Monthly
Unauthenticated remote device takeover in XING (XING Inc./JOYSOUND) CPTrans-ME-X arises from a shipped default password (CWE-1393) that anyone aware of the credential can use to log in with full privileges. The flaw affects all firmware revisions of this Japanese commercial audio/video rack transmission accessory and grants complete control over confidentiality, integrity, and availability. No public exploit code has been identified, and it is not on CISA KEV, but the trivial nature of default-credential abuse makes exploitation straightforward once the credential is known.
The XML import feature in Tuleap Enterprise Edition versions 17.0 through 17.5 assigns default passwords to user accounts created during XML import operations (CWE-1393), exposing those accounts to network-accessible credential guessing with no authentication or user interaction required. Successful exploitation grants an attacker full control of an affected user account, resulting in high confidentiality and integrity impact per the CVSS 7.7 score. No public exploit code has been identified at time of analysis and this CVE is not listed in CISA KEV, but the unauthenticated network vector makes this a realistic threat for any organization that has used XML import for bulk user migration.
Predictable default credentials in Ciena's Navigator Network Control Suite (NCS), Manage Control Plane (MCP), and Planner Plus OnPrem expose hidden system accounts used for internal software operations to remote attackers. These accounts carry limited permissions in isolation, but their known default passwords give an attacker a foothold that can be chained with other weaknesses to escalate privilege on the management system. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV, so exploitation remains theoretical rather than demonstrated.
Credential disclosure in MBS industrial protocol gateways (Single-A, Double-A, Single-X, and Double-X product families) allows remote unauthenticated attackers to extract a hard-coded default password embedded in the firmware image and use it to obtain full administrative control of any affected device. With a CVSS 4.0 score of 9.3 and the vulnerability reported through CERT@VDE under advisory VDE-2026-039, the issue is severe because the recovered credential is shared across the device line, but at the time of analysis there is no public exploit identified and the vulnerability is not listed in CISA KEV.
Full device takeover in Juniper Networks Support Insights Virtual Lightweight Collector (vLWC) before 3.0.94 via hardcoded default credentials. The vLWC software ships with an unchangeable initial password for a high-privileged account with no enforced password change during provisioning, enabling unauthenticated remote attackers to gain complete system control. CVSS v4.0 score 9.3 (Critical). No public exploit identified at time of analysis.
GoHarbor Harbor versions 2.15.0 and earlier contain hardcoded default credentials that allow unauthenticated attackers to gain administrative access to the web UI using the default username 'admin' and password 'Harbor12345'. This vulnerability enables complete compromise of the container registry, including image manipulation, deletion, and unauthorized access to stored artifacts. The issue has been documented in GitHub issues and pull requests within the Harbor project, indicating active awareness and remediation efforts by the development team.
Authentication bypass leading to administrator-level remote code execution affects MLflow installations that use the built-in basic authentication, which ships a basic_auth.ini file containing hard-coded default credentials. Remote unauthenticated attackers who know these well-known defaults can log in as the administrator and execute arbitrary code in that context. No public exploit has been identified at time of analysis and it is not in CISA KEV, but the EPSS score of 1.39% (80th percentile) reflects above-average exploitation interest for a Trend Micro ZDI-disclosed flaw with an available vendor patch.
Default credentials in Tenda W30E V2 router firmware through V16.01.0.19. Known default password enables full administrative access.
Default-password exposure in Diem CMS through 5.1.3 allows remote attackers to access unhardened installations whose credential, provisioned through dmCorePlugin/lib/data/dmDataLoad.php, was never rotated. Publicly available exploit code exists and the vendor has not responded to the project issue; the practical risk is limited to deployments with the default configuration left in place, making this a low-to-moderate priority issue despite network reachability.
Sensitive information disclosure in Lenovo Smart Camera C33 - and the related C33 Pro, C35, RQ3, XW1, X6T, X6Q and Smart Network PTZ X5T/X5Q/X5E models - allows an attacker who is already positioned on the same adjacent network segment to read confidential data from the device without authenticating or relying on user interaction. The root cause class (CWE-1393, use of default password) points to weak or default credentials or secrets as the disclosure vector, and the CVSS v4.0 vector carries an AT:P precondition, meaning specific device state or configuration conditions must also hold, so this is not a direct internet-facing exploit. Exploitation is further limited because these cameras were distributed exclusively in the Chinese market; no public exploit code has been identified at time of analysis, and the independently assessed severity is a moderate, context-dependent risk rather than a top-tier emergency.
