Hard-coded credentials.

Hard-coded AWS Key in AL-KO Robolinho Update Software

• AL-KO Robolinho Update Software
• Hard-coded credentials

Hard-coded password in Yokogawa Electric Corporation CENTUM VP

• Yokogawa Electric Corporation CENTUM VP
• Hard-coded credentials

A cross-session information disclosure vulnerability exists in the awesome-llm-apps project in commit e46690f99c3f08be80a9877fab52acacf7ab8251 (2026-01-19).

• Information disclosure
• Broken access control

OpenClaw: Synology Chat Webhook Pre-Auth Rate-Limit Bypass Enables Brute-Force Guessing of Webhook Token

• Authentication bypass
• Hard-coded credentials

<2026.3.28 · fixed in 2026.3.28

Hardcoded Upgrade Decryption Passwords

• Microchip Time Provider 4100
• Hard-coded credentials

wandb OpenUI config.py hard-coded credentials

• wandb OpenUI
• Hard-coded credentials

OpenClaw: Telegram Webhook Missing Guess Rate Limiting Enables Brute-Force Guessing of Weak Webhook Secret

• Authentication bypass
• Hard-coded credentials

<=2026.3.24 · no fixed version yet

OpenClaw: BlueBubbles Webhook Missing Rate Limiting Enables Brute-Force Password Guessing

• Authentication bypass
• Hard-coded credentials

<=2026.3.24 · no fixed version yet

Wazuh GitHub Actions Workflow Exposure of Sensitive Credentials

• Wazuh (GitHub Actions)
• Hard-coded credentials

Cache Misconfiguration Leading to Cross-User Data Exposure

• OpenText Identity Manager
• Hard-coded credentials

OpenClaw Exposes Credentials Embedded in baseUrl Fields via config.get and channels.status

• Information disclosure
• Hard-coded credentials

<2026.3.22 · fixed in 2026.3.22

HCL Aftermarket DPC is affected by SQL Injection

• HCL Aftermarket DPC
• Hard-coded credentials

HCL Aftermarket DPC is affected by Hardcoded Sensitive Data

• HCL Aftermarket DPC
• Hard-coded credentials

HCL Aftermarket DPC is affected by Weak Password Policy vulnerability

• HCL Aftermarket DPC
• Hard-coded credentials

Saloon is vulnerable to SSRF and credential leakage via absolute URL in endpoint overriding base URL

• Hard-coded credentials
• Server-side request forgery (SSRF)

<4.0.0 · fixed in 4.0.0

Multiple Vulnerabilities in IBM Concert Software

• IBM Concert
• Hard-coded credentials

IBM InfoSphere Information Server is vulnerable to disclosure of sensitive information

• IBM InfoSphere Information Server
• Hard-coded credentials

Multiple Vulnerabilities in IBM Concert Software

• IBM Concert
• Hard-coded credentials

WordPress Addi – Cuotas que se adaptan a ti plugin <= 2.0.4 - Broken Authentication vulnerability

• Addi – Cuotas que se adaptan a ti
• Hard-coded credentials

Session hijacking via exposed session signing secret in distributed Checkmk setups

• Checkmk
• Hard-coded credentials

Hardcoded Cryptographic Key in Configuration Encryption Mechanism on TP-Link Archer NX200, NX210, NX500 and NX600

• TP-Link Systems Inc. Archer NX600 v3.0
• TP-Link Systems Inc. Archer NX600 v2.0
• Hard-coded credentials

Harbor allows the use of the default password for web UI login

• Hard-coded credentials
• CWE-1393

<=2.15.0 · no fixed version yet

kalcaddle kodbox Site-level API key shareOut.class.php shareSafeGroup hard-coded key

• kalcaddle kodbox
• Hard-coded credentials
• CWE-320

Hard-coded passwords in KlinikaXP

• BRI KlinikaXP Insertino
• BRI KlinikaXP
• Hard-coded credentials

Duplicate Advisory: OpenClaw reuses the gateway auth token in the owner ID prompt hashing fallback

• Hard-coded credentials

<2026.2.22 · fixed in 2026.2.22

IGL-Technologies eParking.fi Insufficiently Protected Credentials

• IGL-Technologies eParking.fi
• Hard-coded credentials

CTEK Chargeportal Insufficiently Protected Credentials

• CTEK Chargeportal
• Hard-coded credentials

QuNetSwitch

• QNAP Systems Inc. QuNetSwitch
• Hard-coded credentials

FileRise: Default Encryption Key Enables Token Forgery and Config Decryption

• error311 FileRise
• Hard-coded credentials
• CWE-1188

Yi Technology YI Home Camera WPA/WPS hard-coded key

• Yi Technology YI Home Camera
• Hard-coded credentials
• CWE-320

Yi Technology YI Home Camera ipc hard-coded credentials

• Yi Technology YI Home Camera
• Hard-coded credentials

Azure DevOps: msazure Elevation of Privilege Vulnerability

• Microsoft Azure DevOps: msazure
• Hard-coded credentials

Use of a deterministic credential generation algorithm in /ftl/bin/calc_f2 in Small Cell Sercomm SCE4255W (FreedomFi Englewood) firmware before DG3934v3@2308041842 allows remote attackers to derive v…

• Hard-coded credentials

Use of a hard-coded AES-256-CBC key in the configuration backup/restore implementation of Small Cell Sercomm SCE4255W (FreedomFi Englewood) firmware before DG3934v3@2308041842 allows remote authentic…

• Hard-coded credentials

xiaoheiFS Vulnerable to RCE via Arbitrary Payment Plugin Upload (Automatic Execution)

• danvei233 xiaoheiFS
• Unrestricted file upload
• Hard-coded credentials

The web interface of the WiFi Extender WDR201A (HW V2.1, FW LFMZX28040922V1.02) contains hardcoded credential disclosure mechanisms (in the form of Server Side Include) within multiple server-side we…

• Hard-coded credentials

Glances Central Browser Autodiscovery Leaks Reusable Credentials to Zeroconf-Spoofed Servers

• Hard-coded credentials
• CWE-346

<4.5.2 · fixed in 4.5.2

Glances's Browser API Exposes Reusable Downstream Credentials via `/api/4/serverslist`

• Information disclosure
• Hard-coded credentials

<4.5.2 · fixed in 4.5.2

IncusOS has a LUKS encryption bypass due to insufficient TPM policy

• Hard-coded credentials

<0.0.0-20260313012803-e3b35f230d23 · fixed in 0.0.0-20260313012803-e3b35f230d23

INDEX Conferences & Exhibitions Organization YWF BPOF APGCS App ae.index.apgcs BuildConfig.java hard-coded credentials

• INDEX Conferences & Exhibitions Organization YWF BPOF APGCS App
• Hard-coded credentials

i-SENS SmartLog App air.SmartLog.android hard-coded credentials

• i-SENS SmartLog App
• Hard-coded credentials

ZKTeco ZKBioSecurity 3.0 Local Authorization Bypass via visLogin.jsp

• ZKTeco Inc. ZKTeco ZKBioSecurity
• Hard-coded credentials

ZKTeco ZKBioSecurity 3.0 Hardcoded Credentials Remote Code Execution

• ZKTeco Inc. ZKTeco ZKBioSecurity
• Hard-coded credentials

OpenClaw: Pairing setup codes exposed long-lived shared gateway credentials instead of short-lived bootstrap tokens

• Hard-coded credentials
• Information disclosure

<2026.3.12 · fixed in 2026.3.12

Legacy built-in user account

• syslink software AG Avantra
• Hard-coded credentials

NEXULEAN API Key Leak

• Stalin-143 website
• Broken access control
• Hard-coded credentials

Use of Hard-coded Credentials vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge

• Trane Tracer SC
• Trane Tracer Concierge
• Hard-coded credentials

Insufficiently protected credentials in Veeam Backup and Replication

• Veeam Backup and Replication
• Hard-coded credentials

Hyper Data Protector

• QNAP Systems Inc. Hyper Data Protector
• Hard-coded credentials

perfree go-fastdfs-web Apache Shiro RememberMe ShiroConfig.java rememberMeManager hard-coded key

• perfree go-fastdfs-web
• Hard-coded credentials
• CWE-320

eWON Firmware 12.2-13.0 Authentication Bypass via wsdReadForm

• eWON
• Hard-coded credentials

token leak with redirect and netrc

• curl
• Hard-coded credentials

Hard-coded credentials in Micro Research Ltd. MR-GM5L-S1 and others

• Micro Research Ltd. MR-GM5L-S1
• Micro Research Ltd. MR-GM5A-L1
• Hard-coded credentials

An issue pertaining to CWE-259: Use of Hard-coded Password was discovered in oslabs-beta ThermaKube master.

• Hard-coded credentials

Hard-coded credentials in Schneider Electric EcoStruxure™ IT Data Center Expert (Formerly known as…

• Schneider Electric EcoStruxure™ IT Data Center Expert (Formerly known as StruxureWare Data Center Expert)
• Hard-coded credentials

Use of Hard-coded Credentials in power analyzer

• Janitza UMG 96RM-E 24V(5222063)
• Janitza UMG 96RM-E 230V(5222062)
• Hard-coded credentials

Tenda G1V3.1si V16.01.7.8 Firmware V16.01.7.8 was discovered to contain a hardcoded password vulnerability in /etc_ro/shadow, which allows attackers to log in as root.

• Hard-coded credentials

Tenda i24V3.0si V3.0.0.5 Firmware V3.0.0.5 was discovered to contain a hardcoded password vulnerability in /etc_ro/shadow, which allows attackers to log in as root.

• Hard-coded credentials

OpenClaw: fetch-guard forwards custom authorization headers across cross-origin redirects

• Hard-coded credentials
• CWE-116

<2026.3.7 · fixed in 2026.3.7

Keygraph Shannon Hard-coded Router API Key

• KeygraphHQ Shannon
• Hard-coded credentials