Monthly
DataBuff ai-apm-web through 0.1.10 ships with a hard-coded administrator account (admin / Databuff@123), allowing unauthenticated remote attackers to POST those credentials to /webapi/api/v1/auth/login and receive an administrator token. That token grants access to all protected /webapi routes, yielding full confidentiality, integrity, and availability impact on affected deployments. No public exploit identified at time of analysis, but exploitation is trivial if the built-in admin password remains default and the login endpoint is network-reachable; independent assessment finds this a genuine high-priority issue, not an inflated-CVSS artifact.
Hard-coded administrator credentials (admin/123456) shipped in JuggleIM im-server through version 1.8.16 allow unauthenticated remote attackers to log in to the admin console exposed on TCP port 8090 and take control of tenant applications and their application secrets. Because the console's CheckLogin routine recreates the admin account whenever it is absent, deleting the default administrator does not remove the exposure - the account simply returns. Exploitation requires only that port 8090 is network-reachable and that the operator has not rotated the shipped password; no public exploit code was identified at time of analysis, although the vendor advisory, a public technical writeup, and the upstream SQL seed and login source are all publicly referenced.
Unauthenticated network attackers can gain the highest application privileges on Perforce P4 Search container images prior to 2026.4.2 because the service authentication token is reset to a publicly documented default value (CWE-1392). Successful exploitation can lead to arbitrary code execution and compromise of any connected P4 Server, but full impact requires that the P4 Search container be network-reachable and that a P4 Server be connected to it. No public exploit identified at time of analysis, yet this is a genuine top-priority vulnerability because the default-token flaw is trivial to exploit once the service is exposed and the potential scope change to the connected P4 Server is severe.
Default or unchanged credentials in Logsign SIEM 6.4.101 through 6.4.116 allow remote, unauthenticated attackers to gain full control of an exposed instance simply by trying vendor-supplied or commonly used username and password pairs. The flaw is rated CVSS 3.1 9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) because a successful login yields complete confidentiality, integrity and availability impact on a platform that aggregates security telemetry and often holds integration credentials for other systems. Exploitation requires network reachability to the Logsign SIEM authentication/management interface and that the deployment still uses default or unchanged common credentials; no prior authentication is needed. At the time of analysis there is no public exploit code or confirmed CISA KEV active exploitation, and no EPSS score was supplied, but the low attack complexity and the value of the target make internet-exposed instances a high-priority risk. The issue was reported by TR-CERT and is tracked against CWE-1392.
Unauthenticated account takeover in X-SpringBoot through 6.0 allows remote attackers to authenticate as any user by submitting the hardcoded default master login verification code 172839, shipped in the database seed, to the emailOrMobileLogin endpoint together with a known email address or mobile number. Exploitation requires the deployment to retain the default seed and the attacker to know a valid account identifier, but no credentials, OTP, or user interaction are needed; publicly available exploit code exists. The vulnerability has a CVSS 4.0 base score of 9.3, and the assessed CVSS 3.1 vector is 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
Unauthenticated administrative access to a bundled inventory-management component (CVE-2026-90456) is possible when operators deploy the shipped example configuration file, which contains a fixed, publicly-known default administrative password. Any deployment that copies this example environment file into active configuration without executing the setup routine that regenerates credentials exposes the component's admin interface to anyone who knows the well-documented default value. Reported through CISA ICS-CERT (advisory icsa-26-254-01); no public exploit identified at time of analysis, though the default credential is inherently 'public' by nature of shipping in the distribution.
Cookie-signing secret forgery in an ICS platform's bundled packet-analysis component allows unauthenticated network attackers to bypass authentication entirely when the deployment was initialized from an example configuration file without running the required secret-regeneration routine. The vulnerability (CWE-1392) is contingent on a specific, detectable misconfiguration: the example `.env`-style file ships a publicly known static secret, and deployments that skip the setup step remain permanently vulnerable. Reported under an ICS-CERT advisory (ICSA-26-254-01), this affects operational technology environments where the packet-analysis UI is network-exposed.
Administrative account takeover in IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.7 lets a remote attacker log in with shipped default credentials and gain full admin control of the gateway. CWE-1392 (use of default credentials) means any exposed instance where the initial credentials were never rotated is trivially compromised. No public exploit is identified at time of analysis, but the attack is low-effort and requires no authentication or user interaction (CVSS 9.8).
Administrative account takeover in Datiphy Data Management Center (v8.3.0 through v8.5.1) lets a remote attacker log into the management platform using shipped default administrator credentials, granting full control over the database-activity-monitoring console. Rated CVSS 4.0 9.3 (critical) with a fully network-reachable, unauthenticated vector, though no public exploit identified at time of analysis and no CISA KEV listing exists. Because the console governs database auditing and policy, compromise undermines the very security telemetry it is meant to provide.
Default-credential authentication bypass in the LazyOwn RedTeam/APT Framework (grisuno/lazyown) before 0.2.154 lets any network-reachable attacker log into the C2 dashboard using the hardcoded operator credentials 'LazyOwn'/'LazyOwn', gaining full operator-level control of the command-and-control server. The framework ships these defaults in payload.json and core/payload_schema.py and passes them unchanged into lazyc2.py's HTTP Basic authentication. No public exploit identified at time of analysis, but the credentials are trivially known from the source code, and the CVSS base score is 9.8 (Critical).
DataBuff ai-apm-web through 0.1.10 ships with a hard-coded administrator account (admin / Databuff@123), allowing unauthenticated remote attackers to POST those credentials to /webapi/api/v1/auth/login and receive an administrator token. That token grants access to all protected /webapi routes, yielding full confidentiality, integrity, and availability impact on affected deployments. No public exploit identified at time of analysis, but exploitation is trivial if the built-in admin password remains default and the login endpoint is network-reachable; independent assessment finds this a genuine high-priority issue, not an inflated-CVSS artifact.
Hard-coded administrator credentials (admin/123456) shipped in JuggleIM im-server through version 1.8.16 allow unauthenticated remote attackers to log in to the admin console exposed on TCP port 8090 and take control of tenant applications and their application secrets. Because the console's CheckLogin routine recreates the admin account whenever it is absent, deleting the default administrator does not remove the exposure - the account simply returns. Exploitation requires only that port 8090 is network-reachable and that the operator has not rotated the shipped password; no public exploit code was identified at time of analysis, although the vendor advisory, a public technical writeup, and the upstream SQL seed and login source are all publicly referenced.
Unauthenticated network attackers can gain the highest application privileges on Perforce P4 Search container images prior to 2026.4.2 because the service authentication token is reset to a publicly documented default value (CWE-1392). Successful exploitation can lead to arbitrary code execution and compromise of any connected P4 Server, but full impact requires that the P4 Search container be network-reachable and that a P4 Server be connected to it. No public exploit identified at time of analysis, yet this is a genuine top-priority vulnerability because the default-token flaw is trivial to exploit once the service is exposed and the potential scope change to the connected P4 Server is severe.
Default or unchanged credentials in Logsign SIEM 6.4.101 through 6.4.116 allow remote, unauthenticated attackers to gain full control of an exposed instance simply by trying vendor-supplied or commonly used username and password pairs. The flaw is rated CVSS 3.1 9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) because a successful login yields complete confidentiality, integrity and availability impact on a platform that aggregates security telemetry and often holds integration credentials for other systems. Exploitation requires network reachability to the Logsign SIEM authentication/management interface and that the deployment still uses default or unchanged common credentials; no prior authentication is needed. At the time of analysis there is no public exploit code or confirmed CISA KEV active exploitation, and no EPSS score was supplied, but the low attack complexity and the value of the target make internet-exposed instances a high-priority risk. The issue was reported by TR-CERT and is tracked against CWE-1392.
Unauthenticated account takeover in X-SpringBoot through 6.0 allows remote attackers to authenticate as any user by submitting the hardcoded default master login verification code 172839, shipped in the database seed, to the emailOrMobileLogin endpoint together with a known email address or mobile number. Exploitation requires the deployment to retain the default seed and the attacker to know a valid account identifier, but no credentials, OTP, or user interaction are needed; publicly available exploit code exists. The vulnerability has a CVSS 4.0 base score of 9.3, and the assessed CVSS 3.1 vector is 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
Unauthenticated administrative access to a bundled inventory-management component (CVE-2026-90456) is possible when operators deploy the shipped example configuration file, which contains a fixed, publicly-known default administrative password. Any deployment that copies this example environment file into active configuration without executing the setup routine that regenerates credentials exposes the component's admin interface to anyone who knows the well-documented default value. Reported through CISA ICS-CERT (advisory icsa-26-254-01); no public exploit identified at time of analysis, though the default credential is inherently 'public' by nature of shipping in the distribution.
Cookie-signing secret forgery in an ICS platform's bundled packet-analysis component allows unauthenticated network attackers to bypass authentication entirely when the deployment was initialized from an example configuration file without running the required secret-regeneration routine. The vulnerability (CWE-1392) is contingent on a specific, detectable misconfiguration: the example `.env`-style file ships a publicly known static secret, and deployments that skip the setup step remain permanently vulnerable. Reported under an ICS-CERT advisory (ICSA-26-254-01), this affects operational technology environments where the packet-analysis UI is network-exposed.
Administrative account takeover in IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.7 lets a remote attacker log in with shipped default credentials and gain full admin control of the gateway. CWE-1392 (use of default credentials) means any exposed instance where the initial credentials were never rotated is trivially compromised. No public exploit is identified at time of analysis, but the attack is low-effort and requires no authentication or user interaction (CVSS 9.8).
Administrative account takeover in Datiphy Data Management Center (v8.3.0 through v8.5.1) lets a remote attacker log into the management platform using shipped default administrator credentials, granting full control over the database-activity-monitoring console. Rated CVSS 4.0 9.3 (critical) with a fully network-reachable, unauthenticated vector, though no public exploit identified at time of analysis and no CISA KEV listing exists. Because the console governs database auditing and policy, compromise undermines the very security telemetry it is meant to provide.
Default-credential authentication bypass in the LazyOwn RedTeam/APT Framework (grisuno/lazyown) before 0.2.154 lets any network-reachable attacker log into the C2 dashboard using the hardcoded operator credentials 'LazyOwn'/'LazyOwn', gaining full operator-level control of the command-and-control server. The framework ships these defaults in payload.json and core/payload_schema.py and passes them unchanged into lazyc2.py's HTTP Basic authentication. No public exploit identified at time of analysis, but the credentials are trivially known from the source code, and the CVSS base score is 9.8 (Critical).