CWE-798 vulnerabilities

CVE-2026-112168 affects GALENO SISTEMI's MAGISTRA software version 3.12. The vulnerability involves the use of weak custom encryption, reliance on an outdated compression algorithm for database protection, and the presence of embedded secrets, leading to cleartext storage of sensitive information.

CVE-2026-118790 is a vulnerability in CompuGroup Medical Wingesfar involving multiple hardcoded credentials embedded in product components and administrative functionalities. These hardcoded credentials could allow unauthorized users to gain privileged access to accounts, services, or application features. The vulnerability affects versions prior to 2026.07a. A fix is available in version 2026.07a. The CVSS 4.0 base score is 7.2, indicating a high severity level.

CVE-2026-118465 is a vulnerability in CompuGroup Medical Infantia where shared components use hard-coded credentials for Access, workgroup, CCBasic, DBISAM, and related databases. These credentials are identical across different installations, potentially allowing unauthorized access if discovered.

CVE-2026-118458 is a high-severity vulnerability in CompuGroup Medical's Phronesis product where hard-coded credentials are used. The shared AIS login routing mistakenly selects a production-shipped test Data Access Object (DAO) and performs plaintext comparison for certain application codes, allowing fixed administrator accounts to be accepted.

IBM API Connect 10.0.8.0 through 10.0.8.12 could allow an attacker with access to stored data to decrypt sensitive credentials due to the use of a hard-coded cryptographic key. The key protecting stored credentials is built into the product, so credentials could be decrypted if the stored data is obtained.

CVE-2026-17403 is a critical vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It involves the use of hard-coded credentials, which could allow a remote attacker to gain full administrative control of the affected system.

CVE-2026-17360 is a critical vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It involves the use of hard-coded credentials that could allow a remote attacker to gain full administrative control of the affected system.

A weak password hashing vulnerability has been identified on SonicOS virtual appliances, which in specific conditions could potentially enable an attacker with existing local access to disclose a platform credential. The credential provides access to a limited subset of platform settings.

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. From 2.17.0 until 2.18.0, the TensorBoard proxy token introduced by the incomplete remediation for CVE-2026-54745 uses MINIO_SECRET_KEY as its HMAC secret, whose bundled default is publicly known. In an authorization-disabled deployment using that default, an unauthenticated attacker can forge a token containing a chosen viewerName and namespace; the proxy constructs the destination from the viewerName plus the -service suffix, the namespace, and the configured cluster domain, then reads responses on port 80 under the /tensorboard/<viewer>/ path. Resource-name validation and path-traversal rejection remain enforced, authorization-enabled deployments still check access to the selected namespace, and unrestricted metadata access, writes, or service disruption are not established. This issue is fixed in version 2.18.0.

This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to presence of hardcoded service account credentials, API Keys and authorization tokens within the application package. An unauthenticated remote attacker could exploit this vulnerability by downloading application package and extracting embedded sensitive information. Successful exploitation of this vulnerability could allow the attacker to gain unauthorized access to associated backend services and potentially access sensitive information or perform unauthorized operations on the targeted system.

CVE-2026-61729 is a critical vulnerability in socfortress CoPilot versions prior to 0.1.76. It involves missing authentication for critical webhook functionality due to a publicly hardcoded fallback header secret. This allows an anonymous attacker to bypass JWT authentication and invoke active-response commands on the Wazuh manager, potentially disrupting endpoints and manipulating defensive controls. The flaw also permits forged alerts to drive attacker-controlled OpenSearch queries. The issue is fixed in version 0.1.76.

CVE-2026-111419 is a high-severity vulnerability in Foxit Software Inc.'s official website where JavaScript code contains hard-coded third-party authorization credentials. This exposure may allow unauthorized parties to obtain or misuse these credentials, leading to sensitive information exposure. The vulnerability does not involve user interaction and can be exploited remotely over the network.

CVE-2026-118601 is a vulnerability in the Alpine iLX-F511 device involving hard-coded credentials in its SSH service. This flaw allows network-adjacent attackers to execute arbitrary code without authentication by leveraging these hard-coded credentials. The code execution occurs with the privileges of the telechips user. The vulnerability is assigned a medium severity with a CVSS score of 6.3.

CVE-2026-18449 is a vulnerability in SMCI X12SPI where the BMC fails to properly enforce integrity and encryption for IPMI commands. This flaw allows an attacker to craft malicious packets that can execute arbitrary commands on an active session without requiring privileges or user interaction. The vulnerability is present in version 01.07.20 of the product and has a high severity rating with a CVSS score of 7.5.

Part-DB-server versions prior to 2.12.1 contain a hard-coded APP_SECRET value in the .env file committed to the public repository. This secret is used by the Symfony framework to sign remember-me cookies. Because the official Docker image does not override or randomize this secret, an attacker who obtains it can forge remember-me cookies and gain fully authenticated sessions without credentials. This vulnerability is fixed in version 2.12.1.

Kiloview E3 NDI encoder firmware versions prior to 1.30 contain a hardcoded HMAC-SHA256 secret used to sign session JSON Web Tokens. This secret is identical across all devices and embedded as a static string in the firmware image. An attacker who obtains the firmware can extract this secret and forge session tokens, including administrative tokens, allowing unauthenticated access to privileged functions. The vulnerability is fixed in version 1.30.

NT OneAPP by NewType Infortech contains a hard-coded credentials vulnerability (CWE-798) that allows unauthenticated remote attackers to obtain a hard-coded cryptographic key. This key can be used to decrypt login request contents, exposing users' plaintext account credentials and device information. The vulnerability affects versions from 0 up to and including 1.5.22. The CVSS 4.0 score is 9.1, indicating critical severity.

CVE-2026-87950 is a vulnerability in the Drupal SAML SSO - Service Provider module that involves the use of hard-coded credentials. This flaw allows an attacker to retrieve embedded sensitive data. The issue affects all versions from 0.0.0 up to but not including 3.2.0. A fix is available in version 3.2.0. The vulnerability has a medium severity with a CVSS score of 5.3, indicating a network attack vector with low complexity and no privileges required.

IBM Verify Identity Access 11.0.3.1 and IBM Security Verify Access 10.0.9.3 Appliance could allow a physically proximate attacker to gain elevated privileges due to the use of hard-coded credentials.

CVE-2026-107617 is a critical vulnerability in the Guangzhou Juan IoT Technology Co., Ltd. EseeCloud App involving the use of hard-coded credentials. This flaw allows an attacker to log in to EseeCloud devices without authorization by leveraging these embedded credentials. The vulnerability affects versions from 0 up to and including 4.9.6 and 4.9.86.0. It has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability. There is no information about available patches or vendor advisories addressing this issue.