Hard-coded credentials.

Weak credentials in Rakuten Mobile, Inc. Rakuten Mini and others

• Rakuten Mobile, Inc. Rakuten Mini
• Rakuten Mobile, Inc. Rakuten Hand
• Hard-coded credentials

Omnispace Agora Project < 26.10.0 Insecure Remember-Me Token Storage

• Omnispace Agora Project
• Hard-coded credentials

Windows Update Orchestrator Service Security Feature Bypass Vulnerability

• Microsoft Windows 10 Version 21H2
• Microsoft Windows 10 Version 22H2
• Hard-coded credentials

Snowy 3.6.5 Hard-coded Download Signature Key Allows Unauthenticated File Download

• xiaonuobase Snowy
• Hard-coded credentials

Hard-coded cryptographic key in Fortinet FortiSandbox and others

• Fortinet FortiSandbox
• Fortinet FortiSandbox Cloud
• Hard-coded credentials

MCP Context Forge: Hardcoded default JWT_SECRET_KEY shipped in source and .env.example enables pre-authentication platform admin token forgery

• IBM mcp-context-forge
• Authentication bypass
• Hard-coded credentials

Huawei Default SNMPv3 USM key

• Huawei openUBMC
• Hard-coded credentials

FreeRDP 3.0.0 before 3.32.0 Cleartext Credential Disclosure via /restricted-admin

• FreeRDP
• Hard-coded credentials

Prototype pollution in Perforce Helix Authentication Service

• Perforce Helix Authentication Service
• Hard-coded credentials
• Prototype pollution

Rapyd Admin 9.0.0 before 9.20.0 Hard-Coded Super-Admin Credentials via AuthSeeder

• zofe rapyd-admin
• Hard-coded credentials

NetEase Cloud Music Weak Encryption via eapi/xeapi

• NetEase Cloud Music for Windows
• Hard-coded credentials

Server-side request forgery and hard-coded key in Progress MarkLogic Server OpsDirector

• Progress Software Corporation MarkLogic Server
• Hard-coded credentials
• Server-side request forgery (SSRF)

Grav Login OAuth Plugin before 1.4.3 Predictable Local Credentials Authentication Bypass

• getgrav grav-plugin-login-oauth
• Hard-coded credentials

Untrusted request routing and forged acknowledgements permit copy-workflow manipulation in Progress ShareFile Storage Zones Controller

• Progress ShareFile Storage Zones Controller
• Hard-coded credentials
• Race condition

meetecho janus-gateway Admin API admin.js hard-coded credentials

• meetecho janus-gateway
• Hard-coded credentials

ZKTeco BioTime hard-coded key

• ZKTeco BioTime
• Hard-coded credentials
• CWE-320

Plaintext Database Password Exposure in GV-E-Map Server V18.2.0A

• GeoVision Inc. GV-E-map Server
• Hard-coded credentials

pH7Builder before 18.6.0 Hard-Coded API Key Bypass via Host Header

• ph7software ph7builder
• Hard-coded credentials

pH7Builder before 18.5.0 Sensitive Data Exposure via Member API UserController

• ph7software ph7builder
• Hard-coded credentials

BotSharp through 5.2.0 Authentication Bypass via Hard-Coded JWT Signing Key

• SciSharp BotSharp
• Hard-coded credentials

FunnyWolf Viper config hard-coded credentials

• FunnyWolf Viper
• Hard-coded credentials

Agnaistic agnai through 1.0.555 Hard-Coded Credentials in self-host Docker Compose

• agnai
• Hard-coded credentials

Vikunja: TOTP secret is readable after enrollment, no step-up auth

• Information disclosure
• Hard-coded credentials

<2.6.0 · fixed in 2.6.0

Mindwtr: Cloud token and WebDAV password stored in plaintext on mobile

• dongdongbh Mindwtr
• Information disclosure
• Hard-coded credentials

Red Lion Controls N-Tron 700 Series Insufficiently Protected Credentials

• Red Lion Controls 700 Series
• Hard-coded credentials

Red Lion Controls N-Tron 700 Series Use of Hard-Coded Credentials

• Red Lion Controls 700 Series
• Hard-coded credentials

Grid Protection Alliance openPDC (Docker image) Use of Hard-coded Credentials

• Grid Protection Alliance openPDC (Docker image)
• Hard-coded credentials

Rocket Software Rocket Remote Desktop 18.0.8583.1 is vulnerable to Insufficiently Protected Credentials.

• Hard-coded credentials

Mechanize sends credential headers to another origin after a meta refresh

• Information disclosure
• Hard-coded credentials

<2.14.1 · fixed in 2.14.1

Mechanize sends credential headers to another host after an HTTP redirect

• Information disclosure
• Hard-coded credentials

<2.14.1 · fixed in 2.14.1

Jivejdon through 5.0 Predictable Passwords via Sina Weibo OAuth Login

• banq jivejdon
• Hard-coded credentials

Security vulnerability affects the Windows GIM component as part of IBM Guardium Data Protection

• IBM Guardium Data Protection
• Hard-coded credentials

Mechanize sends credential headers to a different scheme or port after a redirect

• sparklemotion mechanize
• Information disclosure
• Weak cryptography or TLS

IBM Guardium Data Protection Hard-coded Credentials

• IBM Guardium Data Protection
• Hard-coded credentials

AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel

• Weak cryptography or TLS
• Hard-coded credentials

>=3.0.0, <3.0.12 || >=2.0.0, <2.16.1 · fixed in 3.0.12, 2.16.1

AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host

• Weak cryptography or TLS
• Hard-coded credentials

>=3.0.0, <3.0.13 || >=2.0.0, <2.16.1 · fixed in 3.0.13, 2.16.1

AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext

• Weak cryptography or TLS
• Hard-coded credentials

>=3.0.0.Beta1, <3.0.13 || >=2.0.0, <2.16.1 · fixed in 3.0.13, 2.16.1

EspoCRM before 10.0.5 IDOR via PersonalAccount Service Exposes IMAP Passwords

• espocrm
• Hard-coded credentials

Origin validation error in Eclipse Ditto Ditto Explorer UI

• Eclipse Ditto Ditto Explorer UI
• Hard-coded credentials
• CWE-15

Insufficiently protected credentials in Brocade Active Support Connectivity Gateway

• Brocade Active Support Connectivity Gateway
• Hard-coded credentials

Hard-coded cryptographic key in Brocade Active Support Connectivity Gateway

• Brocade Active Support Connectivity Gateway
• Hard-coded credentials

Hard-coded credentials in Brocade Active Support Connectivity Gateway

• Brocade Active Support Connectivity Gateway
• Hard-coded credentials

Hard-coded credentials in Brocade Active Support Connectivity Gateway

• Brocade Active Support Connectivity Gateway
• Hard-coded credentials

Hard-coded credentials in Wavedash Co., Ltd. Ticket Ryutsu Center

• Wavedash Co., Ltd. Ticket Ryutsu Center
• Hard-coded credentials

AsyncHttpClient: Origin credentials sent in cleartext to a proxy that rejects the CONNECT

• AsyncHttpClient async-http-client
• Weak cryptography or TLS
• Hard-coded credentials

Docling: Configured HTTP headers sent to every remote image host named by a document

• Information disclosure
• Hard-coded credentials

>=2.95.0, <2.132.0 · fixed in 2.132.0

Hard-coded cryptographic key in Johnson Controls ADVMS

• Johnson Controls ADVMS
• Hard-coded credentials

Cisco License On-Prem Security Hardening Release

• Cisco License On-Prem
• Hard-coded credentials

Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Login

• Hard-coded credentials

<0.0.0-20260625091610-b2e942031ff8 · fixed in 0.0.0-20260625091610-b2e942031ff8

Obot 0.12.0 before 0.26.2 Credential Exposure via MCP Catalog Entry API

• obot
• Hard-coded credentials

Langflow OSS is affected by multiple vulnerabilities

• IBM Langflow OSS
• Hard-coded credentials

Security Advisory 0190

• Arista Networks CloudVision CUE
• Authentication bypass
• Hard-coded credentials

Hard-coded cryptographic key in Dell Command | Configure (DCC)

• Dell Command | Configure (DCC)
• Hard-coded credentials

MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server

• Hard-coded credentials
• CWE-345

>=2.0.0, <2.2.0 · fixed in 2.2.0

Hard-coded credentials in Dell Container Storage Modules

• Dell Container Storage Modules
• Hard-coded credentials

Hard-coded credentials in Dell Container Storage Modules

• Dell Container Storage Modules
• Hard-coded credentials

Information Disclosure Vulnerability in Schmooze dating mobile Application

• Schmooze dating mobile Application
• Hard-coded credentials

Twenty: Plaintext IMAP/SMTP/CalDAV password disclosure to any workspace member via /metadata GraphQL

• twenty
• Hard-coded credentials

Lybbn Django-Vue-Lyadmin JWT Signing settings.py hard-coded key

• Lybbn Django-Vue-Lyadmin
• Hard-coded credentials
• CWE-320

Plane: Hardcoded SECRET_KEY and LIVE_SERVER_SECRET_KEY shipped in aio/cli community deployment manifests — session forgery and live-server auth bypass

• plane
• Hard-coded credentials