The EnergizeLab AI Station (RK3562) firmware contains a vulnerability due to hard-coded default root credentials with SSH enabled. This allows an attacker with network access to log in as root and gain full control of the device. The vulnerability has a high severity score of 8.8 and affects the firmware image as shipped. No specific affected versions or patches are provided in the available data.
FileRise versions from 3.9.0 up to but not including 3.22.0 contain a vulnerability involving the use of a hard-coded legacy compatibility key. This key can be activated in pristine manual installations lacking a persistent tokens key, allowing attackers who obtain certain encrypted account or configuration files to decrypt TOTP secrets or credentials. Docker installations are not affected due to unique persistent keys. The issue is resolved in version 3.22.0.
CVE-2026-81964 is a vulnerability in Microsoft Windows 10 Version 21H2 involving the use of hard-coded credentials in the Windows Update Orchestrator Service. This flaw allows an authorized local attacker to bypass a security feature. The issue affects multiple Windows 10 builds prior to specific fixed versions. An official fix is available from Microsoft.
CVE-2026-53709 is a critical improper authentication vulnerability in IBM mcp-context-forge prior to version 1.0.2. The product shipped with a known JWT secret key, allowing remote unauthenticated attackers to forge administrator tokens. This flaw enables attackers to maintain administrative access despite password changes, account deletions, or session revocations, leading to potential disclosure, modification, and disruption of the service. The issue is fixed in version 1.0.2.
Perforce Helix Authentication Service (HAS) versions 2022.1 through 2025.2 contain a vulnerability due to the retention of a default SCIM bearer token in the installation templates. This default token is copied into the active configuration without automatic replacement, allowing an attacker who knows the token to authenticate to the SCIM API and perform user and group operations. The vulnerability was fixed in version 2026.1, released on July 17, 2026.
GV-E-Map Server version 18.2.0A contains a hard-coded plaintext database password embedded within an application component. This credential can be extracted through static analysis of the distributed binary and may also be exposed in process memory during runtime. The vulnerability is identified as CWE-798 (Use of Hard-coded Credentials) and has a CVSS 3.1 score of 6.2 (medium severity). There is no information about an available patch or official remediation from the vendor.
CVE-2026-32645 is a vulnerability in Red Lion Controls 700 Series where default factory credentials with administrative access remain enabled and persist even after other administrator accounts are configured. This allows an attacker with local access and high privileges to potentially gain unauthorized administrative control. The vulnerability has a medium severity with a CVSS score of 6. No patch or remediation information is currently provided.
The openPDC Docker image from Grid Protection Alliance contains a fixed administrative credential that is not forced to be changed on first use. This allows an attacker with network access to the management interface to authenticate with the default credential and gain full administrative control. The vulnerability affects versions prior to 2.9.477 and 2.9.482. It has a critical CVSS score of 9.8.
IBM Guardium Data Protection version 12.2 contains a vulnerability involving the use of hard-coded credentials and weak cryptographic protection in the pkcrypto passkey component. This flaw allows a local attacker to recover the root password and escalate privileges to root. The vulnerability has a high severity rating with a CVSS score of 8.4.
Brocade ASCG before 3.5.0 has a well-known Brocade default password embedded in a script distributed to every customer. Any local authenticated user with read access to the installation path can discover this credential and perform privilege escalation on affected Open Virtual Appliance (OVA) deployments, where default configuration settings remain in place.
A vulnerability in Brocade ASCG version before 3.5.0 could allow an attacker to obtain a static cryptographic key hardcoded into the software binaries to secure sensitive data at rest and to protect inter-node communication protocols. An attacker who extracts this key can decrypt stored management credentials or craft forged administrative synchronization messages.
Homer is open source telecom observability software. Prior to version 11.0.283, on every fresh Homer deployment using internal authentication, the bootstrap process automatically creates an `admin` account with the password `sipcapture` (stored as a legacy SHA-256 hex hash). There is no first-login forced-change mechanism. Any attacker who reaches the login endpoint immediately gains full administrative access. Version 11.0.283 patches the issue.
CVE-2026-102161 is a high-severity vulnerability in Arista Networks CloudVision CUE that involves the use of hard-coded credentials. An unauthenticated attacker on an adjacent private network or routed through a reverse proxy can forge their source IP address to gain administrative session privileges on the CV-CUE backend. This vulnerability affects versions from 2021.2.0 through 2026.2.0 inclusive. The vulnerability has a CVSS score of 8.8, indicating a high impact on confidentiality, integrity, and availability.
Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Use of Hard-coded Credentials vulnerability in the CSM Authorization. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.
Dell Container Storage Modules versions prior to 1.18.0 contain a critical vulnerability due to the use of hard-coded credentials. This flaw allows an unauthenticated remote attacker to potentially gain unauthorized access, leading to information disclosure. The vulnerability is identified as CWE-798 and carries a CVSS 3.1 score of 9.8, indicating a critical severity level. No official patch or remediation details are provided in the available data.
Plane, an open-source project management tool, had hard-coded default secrets in certain deployment manifests prior to version 1.4.0. These fixed SECRET_KEY and LIVE_SERVER_SECRET_KEY values were publicly known and remained active if not overridden by operators, allowing attackers to forge Django-signed values and bypass live-service authentication. This vulnerability is fixed in version 1.4.0.
Armatura One contains a vulnerability where its database initialization routine uses a fixed, vendor-defined password for the database superuser account instead of generating a unique password per installation. This allows anyone with operating system access and knowledge of the fixed password to authenticate as the database superuser if the password has not been changed. The vulnerability affects versions prior to 4.6.1 and 4.7.2. It has a high severity with a CVSS score of 8.4.
CVE-2026-103097 is a high-severity vulnerability in GeoVision Inc.'s GV-Eye Android application version 3.6.0. The issue involves a hardcoded API key embedded within the application package, which can be extracted through reverse engineering. This exposure allows unauthorized users to misuse the API key, potentially leading to unauthorized access to services relying on this key. The vulnerability does not affect confidentiality of user data directly but compromises the security of the API key itself.
CVE-2026-103096 is a vulnerability in GeoVision Inc.'s GV-Eye Android application version 3.6.0 where an API key is hardcoded and can be extracted from the application package. Because Android apps can be reverse engineered, this allows unauthorized users to retrieve and misuse the embedded API key. The vulnerability has a high severity with a CVSS score of 7.5, indicating a network attack vector with no privileges or user interaction required and high confidentiality impact. No official patch or remediation guidance is currently provided by the vendor. Users should check for vendor advisories for updates and avoid distributing the vulnerable version until a fix is available.