Hard-coded credentials.

VPS.org one-click Zulip template deployment instance contains multiple vulnerabilities

• VPS.org Zulip template
• Hard-coded credentials
• CWE-1188

HCL iControl is affected by multiple security vulnerabilities.

• HCL Software HCL iControl
• Hard-coded credentials

Use of hard-coded VNC credentials in the engineering-workstation provisioning

• ANDRITZ HIPASE-250
• ANDRITZ 250 SCALA
• Hard-coded credentials
• CWE-1392

Rich Source｜DMS+ (Non-Mobile) - Use of Hard-coded Credentials

• Rich Source DMS+ (Non-Mobile)
• Hard-coded credentials

Hard-coded Cryptographic Key in Watchfire Controllers

• Watchfire BC550
• Watchfire BC750
• Hard-coded credentials

CVE-2026-15977

• SGLang
• Hard-coded credentials

foreUP customer REST API allows authenticated users to read cleartext payment-processor merchant credentials

• foreUP
• Hard-coded credentials

Flyto2 Core: Unauthenticated flyto-verification /run: callback_url SSRF and internal runner-secret exfiltration

• Authentication bypass
• Hard-coded credentials

>=2.26.6, <2.26.7 · fixed in 2.26.7

Flyto2 Core: LLM/API keys leak to an attacker-controlled base_url

• Information disclosure
• Hard-coded credentials

<2.26.7 · fixed in 2.26.7

Flyto2 Core: ${env.VAR} interpolation reads any env secret despite env.get being denylisted

• Hard-coded credentials
• Information disclosure

<2.26.7 · fixed in 2.26.7

CentreStack < 17.5 Hardcoded Key Token Forgery RCE

• Gladinet CentreStack
• Hard-coded credentials

Outstatic CMS <= 2.1.9 contains a hardcoded JWT signing secret.

• Hard-coded credentials

Insufficiently Protected Credentials in GitLab

• GitLab
• Hard-coded credentials

Cisco Secure Firewall Management Center Software Static Credential Vulnerability

• Cisco Secure Firewall Management Center (FMC)
• Hard-coded credentials

swagger-typescript-api vulnerable to authorization-token exfiltration via spec `$ref`

• Information disclosure
• Hard-coded credentials

<13.12.2 · fixed in 13.12.2

Insufficiently protected credentials in Schneider Electric EcoStruxure™ Cybersecurity Admin Expert

• Schneider Electric EcoStruxure™ Cybersecurity Admin Expert
• Hard-coded credentials

Hard-coded AWS IAM credentials vulnerability

• Three Learning Koollab LMS
• Hard-coded credentials

Due to use of IBM Storage Protect, IBM Cloud Pak System is affected by vulnerability []

• IBM Cloud Pak System
• Hard-coded credentials

Hardcoded Credential Vulnerability in Multiple TP-Link Router Models

• TP-Link Systems Inc. TL-WR850N v3
• TP-Link Systems Inc. Archer C20 v6
• Hard-coded credentials

Insufficiently protected credentials in Devolutions Server

• Devolutions Server
• Hard-coded credentials

Use of Hard-coded Credentials Vulnerability

• Ericsson Packet Core Controller (PCC)
• Hard-coded credentials

Joomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wide secret in SP Page Builder < 6.7.1

• joomshaper.com SP Page Builder extension for Joomla
• Hard-coded credentials

An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273.

• Hard-coded credentials

An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273.

• Hard-coded credentials

An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273.

• Hard-coded credentials

Loytec LINX firmware: Improper Authentication in PAM configuration

• Loytec LIP-ME20xC
• Loytec L-INX
• Authentication bypass
• Hard-coded credentials

Insufficiently protected credentials in OpenStack Ironic Python Agent

• OpenStack Ironic Python Agent
• Hard-coded credentials

n8n: Shared Credential Header Leak via HTTP Request Pagination Expression

• Information disclosure
• Hard-coded credentials

<1.123.61 || >=2.0.0-rc.0, <2.27.4 || >=2.28.0, <2.28.1 · fixed in 1.123.61, 2.27.4, 2.28.1

Unauthenticated File Read and Deletion via Hardcoded Encryption Key in RadChart

• Progress Software Telerik UI for ASP.NET AJAX
• Hard-coded credentials

RadAsyncUpload Default HMAC Key Fallback Vulnerability in Telerik UI for ASP.NET AJAX

