AstroBlocks versions prior to 3.4.0 contain a critical vulnerability due to a hard-coded fallback JWT secret and a mismatched environment variable name. This flaw allows an attacker who knows the public fallback secret to forge admin session tokens with owner-level privileges, enabling full administrative control over the CMS. The vulnerability is patched in version 3.4.0.
Use of a per-part static key in the ASP Bootloader could allow an attacker to downgrade the Secure Encrypted Virtualization (SEV) firmware and exploit known vulnerabilities to decrypt memory potentially resulting in loss of confidentiality.
CVE-2026-124602 is a vulnerability in GeoVision Inc.'s GV-Access application version 1.6.1 where RSA cryptographic keys, including private and public keys, are hard-coded within the Android client application. This practice exposes the keys to extraction and reverse engineering, potentially allowing attackers to impersonate the application or misuse cryptographic operations.
CVE-2026-124604 is a vulnerability in GeoVision Inc.'s GV-Cloud version 1.5.1 where RSA cryptographic keys, including private and public keys, are hard-coded within the Android application package. This practice exposes the keys to extraction and reverse engineering by attackers, potentially allowing them to impersonate the application or misuse cryptographic operations.
CVE-2026-124599 is a vulnerability in GeoVision Inc.'s GV-Face application version 2.2.1 where RSA cryptographic keys, including private and public keys, are hard-coded within the Android application package. This practice allows attackers who extract and reverse engineer the app to recover these keys, potentially enabling impersonation of the application or unauthorized cryptographic operations. The vulnerability has a medium severity with a CVSS score of 6.2.
CVE-2026-124598 is a vulnerability in GeoVision Inc.'s GV-Face Android application version 2.2.1 where an API key is hardcoded and can be extracted by reverse engineering the app. This exposure allows unauthorized users to retrieve and potentially misuse the embedded API key.
The LaserGest mobile application encrypts stored assistance portal credentials with a hardcoded AES key and IV, allowing an attacker with access to the application package to recover them in cleartext.
CVE-2026-118464 is a vulnerability in CompuGroup Medical Infantia where shared cryptographic services use hard-coded cryptographic keys and weak cryptographic practices such as deterministic IVs, null salts, and reversible transformations. These weaknesses affect the protection of credentials, inter-process communication data, configuration values, and clinical fields. The vulnerability affects versions from 0 up to and including 5.1.1. It has a CVSS 4.0 base score of 5.8, indicating medium severity.
CVE-2026-118460 is a vulnerability in CompuGroup Medical Infantia where embedded private keys are protected by a shared password. This flaw allows attackers to sign practitioner assertions for arbitrary practitioner identifiers, enabling unauthorized requests for practitioner tokens. The vulnerability affects versions up to 6.09.1 and 5.1.1. It has a high severity with a CVSS 4.0 score of 8. There is no indication of known exploits in the wild or available patches at this time.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability involving the use of a hard-coded cryptographic key. This flaw could allow a local attacker to obtain sensitive information. The vulnerability is classified as CWE-321 and has a high severity rating with a CVSS score of 8.7.
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to the use of a hard-coded cryptographic key.
CVE-2026-115739 is a vulnerability in Trellix DLP on-prem extensions version 11.13.1 and earlier where a hard-coded cryptographic key is used. This flaw allows a remote attacker to decrypt credentials and evidence files, potentially exposing sensitive information. The vulnerability has a CVSS 4.0 base score of 6.0, indicating a medium severity level.
Use of Hard-coded Cryptographic Key in JWT token authentication in Apache OFBiz 24.09.06 and 24.09.07 on all platforms allows an unauthenticated, network-reachable attacker to obtain full administrative access via a forged JWT signed with the factory-default security.token.key value that CVE-2026-31986 removed from newly generated configurations, on a deployment that upgraded from a release predating that fix while retaining its existing security.properties with security.internal.sso.enabled set to true. Users are recommended to upgrade to version 24.09.08. Upgrading alone does not replace an already-configured key: deployments that carried framework/security/config/security.properties forward from a release predating the CVE-2026-31986 fix must also run './gradlew rotateSecretKeys' after upgrading, since the existing generateSecretKeys task leaves an already-set value untouched.
Quest Foglight for Databases EncryptionUtil Hardcoded Encyption Key Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Quest Foglight for Databases. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the symmetricDecrypt method. The issue results from the use of a hard-coded cryptographic key. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-29967.
Dell OS Recovery tool versions, prior to 2.4.4, contain a use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to Information Disclosure.
ng-antd-admin versions prior to 22.0 contain a hardcoded default JWT secret key. If the default secret is not replaced during deployment, attackers can forge tokens to bypass authentication and authorization, impersonate any user including administrators, and access protected API endpoints. This leads to account takeover, data leakage, and unauthorized operations. Version 22.0 mitigates this by rejecting the default secret in production environments and issuing warnings in non-production environments.
Dell OpenManage Enterprise versions prior to 4.8.0 contain a vulnerability due to the use of a hard-coded cryptographic key. This flaw allows a low privileged local attacker to potentially disclose sensitive information. The vulnerability is identified as CWE-321 and has a CVSS v3.1 score of 7.3, indicating high severity. The issue is fixed in version 4.8.0 and later.
CVE-2025-62841 is a high-severity vulnerability in QNAP Systems Inc.'s HBS 3 Hybrid Backup Sync and Hybrid Backup Sync products caused by the use of a hard-coded cryptographic key. This flaw could allow remote attackers to compromise system security. The issue has been fixed in versions 26.4.0.521 and later for HBS 3 Hybrid Backup Sync, and 26.4.1.563 and later for Hybrid Backup Sync.
CVE-2025-62839 is a vulnerability in QNAP Systems Inc.'s HBS 3 Hybrid Backup Sync and Hybrid Backup Sync products involving the use of a hard-coded cryptographic key. This flaw could allow remote attackers to compromise system security. The issue has been addressed and fixed in versions 26.4.0.521 and 26.4.1.563 and later.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and certain LTS releases contain a vulnerability involving the use of a hard-coded cryptographic key. This flaw allows an unauthenticated remote attacker to potentially expose credentials, which could then be used to access the system with the privileges of the compromised user. The vulnerability has a critical severity rating with a CVSS score of 9.8. Fixed versions are available starting from 8.9.0.0 and corresponding LTS patch releases.