# Hard-coded credentials. Passwords and keys built into the code, or weak credentials. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [EVE Doesn't Protect Config Partition with Measured Boot](https://agentprime.io/advisories/GHSA-wc42-fcjp-v8vq.md) `GHSA-wc42-fcjp-v8vq`, `CVE-2023-43634`, `GO-2026-4432` · Go `github.com/lf-edge/eve`: affected `<0.0.0-20230519072751-977f42b07fa9`, fixed in `0.0.0-20230519072751-977f42b07fa9` · CVSS 8.8 High · Not analysed yet · Published 4 Feb 2026 · Tags: Hard-coded credentials, Information disclosure - [EVE's Debug Functions Unlockable Without Triggering Measured Boot](https://agentprime.io/advisories/GHSA-4c4v-42hc-72p6.md) `GHSA-4c4v-42hc-72p6`, `CVE-2023-43633`, `GO-2026-4428` · Go `github.com/lf-edge/eve`: affected `<0.0.0-20220708121648-5fef4d92e758`, fixed in `0.0.0-20220708121648-5fef4d92e758` · CVSS 8.8 High · Not analysed yet · Published 4 Feb 2026 · Tags: Hard-coded credentials, Information disclosure - [EVE: SSH as Root Unlockable Without Triggering Measured Boot](https://agentprime.io/advisories/GHSA-3mq9-xhgq-r7gj.md) `GHSA-3mq9-xhgq-r7gj`, `CVE-2023-43631`, `GO-2026-4418` · Go `github.com/lf-edge/eve`: affected `<0.0.0-20220708121648-5fef4d92e758`, fixed in `0.0.0-20220708121648-5fef4d92e758` · CVSS 8.8 High · Not analysed yet · Published 4 Feb 2026 · Tags: Hard-coded credentials, Information disclosure - [EVE Doesn't Measure Config Partition From 2 Fronts](https://agentprime.io/advisories/GHSA-phcg-h58r-gmcq.md) `GHSA-phcg-h58r-gmcq`, `CVE-2023-43630`, `GO-2026-4430` · Go `github.com/lf-edge/eve`: affected `<0.0.0-20230126065759-d9383a7ee4e1`, fixed in `0.0.0-20230126065759-d9383a7ee4e1` · CVSS 8.8 High · Not analysed yet · Published 4 Feb 2026 · Tags: Weak cryptography or TLS, Hard-coded credentials, Information disclosure - [n8n's domain allowlist bypass enables credential exfiltration](https://agentprime.io/advisories/GHSA-2xcx-75h9-vr9h.md) `GHSA-2xcx-75h9-vr9h`, `CVE-2026-25631` · npm `n8n`: affected `<1.121.0`, fixed in `1.121.0` · CVSS 5.3 Medium · Not analysed yet · Published 4 Feb 2026 · Tags: Hard-coded credentials, CWE-20 - [Cisco Prime Infrastructure Stored Cross-Site Scripting Vulnerability](https://agentprime.io/advisories/CVE-2026-20111.md) `CVE-2026-20111` · CVE record: Cisco Cisco Prime Infrastructure · CVSS 4.8 Medium · Not analysed yet · Published 4 Feb 2026 · Tags: Hard-coded credentials - [Edimax EW-7438RPn 1.13 - Information Disclosure (WiFi Password)](https://agentprime.io/advisories/CVE-2020-37097.md) `CVE-2020-37097` · CVE record: EDIMAX Technology Co., Ltd. EW-7438RPn Mini · CVSS 8.7 High · Not analysed yet · Published 3 Feb 2026 · Tags: Hard-coded credentials - [Netis E1+ 1.2.32533 - Backdoor Account (root)](https://agentprime.io/advisories/CVE-2020-37092.md) `CVE-2020-37092` · CVE record: Netis Systems Co., Ltd. Netis E1+ · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Feb 2026 · Tags: Hard-coded credentials - [Skipper is vulnerable to arbitrary code execution through lua filters in github.com/zalando/skipper](https://agentprime.io/advisories/GHSA-cc8m-98fm-rc9g.md) `GHSA-cc8m-98fm-rc9g`, `CVE-2026-23742`, `GO-2026-4327` · Go `github.com/zalando/skipper`: affected `<0.23.0`, fixed in `0.23.0` · CVSS 8.8 High · Not analysed yet · Published 3 Feb 2026 · Tags: Code injection, Privilege escalation, Hard-coded credentials - [Duplicate Advisory: FUXA contains a hard-coded credential vulnerability](https://agentprime.io/advisories/GHSA-2r8f-cf6w-x5vq.md) `GHSA-2r8f-cf6w-x5vq` · npm `fuxa-server`: affected `<=1.2.7`, no fixed version yet · CVSS 4.0, no score published · Withdrawn · Not analysed yet · Published 3 Feb 2026 · Tags: Hard-coded