# Hard-coded credentials. Passwords and keys built into the code, or weak credentials. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [FUXA has a hardcoded fallback JWT signing secret](https://agentprime.io/advisories/GHSA-c8m8-3jcr-6rj5.md) `GHSA-c8m8-3jcr-6rj5`, `CVE-2025-69971` · npm `@frangoteam/fuxa`: affected `<1.3.0`, fixed in `1.3.0` · CVSS 8.1 High · Not analysed yet · Published 7 Mar 2026 · Tags: Hard-coded credentials - [Everon api.everon.io Insufficiently Protected Credentials](https://agentprime.io/advisories/CVE-2026-27027.md) `CVE-2026-27027` · CVE record: Everon api.everon.io · CVSS 6.9 Medium · Not analysed yet · Published 6 Mar 2026 · Tags: Hard-coded credentials - [Mobiliti e-mobi.hu Insufficiently Protected Credentials](https://agentprime.io/advisories/CVE-2026-27777.md) `CVE-2026-27777` · CVE record: Mobiliti e-mobi.hu · CVSS 6.9 Medium · Not analysed yet · Published 6 Mar 2026 · Tags: Hard-coded credentials - [Insufficiently protected credentials in Acronis Cyber Protect 17](https://agentprime.io/advisories/CVE-2026-28714.md) `CVE-2026-28714` · CVE record: Acronis Acronis Cyber Protect 17 · CVSS 4.8 Medium · Not analysed yet · Published 5 Mar 2026 · Tags: Hard-coded credentials - [ePower epower.ie Insufficiently Protected Credentials](https://agentprime.io/advisories/CVE-2026-27770.md) `CVE-2026-27770` · CVE record: ePower epower.ie · CVSS 6.9 Medium · Not analysed yet · Published 5 Mar 2026 · Tags: Hard-coded credentials - [RustDesk Client Transmits Preset Address Book Password Verbatim in Heartbeat Sync](https://agentprime.io/advisories/CVE-2026-30796.md) `CVE-2026-30796` · CVE record: rustdesk-client RustDesk Client · CVSS 6.9 Medium · Not analysed yet · Published 5 Mar 2026 · Tags: Hard-coded credentials - [IDC SFX2100 Satellite Receiver bgpd/ospfd/ripd/zebra Config Credential Disclosure via World-Readable Files](https://agentprime.io/advisories/CVE-2026-29128.md) `CVE-2026-29128` · CVE record: International Datacasting Corporation SFX2100 Satellite Receiver · CVSS 8.6 High · Not analysed yet · Published 5 Mar 2026 · Tags: Hard-coded credentials - [Insecure, Hardcoded Root Password Stored in Anaconda Configuration File On IDC SFX2100 Satellite Receiver](https://agentprime.io/advisories/CVE-2026-29120.md) `CVE-2026-29120` · CVE record: International Datacasting Corporation IDC SFX2100 SuperFlex Satellite Receiver · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Mar 2026 · Tags: Hard-coded credentials - [Hardcoded and Insecure Credentials for "Admin" Account providing Telnet Access on IDC SFX2100 Satellite Receiver](https://agentprime.io/advisories/CVE-2026-29119.md) `CVE-2026-29119` · CVE record: International Datacasting Corporation (IDC) SFX2100 Series SuperFlex SatelliteReceiver · CVSS 8.8 High · Not analysed yet · Published 4 Mar 2026 · Tags: Hard-coded credentials - [Hardcoded FTP Credentials and LPE(via Insecure Permissions) for \`xd\` Local Account on IDC SFX2100](https://agentprime.io/advisories/CVE-2026-28778.md) `CVE-2026-28778` · CVE record: International Datacasting Corporation (IDC) IDC SFX2100 SuperFlex Satellite Receiver · CVSS 7.9 High · Not analysed yet · Published 4 Mar 2026 · Tags: Hard-coded credentials - [Hardcoded and Insecure Credentials for "User" Local Account with SSH Access On IDC SFX2100 Satellite Receiver](https://agentprime.io/advisories/CVE-2026-28777.md) `CVE-2026-28777` · CVE record: International Datacasting Corporation (IDC) SFX2100 Satellite Receiver · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Mar 2026 · Tags: Hard-coded credentials - [Hardcoded and