Monthly
Administrative account takeover in Datiphy Data Management Center (v8.3.0 through v8.5.1) lets a remote attacker log into the management platform using shipped default administrator credentials, granting full control over the database-activity-monitoring console. Rated CVSS 4.0 9.3 (critical) with a fully network-reachable, unauthenticated vector, though no public exploit identified at time of analysis and no CISA KEV listing exists. Because the console governs database auditing and policy, compromise undermines the very security telemetry it is meant to provide.
Default-credential authentication bypass in the LazyOwn RedTeam/APT Framework (grisuno/lazyown) before 0.2.154 lets any network-reachable attacker log into the C2 dashboard using the hardcoded operator credentials 'LazyOwn'/'LazyOwn', gaining full operator-level control of the command-and-control server. The framework ships these defaults in payload.json and core/payload_schema.py and passes them unchanged into lazyc2.py's HTTP Basic authentication. No public exploit identified at time of analysis, but the credentials are trivially known from the source code, and the CVSS base score is 9.8 (Critical).
Remote code execution in Care Everywhere Gateway 14.3.10 stems from hard-coded, install-invariant credentials in its bundled WildFly 8.2.0.Final management interface (port 20990), letting unauthenticated remote attackers log into the management console and deploy a malicious WAR to run code as the Windows machine account. The affected 14.x branch reached end-of-life in 2017 and later releases remediate the issue. Publicly available exploit code exists (VulnCheck), and given AV:N/AC:L/PR:N/UI:N the barrier to exploitation is minimal, though this is not listed in CISA KEV.
Authentication bypass via well-known default credentials in SAP Commerce Cloud allows an unauthenticated remote attacker to abuse a pre-provisioned sample OAuth2 client whose client ID and secret are published in SAP Help Portal documentation. If the sample client is left in place, the attacker mints a valid OAuth2 access token and calls certain APIs to read and modify business data (CVSS 9.1, high confidentiality and integrity impact, no availability impact). No public exploit identified at time of analysis, but the credentials are publicly documented, making exploitation trivial wherever the sample configuration was never removed.
Authentication bypass via default credentials in IBM API Connect 12.1.0.0 through 12.1.0.3 lets remote unauthenticated attackers log in with vendor-shipped default credentials during the window before the system forces a credential change on first use. Rated CVSS 9.8 with total confidentiality, integrity, and availability impact, the flaw grants full access to the API management platform. There is no public exploit identified at time of analysis and SSVC reports no observed exploitation, but the low attack complexity and known-credential nature make opportunistic abuse of freshly deployed instances plausible.
Authentication bypass via hard-coded default credentials in AutoBangumi before 3.2.8 lets unauthenticated remote attackers log in as administrator using publicly known credentials that the application seeds at startup via add_default_user() whenever the users table is empty. Successful login grants full control over RSS feed and downloader configuration and every authenticated API endpoint (CVSS 4.0 9.3). No public exploit identified at time of analysis, but the credentials are public and exploitation is trivial against any un-upgraded, freshly-initialized instance.
Default-credential authentication bypass in JAIOTlink C492A-W6 Wi-Fi IP cameras (firmware 4.8.30.57701411) lets attackers log in to the anyka_ipc HTTP service on port 80 using the built-in admin username with an empty password, granting full access to snapshots, live video, network configuration, and factory-level API endpoints. Because the same interface exposes a SetMAC command-injection surface, this trivial access can be pivoted toward device-level code execution. Publicly available exploit code exists (published by VulnCheck), though this CVE is not listed in CISA KEV and no active exploitation is confirmed.
Dell Wyse Management Suite (WMS) versions prior to 2605 ships with default credentials, enabling a high-privileged local attacker to authenticate using those credentials and access sensitive information. Reported by Dell under DSA-2026-247, the flaw is classified under CWE-1392 (Use of Default Credentials) and carries a CVSS 3.1 base score of 6.0, reflecting local-only attack surface constrained by the requirement for high privilege. No public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Dell AIOps Collector versions prior to 1.18.3 allows a low-privileged attacker with console access to obtain filesystem-level access by abusing default credentials shipped with fresh installations. The flaw only affects systems freshly installed at an earlier version; upgraded hosts are not impacted. No public exploit identified at time of analysis, and the issue is not on CISA KEV.
Unauthorized camera feed access affects Brickcom Cube, Dome, Bullet, and Box IP camera product lines due to factory-shipped default credentials (CWE-1392). Any attacker reaching the camera's management interface can authenticate using the known default account and silently view live video, with no public exploit identified at time of analysis though the trivial nature of the issue means weaponization requires no specialized tooling. CISA ICS-CERT issued advisory ICSA-26-162-03 covering the issue.
Administrative account takeover in Datiphy Data Management Center (v8.3.0 through v8.5.1) lets a remote attacker log into the management platform using shipped default administrator credentials, granting full control over the database-activity-monitoring console. Rated CVSS 4.0 9.3 (critical) with a fully network-reachable, unauthenticated vector, though no public exploit identified at time of analysis and no CISA KEV listing exists. Because the console governs database auditing and policy, compromise undermines the very security telemetry it is meant to provide.
Default-credential authentication bypass in the LazyOwn RedTeam/APT Framework (grisuno/lazyown) before 0.2.154 lets any network-reachable attacker log into the C2 dashboard using the hardcoded operator credentials 'LazyOwn'/'LazyOwn', gaining full operator-level control of the command-and-control server. The framework ships these defaults in payload.json and core/payload_schema.py and passes them unchanged into lazyc2.py's HTTP Basic authentication. No public exploit identified at time of analysis, but the credentials are trivially known from the source code, and the CVSS base score is 9.8 (Critical).
Remote code execution in Care Everywhere Gateway 14.3.10 stems from hard-coded, install-invariant credentials in its bundled WildFly 8.2.0.Final management interface (port 20990), letting unauthenticated remote attackers log into the management console and deploy a malicious WAR to run code as the Windows machine account. The affected 14.x branch reached end-of-life in 2017 and later releases remediate the issue. Publicly available exploit code exists (VulnCheck), and given AV:N/AC:L/PR:N/UI:N the barrier to exploitation is minimal, though this is not listed in CISA KEV.
Authentication bypass via well-known default credentials in SAP Commerce Cloud allows an unauthenticated remote attacker to abuse a pre-provisioned sample OAuth2 client whose client ID and secret are published in SAP Help Portal documentation. If the sample client is left in place, the attacker mints a valid OAuth2 access token and calls certain APIs to read and modify business data (CVSS 9.1, high confidentiality and integrity impact, no availability impact). No public exploit identified at time of analysis, but the credentials are publicly documented, making exploitation trivial wherever the sample configuration was never removed.
Authentication bypass via default credentials in IBM API Connect 12.1.0.0 through 12.1.0.3 lets remote unauthenticated attackers log in with vendor-shipped default credentials during the window before the system forces a credential change on first use. Rated CVSS 9.8 with total confidentiality, integrity, and availability impact, the flaw grants full access to the API management platform. There is no public exploit identified at time of analysis and SSVC reports no observed exploitation, but the low attack complexity and known-credential nature make opportunistic abuse of freshly deployed instances plausible.
Authentication bypass via hard-coded default credentials in AutoBangumi before 3.2.8 lets unauthenticated remote attackers log in as administrator using publicly known credentials that the application seeds at startup via add_default_user() whenever the users table is empty. Successful login grants full control over RSS feed and downloader configuration and every authenticated API endpoint (CVSS 4.0 9.3). No public exploit identified at time of analysis, but the credentials are public and exploitation is trivial against any un-upgraded, freshly-initialized instance.
Default-credential authentication bypass in JAIOTlink C492A-W6 Wi-Fi IP cameras (firmware 4.8.30.57701411) lets attackers log in to the anyka_ipc HTTP service on port 80 using the built-in admin username with an empty password, granting full access to snapshots, live video, network configuration, and factory-level API endpoints. Because the same interface exposes a SetMAC command-injection surface, this trivial access can be pivoted toward device-level code execution. Publicly available exploit code exists (published by VulnCheck), though this CVE is not listed in CISA KEV and no active exploitation is confirmed.
Dell Wyse Management Suite (WMS) versions prior to 2605 ships with default credentials, enabling a high-privileged local attacker to authenticate using those credentials and access sensitive information. Reported by Dell under DSA-2026-247, the flaw is classified under CWE-1392 (Use of Default Credentials) and carries a CVSS 3.1 base score of 6.0, reflecting local-only attack surface constrained by the requirement for high privilege. No public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Dell AIOps Collector versions prior to 1.18.3 allows a low-privileged attacker with console access to obtain filesystem-level access by abusing default credentials shipped with fresh installations. The flaw only affects systems freshly installed at an earlier version; upgraded hosts are not impacted. No public exploit identified at time of analysis, and the issue is not on CISA KEV.
Unauthorized camera feed access affects Brickcom Cube, Dome, Bullet, and Box IP camera product lines due to factory-shipped default credentials (CWE-1392). Any attacker reaching the camera's management interface can authenticate using the known default account and silently view live video, with no public exploit identified at time of analysis though the trivial nature of the issue means weaponization requires no specialized tooling. CISA ICS-CERT issued advisory ICSA-26-162-03 covering the issue.