Hard-coded credentials.

FUXA has a hardcoded fallback JWT signing secret

• Hard-coded credentials

<1.3.0 · fixed in 1.3.0

Everon api.everon.io Insufficiently Protected Credentials

• api.everon.io
• Hard-coded credentials

Mobiliti e-mobi.hu Insufficiently Protected Credentials

• Mobiliti e-mobi.hu
• Hard-coded credentials

Insufficiently protected credentials in Acronis Cyber Protect 17

• Acronis Cyber Protect 17
• Hard-coded credentials

ePower epower.ie Insufficiently Protected Credentials

• epower.ie
• Hard-coded credentials

RustDesk Client Transmits Preset Address Book Password Verbatim in Heartbeat Sync

• rustdesk-client RustDesk Client
• Hard-coded credentials

IDC SFX2100 Satellite Receiver bgpd/ospfd/ripd/zebra Config Credential Disclosure via World-Readable Files

• International Datacasting Corporation SFX2100 Satellite Receiver
• Hard-coded credentials

Insecure, Hardcoded Root Password Stored in Anaconda Configuration File On IDC SFX2100 Satellite Receiver

• International Datacasting Corporation IDC SFX2100 SuperFlex Satellite Receiver
• Hard-coded credentials

Hardcoded and Insecure Credentials for "Admin" Account providing Telnet Access on IDC SFX2100 Satellite Receiver

• International Datacasting Corporation (IDC) SFX2100 Series SuperFlex SatelliteReceiver
• Hard-coded credentials

Hardcoded FTP Credentials and LPE(via Insecure Permissions) for `xd` Local Account on IDC SFX2100

• International Datacasting Corporation (IDC) IDC SFX2100 SuperFlex Satellite Receiver
• Hard-coded credentials

Hardcoded and Insecure Credentials for "User" Local Account with SSH Access On IDC SFX2100 Satellite Receiver

• International Datacasting Corporation (IDC) SFX2100 Satellite Receiver
• Hard-coded credentials

Hardcoded and Insecure Credentials for "monitor" account with SSH Access On IDC SFX2100 Satellite Receiver

• International Datacasting Corporation (IDC) IDC SFX2100 SuperFlex Satellite Receiver
• Hard-coded credentials

OpenClaw reuses the gateway auth token in the owner ID prompt hashing fallback

• Hard-coded credentials
• CWE-320

<2026.2.22 · fixed in 2026.2.22

IBM WebSphere Application Server Liberty could provide weaker than expected security

• IBM WebSphere Application Server - Liberty
• Hard-coded credentials

Rancher doesn't properly sanitize credentials in cluster template answers

• Information disclosure
• Hard-coded credentials

>=2.5.0, <2.5.13 || >=2.6.0, <2.6.4 · fixed in 2.5.13, 2.6.4

Weak credentials in Eclipse Foundation Eclipse OpenMQ

• Eclipse Foundation Eclipse OpenMQ
• Hard-coded credentials
• CWE-1392

SIP Service Providers – Possible Impersonation of Poly Voice Device

• HP Inc VVX
• HP Inc Edge E
• Hard-coded credentials

Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 was discovered to stroe credentials in plaintext in the component uac_temp.db.

• Hard-coded credentials

Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 was discovered to contain a hardcoded encryption key which could allow attackers to access sensitive information.

• Hard-coded credentials

XIQ‑SE NAC Admin Credential Exposure via HTTP Response

• Extreme Networks ExtremeCloud IQ - Site Engine
• Hard-coded credentials

Insufficiently protected credentials in MediaTek, Inc. MediaTek chipset

• MediaTek, Inc. MediaTek chipset
• Hard-coded credentials

Gradio: Mocked OAuth Login Exposes Server Credentials and Uses Hardcoded Session Secret

• Hard-coded credentials

>=4.16.0, <6.6.0 · fixed in 6.6.0

Unitree UPK files Hard-Coded Key

• Unitree UPK
• Hard-coded credentials

Mobility46 mobility46.se Insufficiently Protected Credentials

• mobility46.se
• Hard-coded credentials

EV Energy ev.energy Insufficiently Protected Credentials

• EV Energy ev.energy
• Hard-coded credentials

SWITCH EV swtchenergy.com Insufficiently Protected Credentials

• SWITCH EV swtchenergy.com
• Hard-coded credentials

EV2GO ev2go.io Insufficiently Protected Credentials

• ev2go.io
• Hard-coded credentials

CloudCharge cloudcharge.se Insufficiently Protected Credentials

• cloudcharge.se
• Hard-coded credentials

Chargemap chargemap.com Insufficiently Protected Credentials

• chargemap.com
• Hard-coded credentials

Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change

• Hard-coded credentials
• Authentication bypass

<=0.24.6 · no fixed version yet

Administrative Credentials Can Be Extracted Through Gardyn API Responses

• Gardyn Home Kit
• Gardyn Home Kit Mobile Application
• Hard-coded credentials

Hard-coded database credentials in Finka software

• TIK-SOFT Finka-FK
• TIK-SOFT Finka-KPR
• Hard-coded credentials

Binardat 10G08-0800GSM Network Switch Hard-coded RC4 Encryption Key

• Binardat Ltd. 10G08-0800GSM Network Switch
• Hard-coded credentials
• Weak cryptography or TLS