Unauthenticated remote device takeover in XING (XING Inc./JOYSOUND) CPTrans-ME-X arises from a shipped default password (CWE-1393) that anyone aware of the credential can use to log in with full privileges. The flaw affects all firmware revisions of this Japanese commercial audio/video rack transmission accessory and grants complete control over confidentiality, integrity, and availability. No public exploit code has been identified, and it is not on CISA KEV, but the trivial nature of default-credential abuse makes exploitation straightforward once the credential is known.
The XML import feature in Tuleap Enterprise Edition versions 17.0 through 17.5 assigns default passwords to user accounts created during XML import operations (CWE-1393), exposing those accounts to network-accessible credential guessing with no authentication or user interaction required. Successful exploitation grants an attacker full control of an affected user account, resulting in high confidentiality and integrity impact per the CVSS 7.7 score. No public exploit code has been identified at time of analysis and this CVE is not listed in CISA KEV, but the unauthenticated network vector makes this a realistic threat for any organization that has used XML import for bulk user migration.
Predictable default credentials in Ciena's Navigator Network Control Suite (NCS), Manage Control Plane (MCP), and Planner Plus OnPrem expose hidden system accounts used for internal software operations to remote attackers. These accounts carry limited permissions in isolation, but their known default passwords give an attacker a foothold that can be chained with other weaknesses to escalate privilege on the management system. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV, so exploitation remains theoretical rather than demonstrated.
Credential disclosure in MBS industrial protocol gateways (Single-A, Double-A, Single-X, and Double-X product families) allows remote unauthenticated attackers to extract a hard-coded default password embedded in the firmware image and use it to obtain full administrative control of any affected device. With a CVSS 4.0 score of 9.3 and the vulnerability reported through CERT@VDE under advisory VDE-2026-039, the issue is severe because the recovered credential is shared across the device line, but at the time of analysis there is no public exploit identified and the vulnerability is not listed in CISA KEV.
Full device takeover in Juniper Networks Support Insights Virtual Lightweight Collector (vLWC) before 3.0.94 via hardcoded default credentials. The vLWC software ships with an unchangeable initial password for a high-privileged account with no enforced password change during provisioning, enabling unauthenticated remote attackers to gain complete system control. CVSS v4.0 score 9.3 (Critical). No public exploit identified at time of analysis.
GoHarbor Harbor versions 2.15.0 and earlier contain hardcoded default credentials that allow unauthenticated attackers to gain administrative access to the web UI using the default username 'admin' and password 'Harbor12345'. This vulnerability enables complete compromise of the container registry, including image manipulation, deletion, and unauthorized access to stored artifacts. The issue has been documented in GitHub issues and pull requests within the Harbor project, indicating active awareness and remediation efforts by the development team.
Authentication bypass leading to administrator-level remote code execution affects MLflow installations that use the built-in basic authentication, which ships a basic_auth.ini file containing hard-coded default credentials. Remote unauthenticated attackers who know these well-known defaults can log in as the administrator and execute arbitrary code in that context. No public exploit has been identified at time of analysis and it is not in CISA KEV, but the EPSS score of 1.39% (80th percentile) reflects above-average exploitation interest for a Trend Micro ZDI-disclosed flaw with an available vendor patch.
Default credentials in Tenda W30E V2 router firmware through V16.01.0.19. Known default password enables full administrative access.
Default-password exposure in Diem CMS through 5.1.3 allows remote attackers to access unhardened installations whose credential, provisioned through dmCorePlugin/lib/data/dmDataLoad.php, was never rotated. Publicly available exploit code exists and the vendor has not responded to the project issue; the practical risk is limited to deployments with the default configuration left in place, making this a low-to-moderate priority issue despite network reachability.
Sensitive information disclosure in Lenovo Smart Camera C33 - and the related C33 Pro, C35, RQ3, XW1, X6T, X6Q and Smart Network PTZ X5T/X5Q/X5E models - allows an attacker who is already positioned on the same adjacent network segment to read confidential data from the device without authenticating or relying on user interaction. The root cause class (CWE-1393, use of default password) points to weak or default credentials or secrets as the disclosure vector, and the CVSS v4.0 vector carries an AT:P precondition, meaning specific device state or configuration conditions must also hold, so this is not a direct internet-facing exploit. Exploitation is further limited because these cameras were distributed exclusively in the Chinese market; no public exploit code has been identified at time of analysis, and the independently assessed severity is a moderate, context-dependent risk rather than a top-tier emergency.