Insecure Credentials for "monitor" account with SSH Access On IDC SFX2100 Satellite Receiver](https://agentprime.io/advisories/CVE-2026-28776.md) `CVE-2026-28776` · CVE record: International Datacasting Corporation (IDC) IDC SFX2100 SuperFlex Satellite Receiver · CVSS 7.8 High · Not analysed yet · Published 4 Mar 2026 · Tags: Hard-coded credentials - [OpenClaw reuses the gateway auth token in the owner ID prompt hashing fallback](https://agentprime.io/advisories/GHSA-v6x2-2qvm-6gv8.md) `GHSA-v6x2-2qvm-6gv8`, `CVE-2026-32897` · npm `openclaw`: affected `<2026.2.22`, fixed in `2026.2.22` · CVSS 6.3 Medium · Not analysed yet · Published 3 Mar 2026 · Tags: Hard-coded credentials, CWE-320 - [IBM WebSphere Application Server Liberty could provide weaker than expected security](https://agentprime.io/advisories/CVE-2025-14923.md) `CVE-2025-14923` · CVE record: IBM WebSphere Application Server - Liberty · CVSS 4.7 Medium · Not analysed yet · Published 3 Mar 2026 · Tags: Hard-coded credentials - [Rancher doesn't properly sanitize credentials in cluster template answers](https://agentprime.io/advisories/GHSA-8w87-58w6-hfv8.md) `GHSA-8w87-58w6-hfv8`, `CVE-2021-36783` · Go `github.com/rancher/rancher`: affected `>=2.5.0, <2.5.13 || >=2.6.0, <2.6.4`, fixed in `2.5.13`, `2.6.4` · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Mar 2026 · Tags: Information disclosure, Hard-coded credentials - [Weak credentials in Eclipse Foundation Eclipse OpenMQ](https://agentprime.io/advisories/CVE-2026-22886.md) `CVE-2026-22886` · CVE record: Eclipse Foundation Eclipse OpenMQ · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Mar 2026 · Tags: Hard-coded credentials, CWE-1392, CWE-1393 - [SIP Service Providers – Possible Impersonation of Poly Voice Device](https://agentprime.io/advisories/CVE-2026-0754.md) `CVE-2026-0754` · CVE record: HP Inc VVX and 2 more · CVSS 8.2 High · Not analysed yet · Published 3 Mar 2026 · Tags: Hard-coded credentials - [Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 was discovered to stroe credentials in plaintext in the component uac_temp.db.](https://agentprime.io/advisories/CVE-2024-55027.md) `CVE-2024-55027` · CVE record · CVSS 7.5 High · Not analysed yet · Published 3 Mar 2026 · Tags: Hard-coded credentials - [Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 was discovered to contain a hardcoded encryption key which could allow attackers to access sensitive information.](https://agentprime.io/advisories/CVE-2024-55023.md) `CVE-2024-55023` · CVE record · CVSS 5.3 Medium · Not analysed yet · Published 3 Mar 2026 · Tags: Hard-coded credentials - [XIQ‑SE NAC Admin Credential Exposure via HTTP Response](https://agentprime.io/advisories/CVE-2026-0689.md) `CVE-2026-0689` · CVE record: Extreme Networks ExtremeCloud IQ - Site Engine · CVSS 6.0 Medium · Not analysed yet · Published 2 Mar 2026 · Tags: Hard-coded credentials - [Insufficiently protected credentials in MediaTek, Inc. MediaTek chipset](https://agentprime.io/advisories/CVE-2026-20435.md) `CVE-2026-20435` · CVE record: MediaTek, Inc. MediaTek chipset · CVSS 4.6 Medium · Not analysed yet · Published 2 Mar 2026 · Tags: Hard-coded credentials - [Gradio: Mocked OAuth Login Exposes Server Credentials and Uses Hardcoded Session Secret](https://agentprime.io/advisories/GHSA-h3h8-3v2v-rg7m.md) `GHSA-h3h8-3v2v-rg7m`, `CVE-2026-27167`, `PYSEC-2026-63` · PyPI `gradio`: affected `>=4.16.0, <6.6.0`, fixed in `6.6.0` · CVSS 0.0 None · Not analysed yet · Published 1 Mar 2026 · Tags: Hard-coded credentials - [Unitree UPK files Hard-Coded Key](https://agentprime.io/advisories/CVE-2026-1442.md) `CVE-2026-1442` · CVE record: Unitree UPK · CVSS 7.8 High · Not analysed yet · Published 27 Feb 2026 · Tags: Hard-coded credentials - [Mobility46 mobility46.se Insufficiently Protected Credentials](https://agentprime.io/advisories/CVE-2026-22878.md) `CVE-2026-22878` · CVE record: Mobility46 mobility46.se · CVSS 6.9 Medium · Not analysed yet · Published 27 Feb 2026 · Tags: Hard-coded credentials - [EV Energy ev.energy Insufficiently Protected Credentials](https://agentprime.io/advisories/CVE-2026-25774.md) `CVE-2026-25774` · CVE record: EV Energy ev.energy · CVSS 6.9 Medium · Not analysed yet · Published 27 Feb 2026 · Tags: Hard-coded credentials - [SWITCH EV swtchenergy.com Insufficiently Protected Credentials](https://agentprime.io/advisories/CVE-2026-27773.md) `CVE-2026-27773` · CVE record: SWITCH EV swtchenergy.com · CVSS 6.9 Medium · Not analysed yet · Published 27 Feb 2026 · Tags: Hard-coded credentials - [EV2GO ev2go.io Insufficiently Protected Credentials](https://agentprime.io/advisories/CVE-2026-22890.md) `CVE-2026-22890` · CVE record: EV2GO ev2go.io · CVSS 6.9 Medium · Not analysed yet · Published 26 Feb 2026 · Tags: Hard-coded credentials - [CloudCharge cloudcharge.se Insufficiently Protected Credentials](https://agentprime.io/advisories/CVE-2026-20733.md) `CVE-2026-20733` · CVE record: CloudCharge cloudcharge.se · CVSS 6.9 Medium · Not analysed yet · Published 26 Feb 2026 · Tags: Hard-coded credentials - [Chargemap chargemap.com Insufficiently Protected Credentials](https://agentprime.io/advisories/CVE-2026-20791.md) `CVE-2026-20791` · CVE record: Chargemap chargemap.com · CVSS 6.9 Medium · Not analysed yet · Published 26 Feb 2026 · Tags: Hard-coded credentials - [Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change](https://agentprime.io/advisories/GHSA-3ccg-x393-96v8.md) `GHSA-3ccg-x393-96v8`, `CVE-2026-27575`, `GO-2026-4551` · Go `code.vikunja.io/api`: affected `<=0.24.6`, no fixed version yet · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Feb 2026 · Tags: Hard-coded credentials, Authentication bypass - [Administrative Credentials Can Be Extracted Through Gardyn API Responses](https://agentprime.io/advisories/CVE-2025-1242.md) `CVE-2025-1242` · CVE record: Gardyn Home Kit and 2 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Feb 2026 · Tags: Hard-coded credentials - [Hard-coded database credentials in Finka software](https://agentprime.io/advisories/CVE-2025-13776.md) `CVE-2025-13776` · CVE record: TIK-SOFT Finka-FK and 4 more · CVSS 8.6 High · Not analysed yet · Published 24 Feb 2026 · Tags: Hard-coded credentials - [Binardat 10G08-0800GSM Network Switch Hard-coded RC4 Encryption Key](https://agentprime.io/advisories/CVE-2026-27519.md) `CVE-2026-27519` · CVE record: Binardat Ltd. 10G08-0800GSM Network Switch · CVSS 8.7 High · Not analysed yet · Published 24 Feb 2026 · Tags: Hard-coded credentials, Weak cryptography or TLS - [Binardat 10G08-0800GSM Network Switch Hard-coded Credentials](https://agentprime.io/advisories/CVE-2026-27507.md) `CVE-2026-27507` · CVE record: Binardat Ltd. 10G08-0800GSM Network Switch · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Feb 2026 · Tags: Hard-coded credentials - [MLflow Use of Default Password Authentication Bypass Vulnerability](https://agentprime.io/advisories/GHSA-gq3w-7jj3-x7gr.md) `GHSA-gq3w-7jj3-x7gr`, `CVE-2026-2635`, `PYSEC-2026-421` · PyPI `mlflow`: affected `<3.8.0rc0`, fixed in `3.8.0rc0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Feb 2026 · Tags: Hard-coded credentials, CWE-1393 - [Jinan USR IOT Technology Limited (PUSR) USR-W610 Insufficiently Protected Credentials](https://agentprime.io/advisories/CVE-2026-26049.md) `CVE-2026-26049` · CVE record: Jinan USR IOT Technology Limited (PUSR) USR-W610 · CVSS 5.7 Medium · Not analysed yet · Published 20 Feb 2026 · Tags: Hard-coded credentials - [Jinan USR IOT Technology Limited (PUSR) USR-W610 Weak Password Requirements](https://agentprime.io/advisories/CVE-2026-25715.md) `CVE-2026-25715` · CVE record: Jinan USR IOT Technology Limited (PUSR) USR-W610 · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Feb 2026 · Tags: Hard-coded credentials - [Beetel 777VR1 WPA2 PSK hard-coded credentials](https://agentprime.io/advisories/CVE-2026-2702.md) `CVE-2026-2702` · CVE record: Beetel 777VR1 · CVSS 2.3 Low · Not analysed yet · Published 19 Feb 2026 · Tags: Hard-coded credentials - [In RUCKUS Network Director (RND) < 4.5.0.56, the OVA appliance contains hardcoded SSH keys for the postgres user.](https://agentprime.io/advisories/CVE-2025-67305.md) `CVE-2025-67305` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Feb 2026 · Tags: Hard-coded credentials - [In Ruckus Network Director (RND) < 4.5.0.54, the OVA appliance contains hardcoded credentials for the ruckus PostgreSQL database user.](https://agentprime.io/advisories/CVE-2025-67304.md) `CVE-2025-67304` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Feb 2026 · Tags: Hard-coded credentials - [OpenClaw: Telegram bot token exposure via logs](https://agentprime.io/advisories/GHSA-chf7-jq6g-qrwv.md) `GHSA-chf7-jq6g-qrwv`, `CVE-2026-27003` · npm `openclaw`: affected `<2026.2.15`, fixed in `2026.2.15` · CVSS 6.9 Medium · Not analysed yet · Published 18 Feb 2026 · Tags: Hard-coded credentials - [Hard-coded credentials in Dell RecoverPoint for Virtual Machines](https://agentprime.io/advisories/CVE-2026-22769.md) `CVE-2026-22769` · CVE record: Dell RecoverPoint for Virtual Machines · CVSS 10.0 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.14 · Not analysed yet · Published 17 Feb 2026 · Tags: Hard-coded credentials - [Multiple Vulnerabilities in IBM Concert Software.](https://agentprime.io/advisories/CVE-2025-33089.md) `CVE-2025-33089` · CVE record: IBM Concert · CVSS 6.5 Medium · Not analysed yet · Published 17 Feb 2026 · Tags: Hard-coded credentials - [Glory RBG-100 Recycler System Hard-coded OS Credentials](https://agentprime.io/advisories/CVE-2026-23647.md) `CVE-2026-23647` · CVE record: Glory Global Solutions RBG-100 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Feb 2026 · Tags: Hard-coded credentials - [Beetel 777VR1 Web Management hard-coded credentials](https://agentprime.io/advisories/CVE-2026-2616.md) `CVE-2026-2616` · CVE record: Beetel 777VR1 · CVSS 8.7 High · Not analysed yet · Published 17 Feb 2026 · Tags: Hard-coded credentials - [Calero VeraSMART < 2026 R1 Hardcoded Static AES Keys Allow Decryption of Service Credentials](https://agentprime.io/advisories/CVE-2026-26334.md) `CVE-2026-26334` · CVE record: Calero VeraSMART · CVSS 8.5 High · Not analysed yet · Published 13 Feb 2026 · Tags: Hard-coded credentials - [Calero VeraSMART < 2022 R1 Static IIS Machine Keys Enable ViewState RCE](https://agentprime.io/advisories/CVE-2026-26335.md) `CVE-2026-26335` · CVE record: Calero VeraSMART · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Feb 2026 · Tags: Hard-coded credentials - [Heatmiser Netmonitor 3.03 - Hardcoded Credentials](https://agentprime.io/advisories/CVE-2019-25322.md) `CVE-2019-25322` · CVE record: Heatmiser Heatmiser Netmonitor · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Feb 2026 · Tags: Hard-coded credentials - [NeuVector scanner insecurely handles passwords as command arguments](https://agentprime.io/advisories/GHSA-3c9m-gq32-g4jx.md) `GHSA-3c9m-gq32-g4jx`, `CVE-2025-67860`, `GO-2026-4490` · Go `github.com/neuvector/scanner`: affected `>=4.0, <4.072`, fixed in `4.072` · CVSS 3.8 Low · Not analysed yet · Published 12 Feb 2026 · Tags: Hard-coded credentials - [newbee-mall Default Seeded Administrator Credentials Allow Account Takeover](https://agentprime.io/advisories/CVE-2026-26218.md) `CVE-2026-26218` · CVE record: newbee-ltd newbee-mall · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Feb 2026 · Tags: Hard-coded credentials - [Hardcoded Key Allows Credential Disclosure](https://agentprime.io/advisories/CVE-2026-22906.md) `CVE-2026-22906` · CVE record: WAGO 0852-1322 and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Feb 2026 · Tags: Hard-coded credentials - [AMSS++ 4.7 - Backdoor Admin Account](https://agentprime.io/advisories/CVE-2020-37135.md) `CVE-2020-37135` · CVE record: Amssplus AMSS++ · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Feb 2026 · Tags: Hard-coded credentials - [3DP-MANAGER Uses Hard-coded Credentials](https://agentprime.io/advisories/CVE-2026-25803.md) `CVE-2026-25803` · CVE record: denpiligrim 3dp-manager · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Feb 2026 · Tags: Hard-coded credentials - [PlaciPy has a Hard-Coded Default Password for All Student Accounts (Account Takeover)](https://agentprime.io/advisories/CVE-2026-25753.md) `CVE-2026-25753` · CVE record: Praskla-Technology assessment-placipy · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Feb 2026 · Tags: Hard-coded credentials - [Use of Hard-Coded Cryptographic Key for Password Storage](https://agentprime.io/advisories/CVE-2026-2103.md) `CVE-2026-2103` · CVE record: Infor SyteLine ERP · CVSS 7.1 High · Not analysed yet · Published 6 Feb 2026 · Tags: Hard-coded credentials - [Insufficiently protected credentials in Moxa UC-1200A Series](https://agentprime.io/advisories/CVE-2026-0715.md) `CVE-2026-0715` · CVE record: Moxa UC-1200A Series · CVSS 7.0 High · Not analysed yet · Published 5 Feb 2026 · Tags: Hard-coded credentials - [YugabyteDB Anywhere Exposes LDAP Credentials in Cleartext in Web UI](https://agentprime.io/advisories/CVE-2026-1966.md) `CVE-2026-1966` · CVE record: YugabyteDB Inc YugabyteDB Anywhere · CVSS 2.4 Low · Not analysed yet · Published 5 Feb 2026 · Tags: Hard-coded credentials - [FUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default Configuration](https://agentprime.io/advisories/GHSA-32cc-x95p-fxcg.md) `GHSA-32cc-x95p-fxcg`, `CVE-2026-25894` · npm `fuxa-server`: affected `<1.2.10`, fixed in `1.2.10` · CVSS 9.5 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Feb 2026 · Tags: Hard-coded credentials, CWE-1188 - [EVE Has Partially Predetermined Vault Key](https://agentprime.io/advisories/GHSA-g7vp-j25f-h34p.md) `GHSA-g7vp-j25f-h34p`, `CVE-2023-43637`, `GO-2026-4436` · Go `github.com/lf-edge/eve`: affected `<0.0.0-20220310190112-c0c966dc31e2`, fixed in `0.0.0-20220310190112-c0c966dc31e2` · CVSS 7.8 High · Not analysed yet · Published 4 Feb 2026 · Tags: Hard-coded credentials - [EVE Seals Vault Key With SHA1 PCRs](https://agentprime.io/advisories/GHSA-4jvr-vj2c-8q37.md) `GHSA-4jvr-vj2c-8q37`, `CVE-2023-43635`, `GO-2026-4434` · Go `github.com/lf-edge/eve`: affected `<0.0.0-20230519072751-977f42b07fa9`, fixed in `0.0.0-20230519072751-977f42b07fa9` · CVSS 8.8 High · Not analysed yet · Published 4 Feb 2026 · Tags: Weak cryptography or TLS, Hard-coded credentials Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .