Hard-coded credentials.

Credential Manager Vulnerability Allows Unauthorized Administrative Access

• Hewlett Packard Enterprise (HPE) AOS-CX
• Hard-coded credentials

pnpm: Environment secrets exfiltrated via env-placeholder expansion in proxy settings read from an untrusted pnpm-workspace.yaml

• Information disclosure
• Weak cryptography or TLS

>=10.7.0, <10.34.5 || >=11.0.0, <11.11.0 · fixed in 10.34.5, 11.11.0

DataEdgePlatform DataMosaix™ Private Cloud

• Rockwell Automation DataEdgePlatform DataMosaix™ Private Cloud
• Hard-coded credentials

MySQL2: Auth Plugin Downgrade to mysql_clear_password Leaks Plaintext Credentials

• Hard-coded credentials

<3.22.0 · fixed in 3.22.0

Hardcoded Credentials in TMT Machine's Talassoft Industrial Management Software

• TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software
• Hard-coded credentials

Inbox Foundry ActiveInbox Extension Google OAuth Client Secret service-worker.production-esm.js hard-coded credentials

• Inbox Foundry ActiveInbox Extension
• Hard-coded credentials

Insecure hardcoded credentials in the Admin account of Tenda HG21 V4.0.0-260302 allows attackers to gain root access.

• Hard-coded credentials

Shinobi before commit 5a76c74f Arbitrary Database Query Execution via Hardcoded Child Node Key

• Shinobi
• Hard-coded credentials

org.mariadb:r2dbc-mariadb vulnerable to cleartext password disclosure to a man-in-the-middle server (clear-text auth plugins not gated on a secure transport)

• Weak cryptography or TLS
• Hard-coded credentials

<1.4.1 · fixed in 1.4.1

org.mariadb.jdbc:mariadb-java-client has Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials

• Weak cryptography or TLS
• Hard-coded credentials

<2.7.14 || >=3.0.0, <3.3.5 || >=3.4.0, <3.4.3 || >=3.5.0, <3.5.9 · fixed in 2.7.14, 3.3.5, 3.4.3, 3.5.9

MariaDB has cleartext password disclosure to a MITM on the initial-handshake

• Hard-coded credentials

<2.7.14 || >=3.0.0, <3.3.5 || >=3.4.0, <3.4.3 || >=3.5.0, <3.5.9 · fixed in 2.7.14, 3.3.5, 3.4.3, 3.5.9

MariaDB has Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials

• Weak cryptography or TLS
• Hard-coded credentials

<3.2.4 || >=3.3.0, <3.3.3 || >=3.4.0, <3.4.6 || >=3.5.0, <3.5.3 · fixed in 3.2.4, 3.3.3, 3.4.6, 3.5.3

MariaDB's connector leaks the cleartext password to an MitM despite `ssl: true`

• Weak cryptography or TLS
• Hard-coded credentials

<3.2.4 || >=3.3.0, <3.3.3 || >=3.4.0, <3.4.6 || >=3.5.0, <3.5.3 · fixed in 3.2.4, 3.3.3, 3.4.6, 3.5.3

Stable Diffusion WebUI Credential Disclosure via /sdapi/v1/cmd-flags

• AUTOMATIC1111 stable-diffusion-webui
• Hard-coded credentials

Hardcoded Credentials Vulnerability in CP Plus CP-XR-DE21-S Router

• CP Plus CP-XR-DE21-S Router
• Hard-coded credentials

gitoxide before 0.37.1 HTTP Basic credential leak via URL parsing

• gitoxide
• Hard-coded credentials

Wazuh discloses cleartext cluster key to low-privilege API users via GET /cluster/local/config

• wazuh
• Information disclosure
• Hard-coded credentials

Fireware OS Stack-Based Buffer Overflow in Mobile Security epm Endpoint

• WatchGuard Fireware OS
• Memory corruption
• Hard-coded credentials

Ebyte NE2-D11 Insufficiently Protected Credentials

• Ebyte NE2-D11 Firmware
• Hard-coded credentials

Use of Hard-coded Credentials in Bendix EC80 Brake ECU

• Bendix EC80ESP+ J1708
• Bendix EC80ESP+ 6S/6M
• Hard-coded credentials

Zbtlink MQWrt infosrvd Command Injection

• Zbtlink WE1326
• Zbtlink WE2426-C
• Command injection
• Hard-coded credentials

A vulnerability in pentestgpt/core/langfuse.py in PentestGPT 1.0.0 allows remote attackers to disclose sensitive user telemetry data via hardcoded API credentials.

• Hard-coded credentials

Insufficiently protected credentials in Veeam ONE

• Veeam ONE
• Hard-coded credentials

Trojanized pantheon-agents 0.6.1 and 0.6.2 on PyPI ship a credential stealer (supply-chain account compromise)

• Hard-coded credentials
• CWE-506

>=0.6.1, <0.6.4 · fixed in 0.6.4

Use of Hard-coded LDAP Credentials in TÜBİTAK BİLGEM's Liderahenk

• TÜBİTAK BİLGEM Software Technologies Research Institute Liderahenk
• Hard-coded credentials

Insufficiently Protected Credentials in Rently Smart Home

• Rently Smart Home
• Hard-coded credentials

Embedded credentials in Virtuagym

• Resamania Virtuagym
• Hard-coded credentials

NVIDIA NemoClaw contains a vulnerability where an attacker could cause

• Hard-coded credentials

<=0.0.1 · no fixed version yet

urllib's cross-origin redirects preserve credential-bearing request headers, leading to potential credential leakage

• Information disclosure
• Hard-coded credentials

<2.44.1 || >=3.0.0, <4.9.1 · fixed in 2.44.1, 4.9.1

Hard-coded cryptographic key in NVIDIA Unified Fabric Manager Enterprise - GA and others

• NVIDIA Unified Fabric Manager Enterprise - GA
• NVIDIA Unified Fabric Manager Enterprise - LTS 2025
• Hard-coded credentials

Hard-coded credentials in FURUNO ELECTRIC CO., LTD. FA-50

• FURUNO ELECTRIC CO., LTD. FA-50
• Hard-coded credentials

Duplicate Advisory: Grav: config_denied_paths default list omits `system`, exposing real secrets (e.g. system.cache.redis.password) via the Twig sandbox when config_access is enabled

• Hard-coded credentials

* · no fixed version yet

Duplicate Advisory: Grav: UserInterface offsetget/offsetexists allow-listed in Twig sandbox let editor-authored content leak hashed_password and 2FA secrets via offsetGet()

• Hard-coded credentials

* · no fixed version yet

RansomLook API Key Disclosure Through /admin/apikeys HTML Source

• ransomlook
• Information disclosure
• Hard-coded credentials

Dolibarr < 24.0.0 Members REST API Sensitive Data Exposure via Member Endpoints

• dolibarr
• Hard-coded credentials

Hard-coded Mesh Group Private Key in TP-Link Deco XE75, XE5300, and WE10800

• TP-Link Systems Inc. Deco XE75 v3 / XE5300 v3.6/ WE10800 v3.6
• Hard-coded credentials

act 0.2.81 through 0.2.89 Missing Authorization in the Artifacts V4 Backend

• nektos act
• Hard-coded credentials
• Broken access control

DJI Drone FTP Service Allows Unrestricted Storage Consumption of the /blackbox Directory

• DJI Neo
• DJI Neo 2
• Hard-coded credentials

vas3k TaxHacker JWT Secret config.ts envSchema.parse hard-coded credentials

• vas3k TaxHacker
• Hard-coded credentials

Checkmate: Sensitive Bearer Token Exposure via Public Status Pages When showURL Setting is Enabled

• bluewave-labs Checkmate
• Information disclosure
• Hard-coded credentials

Hard-coded credentials in Yamaha Corporation VOCALOID6

• Yamaha Corporation VOCALOID6
• Hard-coded credentials

CloudNativePG: Cleartext role passwords recorded in pg_stat_statements allow privileged tenant roles to recover the PostgreSQL superuser credential and achieve RCE in the database pod

• cloudnative-pg
• Hard-coded credentials
• CWE-256

libgit2: HTTP transport can leak credentials to an offsite redirect target

• libgit2
• Information disclosure
• Hard-coded credentials

Use of Hard-coded Credentials in Container Connections in Splunk AI Toolkit

• Splunk AI Toolkit
• Hard-coded credentials

Use of Hard-coded Cryptographic Key through Companion App Registration in Splunk Secure Gateway

• Splunk Enterprise
• Splunk Secure Gateway
• Hard-coded credentials

Cisco Crosswork Security Hardening Release: August 2026

• Cisco Crosswork Planning
• Hard-coded credentials

Cudy WR3000 2.0 Hard-coded JWT Secret Authentication Bypass via MQTT

• Shenzhen Cudy Technology Co., Ltd. WR3000 2.0
• Shenzhen Cudy Technology Co., Ltd. P5 V1.1
• Hard-coded credentials

HDD Password leakage vulnerability

• Insyde Software InsydeH2O, InsydeH2O ARM
• Hard-coded credentials

Blueprint Studio terminal SSH private key written to disk

• ha-china blueprint-studio
• Hard-coded credentials

Blueprint Studio stored Git credentials in plaintext Git credential store

• ha-china blueprint-studio
• Hard-coded credentials

`HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching

• Python Software Foundation CPython
• Weak cryptography or TLS
• Hard-coded credentials

Hardcoded session key in Zabbix 7.4

• Zabbix
• Hard-coded credentials

Email media OAuth secret leak to Super Admin

• Zabbix
• Hard-coded credentials

An issue exists in pson EH-TW5350 Epson iProjection.apk v3.2.6.

• Hard-coded credentials

Stirling-PDF: Internal Service Account API Key Disclosure via Pipeline Endpoint

• Stirling-Tools Stirling-PDF
• Information disclosure
• Hard-coded credentials

Sensitive Data Exposure in Innotim Software's Logsign SIEM

• Innotim Software Telecommunications and Consulting Trade Ltd. Co. Logsign SIEM
• Hard-coded credentials

openssl_encrypt versions before 1.4.0 contain hardcoded default JWT signing secrets in config.py that pass validation checks. Attackers with access to source code can forge valid JWT tokens for any...

• Hard-coded credentials

<1.4.0 · fixed in 1.4.0

openssl_encrypt versions before 1.4.0 contain a hardcoded default secret key in the standalone telemetry server configuration that is used for API key hashing. Attackers who know this default value...

• Hard-coded credentials

<1.4.0 · fixed in 1.4.0

openssl_encrypt versions before 1.4.0 contain hardcoded database credentials in standalone server configuration files. Attackers on the same network can access PostgreSQL databases using well-known...

• Hard-coded credentials

<1.4.0 · fixed in 1.4.0

Planet9 Hardcoded Credentials Vulnerability Information

• Acer Planet9 desktop application
• Hard-coded credentials