credentials - [HCL AION is affected by an Autocomplete HTML Attribute Not Disabled for Password Field vulnerability](https://agentprime.io/advisories/CVE-2025-52623.md) `CVE-2025-52623` · CVE record: HCL AION · CVSS 3.7 Low · Not analysed yet · Published 3 Feb 2026 · Tags: Hard-coded credentials - [Weak credentials in ELECOM CO.,LTD. WRC-X1500GS-B and others](https://agentprime.io/advisories/CVE-2026-24449.md) `CVE-2026-24449` · CVE record: ELECOM CO.,LTD. WRC-X1500GS-B and 1 more · CVSS 5.1 Medium · Not analysed yet · Published 3 Feb 2026 · Tags: Hard-coded credentials - [Bambuddy Uses Hardcoded Secret Key + Many API Endpoints do not Require Authentication](https://agentprime.io/advisories/GHSA-gc24-px2r-5qmf.md) `GHSA-gc24-px2r-5qmf`, `CVE-2026-25505` · PyPI `bambuddy`: affected `<0.1.7`, fixed in `0.1.7` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Feb 2026 · Tags: Authentication bypass, Hard-coded credentials - [Hard-coded credentials in Samsung Electronics MagicINFO 9 Server](https://agentprime.io/advisories/CVE-2026-25202.md) `CVE-2026-25202` · CVE record: Samsung Electronics MagicINFO 9 Server · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Feb 2026 · Tags: Hard-coded credentials - [malcontent OCI image pull credential exfiltration via malicious registry token realm](https://agentprime.io/advisories/GHSA-9m43-p3cx-w8j5.md) `GHSA-9m43-p3cx-w8j5`, `CVE-2026-24845`, `GO-2026-4392` · Go `github.com/chainguard-dev/malcontent`: affected `>=0.10.0, <1.20.3`, fixed in `1.20.3` · CVSS 6.5 Medium · Not analysed yet · Published 29 Jan 2026 · Tags: Hard-coded credentials - [Tenda AX12 Pro V2 Telnet Service hard-coded credentials](https://agentprime.io/advisories/CVE-2026-1610.md) `CVE-2026-1610` · CVE record: Tenda AX12 Pro V2 · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jan 2026 · Tags: Hard-coded credentials - [M/Monit 3.7.4 - Password Disclosure](https://agentprime.io/advisories/CVE-2020-36968.md) `CVE-2020-36968` · CVE record: Tildeslash Ltd. M/Monit · CVSS 7.1 High · Not analysed yet · Published 28 Jan 2026 · Tags: Hard-coded credentials - [SolarWinds Web Help Desk Hardcoded Credentials Vulnerability](https://agentprime.io/advisories/CVE-2025-40537.md) `CVE-2025-40537` · CVE record: SolarWinds Web Help Desk · CVSS 7.5 High · Not analysed yet · Published 28 Jan 2026 · Tags: Hard-coded credentials - [Dokploy uses hardcoded credentials in installation script, which could result in database access](https://agentprime.io/advisories/CVE-2026-24840.md) `CVE-2026-24840` · CVE record: Dokploy dokploy · CVSS 8.0 High · Not analysed yet · Published 28 Jan 2026 · Tags: Hard-coded credentials - [Use of well-known default credentials in EZCast Pro II Dongle](https://agentprime.io/advisories/CVE-2026-24346.md) `CVE-2026-24346` · CVE record: EZCast EZCast Pro II · CVSS 7.6 High · Not analysed yet · Published 27 Jan 2026 · Tags: Hard-coded credentials - [Password Confirmation Bypass in Omada Controller](https://agentprime.io/advisories/CVE-2025-9521.md) `CVE-2025-9521` · CVE record: TP-Link Systems Inc. Omada Controller · CVSS 2.1 Low · Not analysed yet · Published 26 Jan 2026 · Tags: Hard-coded credentials - [Static Firmware Encryption Password in dormakaba access manager](https://agentprime.io/advisories/CVE-2025-59107.md) `CVE-2025-59107` · CVE record: dormakaba Access Manager 92xx-k5 · CVSS 8.5 High · Not analysed yet · Published 26 Jan 2026 · Tags: Hard-coded credentials - [Weak Default Passwords for SSH Access in dormakaba access manager](https://agentprime.io/advisories/CVE-2025-59103.md) `CVE-2025-59103` · CVE record: dormakaba Access Manager 92xx-k5 · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Jan 2026 · Tags: Hard-coded credentials - [Weak Default Password in dormakaba Kaba exos 9300](https://agentprime.io/advisories/CVE-2025-59096.md) `CVE-2025-59096` · CVE record: dormakaba Kaba exos 9300 · CVSS 4.6 Medium · Not analysed yet · Published 26 Jan 2026 · Tags: Hard-coded credentials - [Hard-coded Key for PIN Encryption in dormakaba Kaba exos 9300](https://agentprime.io/advisories/CVE-2025-59095.md) `CVE-2025-59095` · CVE record: dormakaba Kaba exos 9300 · CVSS 6.8 Medium · Not analysed yet · Published 26 Jan 2026 · Tags: Hard-coded credentials - [Unauthenticated RPC Service in dormakaba Kaba exos 9300](https://agentprime.io/advisories/CVE-2025-59092.md) `CVE-2025-59092` · CVE record: dormakaba Kaba exos 9300 · CVSS 8.7 High · Not analysed yet · Published 26 Jan 2026 · Tags: Hard-coded credentials - [Hardcoded Legacy Accounts Allowing Control Over Access Managers in dormakaba Kaba exos 9300](https://agentprime.io/advisories/CVE-2025-59091.md) `CVE-2025-59091` · CVE record: dormakaba Kaba exos 9300 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Jan 2026 · Tags: Hard-coded credentials - [Beetel 777VR1 UART weak password](https://agentprime.io/advisories/CVE-2026-1408.md) `CVE-2026-1408` · CVE record: Beetel 777VR1 · CVSS 1.0 Low · Not analysed yet · Published 25 Jan 2026 · Tags: Hard-coded credentials - [Hard-coded cryptographic key in Salesforce Marketing Cloud Engagement](https://agentprime.io/advisories/CVE-2026-22586.md) `CVE-2026-22586` · CVE record: Salesforce Marketing Cloud Engagement · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Jan 2026 · Tags: Hard-coded credentials - [Typebot affected by Credential Theft via Client-Side Script Execution and API Authorization Bypass](https://agentprime.io/advisories/GHSA-4xc5-wfwc-jw47.md) `GHSA-4xc5-wfwc-jw47`, `CVE-2025-65098` · npm `@typebot.io/js`: affected `<0.9.15`, fixed in `0.9.15` · CVSS 7.4 High · Not analysed yet · Published 22 Jan 2026 · Tags: Cross-site scripting (XSS), Information disclosure, Broken access control, Weak cryptography or TLS - [DataEase Vulnerable to Brute-Force Attack on Admin JWT Secret Derived from Password that Enables Full Account Takeover](https://agentprime.io/advisories/CVE-2026-23958.md) `CVE-2026-23958` · CVE record: dataease dataease · CVSS 8.8 High · Not analysed yet · Published 22 Jan 2026 · Tags: Hard-coded credentials - [Claude Code Leaks Data via Malicious Environment Configuration Before Trust Confirmation](https://agentprime.io/advisories/GHSA-jh7p-qr78-84p7.md) `GHSA-jh7p-qr78-84p7`, `CVE-2026-21852` · npm `@anthropic-ai/claude-code`: affected `<2.0.65`, fixed in `2.0.65` · CVSS 5.3 Medium · EPSS 0.28 · Not analysed yet · Published 21 Jan 2026 · Tags: Hard-coded credentials - [Hard-Coded Default Credentials Enable Document Archive Decryption in Milner ImageDirector Capture](https://agentprime.io/advisories/CVE-2025-58744.md) `CVE-2025-58744` · CVE record: Milner ImageDirector Capture · CVSS 6.9 Medium · Not analysed yet · Published 20 Jan 2026 · Tags: Hard-coded credentials, CWE-1392 - [Insufficient Configuration Protections Enable Database Credential Interception in Milner ImageDirector Capture](https://agentprime.io/advisories/CVE-2025-58742.md) `CVE-2025-58742` · CVE record: Milner ImageDirector Capture · CVSS 8.5 High · Not analysed yet · Published 20 Jan 2026 · Tags: Hard-coded credentials, CWE-923 - [Insecure Masked Credential Fields Enable Database Credential Access in Milner ImageDirector Capture](https://agentprime.io/advisories/CVE-2025-58741.md) `CVE-2025-58741` · CVE record: Milner ImageDirector Capture · CVSS 8.5 High · Not analysed yet · Published 20 Jan 2026 · Tags: Hard-coded credentials - [Hardcoded Encryption Key Enables Database Credential Access in Milner ImageDirector Capture](https://agentprime.io/advisories/CVE-2025-58740.md) `CVE-2025-58740` · CVE record: Milner ImageDirector Capture · CVSS 8.5 High · Not analysed yet · Published 20 Jan 2026 · Tags: Hard-coded credentials - [IBM Sterling Connect:Direct for UNIX Container is affected by vulnerability where hard-coded credentials are embeeded in the product for its internal use.](https://agentprime.io/advisories/CVE-2025-14115.md) `CVE-2025-14115` · CVE record: IBM Sterling Connect:Direct for UNIX Container · CVSS 8.4 High · Not analysed yet · Published 20 Jan 2026 · Tags: Hard-coded credentials - [BROWAN COMMUNICATIONS ｜PrismX MX100 AP controller - Insufficiently Protected Credentials](https://agentprime.io/advisories/CVE-2026-1223.md) `CVE-2026-1223` · CVE record: BROWAN COMMUNICATIONS PrismX MX100 AP controller · CVSS 6.9 Medium · Not analysed yet · Published 20 Jan 2026 · Tags: Hard-coded credentials - [BROWAN COMMUNICATIONS ｜PrismX MX100 AP controller - Use of Hard-coded Credentials](https://agentprime.io/advisories/CVE-2026-1221.md) `CVE-2026-1221` · CVE record: BROWAN COMMUNICATIONS PrismX MX100 AP controller · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Jan 2026 · Tags: Hard-coded credentials - [HCL AION is affected by a Weak Password Policy vulnerability](https://agentprime.io/advisories/CVE-2025-55252.md) `CVE-2025-55252` · CVE record: HCL Software AION · CVSS 3.1 Low · Not analysed yet · Published 19 Jan 2026 · Tags: Hard-coded credentials - [DIAView - Authentication Bypass Vulnerability](https://agentprime.io/advisories/CVE-2025-62581.md) `CVE-2025-62581` · CVE record: Delta Electronics DIAView · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Jan 2026 · Tags: Hard-coded credentials - [MTPutty 1.0.1.21 - SSH Password Disclosure](https://agentprime.io/advisories/CVE-2021-47759.md) `CVE-2021-47759` · CVE record: Ttyplus MTPutty · CVSS 6.8 Medium · Not analysed yet · Published 15 Jan 2026 · Tags: Hard-coded credentials - [Hard-coded credentials in SICK AG TDC-X401GL](https://agentprime.io/advisories/CVE-2026-22911.md) `CVE-2026-22911` · CVE record: SICK AG TDC-X401GL · CVSS 5.3 Medium · Not analysed yet · Published 15 Jan 2026 · Tags: Hard-coded credentials - [Weak credentials in SICK AG TDC-X401GL](https://agentprime.io/advisories/CVE-2026-22910.md) `CVE-2026-22910` · CVE record: SICK AG TDC-X401GL · CVSS 7.5 High · Not analysed yet · Published 15 Jan 2026 · Tags: Hard-coded credentials - [Plaintext Passwords Vulnerability in BLUVOYIX](https://agentprime.io/advisories/CVE-2026-22240.md) `CVE-2026-22240` · CVE record: Bluspark Global BLUVOYIX · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Jan 2026 · Tags: Information disclosure, Hard-coded credentials - [Weak password requirements in Huawei HarmonyOS and others](https://agentprime.io/advisories/CVE-2025-68963.md) `CVE-2025-68963` · CVE record: Huawei HarmonyOS and 1 more · CVSS 5.7 Medium · Not analysed yet · Published 14 Jan 2026 · Tags: Hard-coded credentials - [Covenant 0.5 - Remote Code Execution (RCE)](https://agentprime.io/advisories/CVE-2020-36911.md) `CVE-2020-36911` · CVE record: Cobbr Covenant · CVSS 9.3 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.12 · Not analysed yet · Published 13 Jan 2026 · Tags: Hard-coded credentials - [fabricators Ltd Vanilla OS 2 Core image v1.1.0 was discovered to contain static keys for the SSH service, allowing attackers to possibly execute a man-in-the-middle attack during connections with oth…](https://agentprime.io/advisories/CVE-2024-54855.md) `CVE-2024-54855` · CVE record · CVSS 6.4 Medium · Not analysed yet · Published 13 Jan 2026 · Tags: Hard-coded