276.md) `CVE-2026-86276` · CVE record: SourceCodester Syllabus-Aligned Learning Management & Examination System · CVSS 6.9 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Hard-coded credentials - [liufee FeehiCMS Cookie Validation main-local.php hard-coded key](https://agentprime.io/advisories/CVE-2026-86241.md) `CVE-2026-86241` · CVE record: liufee FeehiCMS · CVSS 5.3 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Hard-coded credentials, CWE-320 - [Tenda CP3 hostapd hard-coded credentials](https://agentprime.io/advisories/CVE-2026-86150.md) `CVE-2026-86150` · CVE record: Tenda CP3 · CVSS 5.1 Medium · Not analysed yet · Published 5 Sept 2026 · Tags: Hard-coded credentials - [NetBox through 4.7.0 Credential Disclosure via REST and GraphQL APIs](https://agentprime.io/advisories/CVE-2026-86175.md) `CVE-2026-86175` · CVE record: netbox-community netbox · CVSS 7.1 High · Not analysed yet · Published 5 Sept 2026 · Tags: Hard-coded credentials - [SiYuan: Non-administrator responses from /api/system/getConf omit three secrets that the configuration-export path explicitly strips, disclosing the session-cookie signing key and the OS username to anonymous readers](https://agentprime.io/advisories/GHSA-h4v5-crx2-3cv4.md) `GHSA-h4v5-crx2-3cv4`, `CVE-2026-72793`, `GO-2026-6424` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<0.0.0-20260725132049-2d8b98395a91`, fixed in `0.0.0-20260725132049-2d8b98395a91` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Hard-coded credentials - [SiYuan: The session-cookie signing key (Conf.CookieKey) is returned to anonymous readers by /api/system/getConf](https://agentprime.io/advisories/GHSA-34fj-mwm6-fjfg.md) `GHSA-34fj-mwm6-fjfg`, `CVE-2026-72794`, `GO-2026-6420` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<0.0.0-20260725123945-77421530be4a`, fixed in `0.0.0-20260725123945-77421530be4a` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Hard-coded credentials - [Tycon Systems TPDIN-Monitor-WEB3 Use of Hard-coded Credentials](https://agentprime.io/advisories/CVE-2026-77847.md) `CVE-2026-77847` · CVE record: Tycon Systems TPDIN-Monitor-WEB3 · CVSS 7.1 High · Not analysed yet · Published 4 Sept 2026 · Tags: Hard-coded credentials - [PassMark PerformanceTest, BurnInTest, and OSForensics Hard-coded Credentials Authentication Bypass via DirectIo64.sys](https://agentprime.io/advisories/CVE-2026-80114.md) `CVE-2026-80114` · CVE record: PassMark Software PerformanceTest and 2 more · CVSS 8.5 High · Not analysed yet · Published 4 Sept 2026 · Tags: Hard-coded credentials - [QRadar contains hard-coded credentials](https://agentprime.io/advisories/CVE-2026-5522.md) `CVE-2026-5522` · CVE record: IBM QRadar · CVSS 6.7 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Hard-coded credentials - [Onyx 4.6.6 Custom Tool Secret Header Disclosure via Tool Endpoints](https://agentprime.io/advisories/CVE-2026-85700.md) `CVE-2026-85700` · CVE record: onyx-dot-app onyx · CVSS 7.1 High · Not analysed yet · Published 4 Sept 2026 · Tags: Hard-coded credentials - [Hard-coded password in Xing Inc. XING CPTrans-ME-X](https://agentprime.io/advisories/CVE-2026-70403.md) `CVE-2026-70403` · CVE record: Xing Inc. XING CPTrans-ME-X · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Hard-coded credentials - [Lightstar｜SmartIT Desktop Manager - Use of Hard-coded Credentials](https://agentprime.io/advisories/CVE-2026-85149.md) `CVE-2026-85149` · CVE record: Lightstar SmartIT Desktop Manager · CVSS 6.9 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Hard-coded credentials - [Lightstar｜SmartIT Desktop Manager - Use of Hard-coded Credentials](https://agentprime.io/advisories/CVE-2026-85148.md) `CVE-2026-85148` · CVE record: Lightstar SmartIT Desktop Manager · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Hard-coded credentials - [Lightstar｜SmartIT Desktop Manager - Use of Hard-coded Credentials](https://agentprime.io/advisories/CVE-2026-85146.md) `CVE-2026-85146` · CVE record: Lightstar SmartIT Desktop Manager · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Hard-coded credentials - [Missing authentication in ASUS Control Center Enterprise (ACC)](https://agentprime.io/advisories/CVE-2026-75754.md) `CVE-2026-75754` · CVE record: ASUS Control Center Enterprise (ACC) · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Authentication bypass, Hard-coded credentials, Server-side request forgery (SSRF) - [PowerJob Server version 5.1.2 (and likely earlier) uses a predictable JWT signing key for HS256-based authentication.](https://agentprime.io/advisories/CVE-2026-75431.md) `CVE-2026-75431` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Hard-coded credentials - [SiYuan: Encrypted-notebook key-derivation material and wrapped notebook keys disclosed to anonymous readers, enabling offline master-password cracking](https://agentprime.io/advisories/GHSA-8x84-r2ff-h8pq.md) `GHSA-8x84-r2ff-h8pq`, `CVE-2026-72801`, `GO-2026-6392` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<0.0.0-20260724102025-3bc014c7dc32`, fixed in `0.0.0-20260724102025-3bc014c7dc32` · CVSS 8.7 High · Not analysed yet · Published 3 Sept 2026 · Tags: Hard-coded credentials - [MOOS core-moos through 10.4.0 Remote Process Termination via Hard-Coded Multicast Passphrase](https://agentprime.io/advisories/CVE-2026-85451.md) `CVE-2026-85451` · CVE record: themoos core-moos · CVSS 7.1 High · Not analysed yet · Published 3 Sept 2026 · Tags: Hard-coded credentials - [Hardcoded Shared RSA-1024 Private Key in Web Login in TP-Link RE305 and Archer C7](https://agentprime.io/advisories/CVE-2026-18330.md) `CVE-2026-18330` · CVE record: TP-Link Systems Inc. RE305 v3 and 1 more · CVSS 6.1 Medium · Not analysed yet · Published 3 Sept 2026 · Tags: Hard-coded credentials - [Vulnerabilities exists in IBM Netezza Software](https://agentprime.io/advisories/CVE-2026-8862.md) `CVE-2026-8862` · CVE record: IBM Netezza Software · CVSS 7.5 High · Not analysed yet · Published 3 Sept 2026 · Tags: Hard-coded credentials - [Peppermint through 0.5.5 Use of Hard-coded JWT Signing Secret in docker-compose.yml](https://agentprime.io/advisories/CVE-2026-85391.md) `CVE-2026-85391` · CVE record: Peppermint-Lab peppermint · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Hard-coded credentials - [MISP LDAP and LinOTP Authentication Bypass via Empty or Invalid Credentials](https://agentprime.io/advisories/CVE-2026-85216.md) `CVE-2026-85216` · CVE record: misp misp · CVSS 9.5 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Hard-coded credentials - [Use of Weak Credentials](https://agentprime.io/advisories/CVE-2026-79679.md) `CVE-2026-79679` · CVE record: B&R Industrial Automation GmbH mapp Services · CVSS 7.0 High · Not analysed yet · Published 3 Sept 2026 · Tags: Hard-coded credentials - [UpSignOn < 7.19.0 Biometric Key Exposure via Windows PasswordVault](https://agentprime.io/advisories/CVE-2026-75136.md) `CVE-2026-75136` · CVE record: Septeo IT Solutions UpSignOn · CVSS 6.9 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Hard-coded credentials - [WWBN AVideo Unauthenticated Password Hash Oracle via encryptPass.json.php](https://agentprime.io/advisories/CVE-2026-84483.md) `CVE-2026-84483` · CVE record: WWBN AVideo · CVSS 6.9 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Hard-coded credentials Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .