Hard-coded credentials.

BridgeHead FileStore < 24A Apache Axis2 Default Credentials RCE

• BridgeHead Software FileStore
• Hard-coded credentials
• CWE-1188

SenseLive X3050 Insufficiently Protected Credentials

• SenseLive X3050
• Hard-coded credentials

SenseLive X3050 Use of Hard-coded Credentials

• SenseLive X3050
• Hard-coded credentials

Tanium addressed an information disclosure vulnerability in Tanium Server.

• Tanium Server
• Hard-coded credentials

Weak Password Policy Vulnerability in Quantum Networks Router QN-I-470

• Quantum Networks Router QN-I-470
• Hard-coded credentials

liangliangyy DjangoBlog File Upload Endpoint settings.py hard-coded key

• liangliangyy DjangoBlog
• Hard-coded credentials
• CWE-320

liangliangyy DjangoBlog Setting settings.py hard-coded credentials

• liangliangyy DjangoBlog
• Hard-coded credentials

Hard-coded cryptographic key in silex technology, Inc. SD-330AC and others

• silex technology, Inc. SD-330AC
• silex technology, Inc. AMC Manager
• Hard-coded credentials

liangliangyy DjangoBlog Amap API Call views.py hard-coded key

• liangliangyy DjangoBlog
• Hard-coded credentials
• CWE-320

liangliangyy DjangoBlog Setting settings.py hard-coded credentials

• liangliangyy DjangoBlog
• Hard-coded credentials

osuuu LightPicture API Upload Endpoint lp.sql hard-coded credentials

• osuuu LightPicture
• Hard-coded credentials

go-git: Credential leak via cross-host redirect in smart HTTP transport

• Hard-coded credentials

<5.18.0 · fixed in 5.18.0

Anviz CX7 Firmware Use of Hard-coded Cryptographic Key

• Anviz CX7 Firmware
• Hard-coded credentials

Horner Automation Cscape and XL4, XL7 PLC Weak password requirements

• Horner Automation Cscape
• Horner Automation XL7 PLC
• Hard-coded credentials

Sparx Enterprise Architect Client reveals plaintext OAuth2 client secret

• Sparx Systems Pty Ltd. Sparx Enterprise Architect
• Hard-coded credentials

Insufficiently protected credentials in Dell PowerProtect Data Domain BoostFS

• Dell PowerProtect Data Domain BoostFS
• Hard-coded credentials

Weak credentials in Dell PowerProtect Data Domain

• Dell PowerProtect Data Domain
• Hard-coded credentials

Flowise: Sensitive Data Leak in public-chatbotConfig

• Information disclosure
• Hard-coded credentials

<3.1.0 · fixed in 3.1.0

Kyverno apiCall automatically forwards ServiceAccount token to external endpoints (credential leak)

• Information disclosure
• Hard-coded credentials

<1.17.0 · fixed in 1.17.0

Flowise: Weak Default Token Hash Secret

• Hard-coded credentials

<3.1.0 · fixed in 3.1.0

Flowise: Weak Default Express Session Secret

• Hard-coded credentials

<3.1.0 · fixed in 3.1.0

Flowise: Weak Default JWT Secrets

• Hard-coded credentials
• Weak cryptography or TLS

<3.1.0 · fixed in 3.1.0

Dgraph: Unauthenticated /debug/pprof/cmdline discloses admin auth token, enabling unauthorized access to protected Alpha admin endpoints

• Information disclosure
• Hard-coded credentials

<=1.2.8 · no fixed version yet

KnowledgeDeliver deployments before February 24, 2026 use a static ASP.NET/IIS machineKey value

• Digital Knowledge KnowledgeDeliver
• Hard-coded credentials
• Insecure deserialization

Sparx Enterprise Architect Client does not verify the receiver of OAuth2 credentials during OpenID authentication

• Sparx Systems Pty Ltd. Sparx Enterprise Architect
• Hard-coded credentials

Nexus Repository 3 - Hardcoded Credential in Internal Database Component

• Sonatype Nexus Repository
• Hard-coded credentials

Azure Logic Apps Elevation of Privilege Vulnerability

• Microsoft Azure Logic Apps
• Hard-coded credentials

Hard-coded cryptographic key in Fortinet FortiClientEMS

• Fortinet FortiClientEMS
• Hard-coded credentials

Insufficiently protected credentials in Fortinet FortiSandbox and others

• Fortinet FortiSandbox
• Fortinet FortiSandbox PaaS
• Hard-coded credentials

Hard-coded credentials in Schneider Electric Easergy MiCOM P14x and others

• Schneider Electric Easergy MiCOM P14x
• Schneider Electric Easergy MiCOM P24x
• Hard-coded credentials

Information Disclosure Vulnerability in SAP HANA Cockpit and HANA Database Explorer

• SAP_SE SAP HANA Cockpit and HANA Database Explorer
• Hard-coded credentials

An issue was discovered in BMC Control-M/MFT 9.0.20 through 9.0.22.

• Hard-coded credentials

CTP OS: Configuring password requirements does not work which permits the use of weak passwords

• Juniper Networks CTP OS
• Hard-coded credentials

Apache OpenMeetings Uses Hard-coded Cryptographic Key

• Hard-coded credentials

>=6.1.0, <9.0.0 · fixed in 9.0.0

Hard-coded password in Siklu EtherHaul 8010

• Siklu EtherHaul 8010
• Hard-coded credentials

HAX CMS's public /server-status endpoint exposes authentication tokens, user activity, and client IP addresses

• haxtheweb HAXiam
• Broken access control
• Hard-coded credentials

hcengineering Huly Platform JWT Token token.ts hard-coded key

• hcengineering Huly Platform
• Hard-coded credentials
• CWE-320

Tenda AC10 RSA 2048-bit Private Key privkeySrv.pem hard-coded key

• Tenda AC10
• Hard-coded credentials
• CWE-320

Tenda 4G03 Pro ECDSA P-256 Private Key server.key hard-coded key

• Tenda 4G03 Pro
• Hard-coded credentials
• CWE-320

Text to Speech (TTS) by Mementor <= 1.9.8 - Use of Hardcoded Password to Unauthenticated Remote Database Access

• mvirik Text to Speech – TTSWP
• Hard-coded credentials

GarrettCom Magnum 6K and 10K Authentication Bypass via Hardcoded String

• Belden GarrettCom Magnum 6K and 10K Managed Switches
• Hard-coded credentials

Hirschmann HiLCOS Hard-coded Credentials SSH SSL Keys

• Belden Hirschmann HiLCOS
• Hard-coded credentials

Gardyn Mobile Application and Device Firmware Use Hard-coded Credentials

• Gardyn Mobile Application
• Gardyn Cloud API
• Hard-coded credentials

Investory Toy Planet Trouble App app.investory.toyfactory google-services-desktop.json hard-coded key

• Investory Toy Planet Trouble App
• Hard-coded credentials
• CWE-320

Wahoo Fitness SYSTM App com.WahooFitness.SYSTM BuildConfig.java hard-coded key

• Wahoo Fitness SYSTM App
• Hard-coded credentials
• CWE-320

Noelse Individuals & Pro App com.afone.noelse BuildConfig.java hard-coded key

• Noelse Individuals & Pro App
• Hard-coded credentials
• CWE-320

PropertyGuru AgentNet Singapore App com.allproperty.android.agentnet BuildConfig.java hard-coded key

• PropertyGuru AgentNet Singapore App
• Hard-coded credentials
• CWE-320

Align Technology My Invisalign App com.aligntech.myinvisalign.emea BuildConfig.java hard-coded key

• Align Technology My Invisalign App
• Hard-coded credentials
• CWE-320

Dialogue App ca.diagram.dialogue config.json hard-coded key

• Dialogue App
• Hard-coded credentials
• CWE-320

GRID Organiser App co.gridapp.organiser app.json hard-coded key

• GRID Organiser App
• Hard-coded credentials
• CWE-320

Rico só vantagem pra investir App br.com.rico.mobile SegmentSettingsModule.java hard-coded key

• Rico só vantagem pra investir App
• Hard-coded credentials
• CWE-320

OpenClaw: Media download follows cross-origin redirects with Authorization headers intact

• Hard-coded credentials

<2026.3.31 · fixed in 2026.3.31

UCC CampusConnect App campusconnect.ucc BuildConfig.java hard-coded key

• UCC CampusConnect App
• Hard-coded credentials
• CWE-320

Private Key stored as extractable in browser IndexeDB

• CERT/CC cveClient/encrypt-storage.js
• Hard-coded credentials

Shinrays Games Goods Triple App cats.goods.sort.sorting.games jRwTX.java hard-coded key

• Shinrays Games Goods Triple App
• Hard-coded credentials
• CWE-320

Enter Software Iperius Backup IperiusAccounts.ini hard-coded key

• Enter Software Iperius Backup
• Hard-coded credentials
• CWE-320

Credential Exposure vulnerability in MEPIS RM

• Metronik d.o.o. MEPIS RM
• Hard-coded credentials

Nautobot: Management of users via REST API does not apply configured password validators

• Hard-coded credentials

<2.4.30 || >=3.0.0, <3.0.10 · fixed in 2.4.30, 3.0.10

Search Guard audit logs can contain under certain conditions user credentials

• floragunn Search Guard FLX
• Hard-coded credentials
• Information disclosure

FHIR Validator HTTP service has SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token Theft

• Hard-coded credentials
• Information disclosure

<6.9.4 · fixed in 6.9.4