• Progress Software Telerik UI for ASP.NET AJAX
• Hard-coded credentials

Backdoor Authentication Token

• Autel MaxiCharger Single
• Hard-coded credentials

Hard-coded / Backdoor Accounts

• Autel MaxiCharger Single
• Hard-coded credentials

Credential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registry

• Hard-coded credentials

<0.7.1 · fixed in 0.7.1

HCL MyCloud affected by Weak Password Policy

• HCLSoftware MyCloud
• Hard-coded credentials

File Browser: Share API exposes the password hash and bypass token

• Information disclosure
• Hard-coded credentials

<2.63.17 · fixed in 2.63.17

LightRAG is Vulnerable to Authentication Bypass: hardcoded DEFAULT_TOKEN_SECRET and public /auth-status defeat LIGHTRAG_API_KEY protection

• Authentication bypass
• Hard-coded credentials

<1.5.4 · fixed in 1.5.4

Guzzle: Proxy-Authorization headers can be sent to origin servers

• Information disclosure
• Hard-coded credentials

<7.14.2 · fixed in 7.14.2

Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints

• IBM Langflow OSS
• Hard-coded credentials

Keycloak-services: keycloak-services: authenticator config endpoint exposes raw recaptcha secrets to view-only admins

• Red Hat build of Keycloak 26.6
• Red Hat build of Keycloak 26.6.7
• Hard-coded credentials
• CWE-212

clawvet < 0.7.5 Hard-coded JWT Secret Session Forgery

• MohibShaikh clawvet
• Authentication bypass
• Hard-coded credentials

OpenClaw < 2026.5.28 Bot Framework SSRF via serviceUrl Parameter Validation

• openclaw msteams
• Hard-coded credentials

OpenClaw < 2026.5.27 Token Leakage via MS Teams Outbound Requests

• openclaw msteams
• Hard-coded credentials

Pheditor: Hardcoded default password 'admin' with no forced change enables full application compromise

• Hard-coded credentials

>=2.0.1, <2.0.6 · fixed in 2.0.6

HireFlow: Use of Hard-coded Credentials

• StratonWebDesigners HireFlow
• Hard-coded credentials

An issue in Kerlink Kerlink Wirnet iStation 868 KerOS v.4.3.3_20200803132042 allows a remote attacker to obtain sensitive information via the community string component.

• Information disclosure
• Hard-coded credentials

FastGPT: Unauthenticated cross-tenant data access via forgeable plugin-invoke JWT (default INVOKE_TOKEN_SECRET='token')

• labring FastGPT
• Hard-coded credentials

Credential exposure in ICU Scandinavia Boomerang

• ICU Scandinavia Boomerang
• Hard-coded credentials

Hardcoded Cryptographic Key Information Disclosure Vulnerability on TP-Link Kasa EC70 and EC71

• TP-Link Systems Inc. Kasa EC71 v4
• TP-Link Systems Inc. Kasa EC70 v4
• Hard-coded credentials

CAI Content Credentials | Insufficiently Protected Credentials (CWE-522)

• Adobe Content Credentials Rust SDK
• Adobe Content Credentials Command-Line Tool
• Hard-coded credentials

nebula-mesh: Operator session tokens stored in plaintext in the database

• Information disclosure
• Hard-coded credentials

<0.3.8 · fixed in 0.3.8

GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability

• Microsoft Visual Studio Code
• Information disclosure
• Hard-coded credentials

Excon does not redact additional sensitive/risky headers when following redirects

• Information disclosure
• Hard-coded credentials

<1.5.0 · fixed in 1.5.0

Insufficiently Protected Credentials in GitLab

• GitLab
• Hard-coded credentials

Insufficiently protected credentials in Webpros Plesk

• Webpros Plesk
• Hard-coded credentials

DataEase: Hardcoded JWT Signing Secret in ShareLink

• dataease
• Hard-coded credentials

HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets

• HAARG HTTP::Tiny
• Hard-coded credentials

Trueview Security camera T18161- AF v4.9.60.0 contains an authentication bypass vulnerability caused by improper password validation and the presence of hard-coded credentials in the firmware.

• Authentication bypass
• Hard-coded credentials

9router has unauthenticated CRUD on /api/providers and Full API Key Leak via /api/usage/stats

• Information disclosure
• Authentication bypass

<=0.4.41 · no fixed version yet

Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps

• Hard-coded credentials
• Open redirect

<2.29.17 || >=2.30.0, <2.32.7 || >=2.33.0, <2.33.8 || >=2.34.0, <2.34.2 · fixed in 2.29.17, 2.32.7, 2.33.8, 2.34.2

uniFLOW Universal Login Manager (ULM) Standalone Improper Protection of Sensitive Information Leads to Information Disclosure

• NT-ware uniFLOW ULM (Universal Login Manager) Standalone
• Hard-coded credentials