Binardat 10G08-0800GSM Network Switch Hard-coded Credentials

• Binardat Ltd. 10G08-0800GSM Network Switch
• Hard-coded credentials

MLflow Use of Default Password Authentication Bypass Vulnerability

• Hard-coded credentials
• CWE-1393

<3.8.0rc0 · fixed in 3.8.0rc0

Jinan USR IOT Technology Limited (PUSR) USR-W610 Insufficiently Protected Credentials

• Jinan USR IOT Technology Limited (PUSR) USR-W610
• Hard-coded credentials

Jinan USR IOT Technology Limited (PUSR) USR-W610 Weak Password Requirements

• Jinan USR IOT Technology Limited (PUSR) USR-W610
• Hard-coded credentials

Beetel 777VR1 WPA2 PSK hard-coded credentials

• Beetel 777VR1
• Hard-coded credentials

In RUCKUS Network Director (RND) < 4.5.0.56, the OVA appliance contains hardcoded SSH keys for the postgres user.

• Hard-coded credentials

In Ruckus Network Director (RND) < 4.5.0.54, the OVA appliance contains hardcoded credentials for the ruckus PostgreSQL database user.

• Hard-coded credentials

OpenClaw: Telegram bot token exposure via logs

• Hard-coded credentials

<2026.2.15 · fixed in 2026.2.15

Hard-coded credentials in Dell RecoverPoint for Virtual Machines

• Dell RecoverPoint for Virtual Machines
• Hard-coded credentials

Multiple Vulnerabilities in IBM Concert Software.

• IBM Concert
• Hard-coded credentials

Glory RBG-100 Recycler System Hard-coded OS Credentials

• Glory Global Solutions RBG-100
• Hard-coded credentials

Beetel 777VR1 Web Management hard-coded credentials

• Beetel 777VR1
• Hard-coded credentials

Calero VeraSMART < 2026 R1 Hardcoded Static AES Keys Allow Decryption of Service Credentials

• Calero VeraSMART
• Hard-coded credentials

Calero VeraSMART < 2022 R1 Static IIS Machine Keys Enable ViewState RCE

• Calero VeraSMART
• Hard-coded credentials

Heatmiser Netmonitor 3.03 - Hardcoded Credentials

• Heatmiser Netmonitor
• Hard-coded credentials

NeuVector scanner insecurely handles passwords as command arguments

• Hard-coded credentials

>=4.0, <4.072 · fixed in 4.072

newbee-mall Default Seeded Administrator Credentials Allow Account Takeover

• newbee-ltd newbee-mall
• Hard-coded credentials

Hardcoded Key Allows Credential Disclosure

• WAGO 0852-1322
• WAGO 0852-1328
• Hard-coded credentials

AMSS++ 4.7 - Backdoor Admin Account

• Amssplus AMSS++
• Hard-coded credentials

3DP-MANAGER Uses Hard-coded Credentials

• denpiligrim 3dp-manager
• Hard-coded credentials

PlaciPy has a Hard-Coded Default Password for All Student Accounts (Account Takeover)

• Praskla-Technology assessment-placipy
• Hard-coded credentials

Use of Hard-Coded Cryptographic Key for Password Storage

• Infor SyteLine ERP
• Hard-coded credentials

Insufficiently protected credentials in Moxa UC-1200A Series

• Moxa UC-1200A Series
• Hard-coded credentials

YugabyteDB Anywhere Exposes LDAP Credentials in Cleartext in Web UI

• YugabyteDB Inc YugabyteDB Anywhere
• Hard-coded credentials

FUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default Configuration

• Hard-coded credentials
• CWE-1188

<1.2.10 · fixed in 1.2.10

EVE Has Partially Predetermined Vault Key

• Hard-coded credentials

<0.0.0-20220310190112-c0c966dc31e2 · fixed in 0.0.0-20220310190112-c0c966dc31e2

EVE Seals Vault Key With SHA1 PCRs

• Weak cryptography or TLS
• Hard-coded credentials

<0.0.0-20230519072751-977f42b07fa9 · fixed in 0.0.0-20230519072751-977f42b07fa9