credentials - [SQLE's JWT Secret Handler can be manipulated to use hard-coded cryptographic key in github.com/actiontech/sqle](https://agentprime.io/advisories/GHSA-43h9-hc38-qph5.md) `GHSA-43h9-hc38-qph5`, `CVE-2025-15107`, `GO-2025-4269` · Go `github.com/actiontech/sqle`: affected `*`, no fixed version yet · CVSS 6.3 Medium · Not analysed yet · Published 12 Jan 2026 · Tags: Hard-coded credentials, CWE-320 - [Spectrum basic authentication in use](https://agentprime.io/advisories/CVE-2025-69271.md) `CVE-2025-69271` · CVE record: Broadcom DX NetOps Spectrum · CVSS 2.3 Low · Not analysed yet · Published 12 Jan 2026 · Tags: Hard-coded credentials - [An issue in Automai Director v.25.2.0 allows a remote attacker to escalate privileges and obtain sensitive information via a crafted js file](https://agentprime.io/advisories/CVE-2025-46067.md) `CVE-2025-46067` · CVE record · CVSS 8.2 High · Not analysed yet · Published 12 Jan 2026 · Tags: Hard-coded credentials - [Ruckus vRIoT IoT Controller < 3.0.0.0 Hardcoded SSH Credentials RCE](https://agentprime.io/advisories/CVE-2025-69426.md) `CVE-2025-69426` · CVE record: RUCKUS Networks vRIoT IOT Controller · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Jan 2026 · Tags: Broken access control, Hard-coded credentials - [Ruckus vRIoT IoT Controller < 3.0.0.0 Hardcoded Tokens RCE](https://agentprime.io/advisories/CVE-2025-69425.md) `CVE-2025-69425` · CVE record: RUCKUS Networks vRIoT IoT Controller · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Jan 2026 · Tags: Authentication bypass, Hard-coded credentials - [Hardcoded credentials in KAON CG3000T/CG3000CT routers](https://agentprime.io/advisories/CVE-2025-7072.md) `CVE-2025-7072` · CVE record: KAON CG3000T and 1 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Jan 2026 · Tags: Hard-coded credentials - [bearer token leak on cross-protocol redirect](https://agentprime.io/advisories/CVE-2025-14524.md) `CVE-2025-14524` · CVE record: curl curl · CVSS 5.3 Medium · Not analysed yet · Published 8 Jan 2026 · Tags: Hard-coded credentials - [KAYSUS KS-WR3600 routers with firmware 1.0.5.9.1 enable the SSH service enabled by default on the LAN interface.](https://agentprime.io/advisories/CVE-2025-68716.md) `CVE-2025-68716` · CVE record · CVSS 8.4 High · Not analysed yet · Published 8 Jan 2026 · Tags: Broken access control, Authentication bypass, Hard-coded credentials - [INIM Electronics Smartliving SmartLAN/G/SI <=6.x Hard-coded Credentials Vulnerability](https://agentprime.io/advisories/CVE-2019-25291.md) `CVE-2019-25291` · CVE record: INIM Electronics s.r.l. Smartliving SmartLAN/G/SI · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Jan 2026 · Tags: Hard-coded credentials - [FLIR Thermal Camera F/FC/PT/D firmware version 8.0.0.64 Hard-Coded SSH Credentials Vulnerability](https://agentprime.io/advisories/CVE-2017-20214.md) `CVE-2017-20214` · CVE record: FLIR Systems, Inc. FLIR Thermal Camera F/FC/PT/D · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Jan 2026 · Tags: Hard-coded credentials - [HCL DevOps Deploy is susceptible to insufficiently protected credentials](https://agentprime.io/advisories/CVE-2025-62327.md) `CVE-2025-62327` · CVE record: HCLSoftware DevOps Deploy · CVSS 4.9 Medium · Not analysed yet · Published 7 Jan 2026 · Tags: Hard-coded credentials - [Adtec Digital SignEdje Digital Signage Player v2.08.28 Default Credentials](https://agentprime.io/advisories/CVE-2020-36915.md) `CVE-2020-36915` · CVE record: Adtecdigital SignEdje Digital Signage Player and 4 more · CVSS 8.7 High · Not analysed yet · Published 6 Jan 2026 · Tags: Hard-coded credentials, CWE-1392 Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .