Monthly
Unauthenticated arbitrary database query execution in the Shinobi open-source video management/NVR platform (versions prior to commit 5a76c74f) lets attackers who can reach the child node service run SQL against the backend. By presenting a hardcoded connection key during the child-node WebSocket handshake, an attacker bypasses authentication and dispatches queries through the onWebSocketDataFromChildNode handler to read and modify user records and camera configuration. Reported by VulnCheck with a CVSS 4.0 base score of 9.3; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Hardcoded HTTP Digest authentication credentials baked into CP Plus CP-XR-DE21-S Router firmware grant any adjacent-network attacker full administrative access without valid credentials. Because the credentials are identical across every device running the affected firmware, a single firmware extraction exposes the entire deployed population. No active exploitation is confirmed by CISA KEV, but the trivially low exploitation complexity and total administrative compromise make this a high-priority remediation target for any network where this router is deployed.
Hard-coded credentials in the Bendix EC80ESP and EC80ESP+ Brake ECU family allow an adjacent-network attacker to bypass authentication and disable automatic traction control and electronic stability program functions on commercial heavy vehicles. All ten identified EC80ESP/EC80ESP+ variants across J1708, CAN, PLC, and TPMS configurations are affected, with no version exclusion identified in CPE data. No public exploit or KEV-confirmed active exploitation has been identified, though the safety-critical nature of the affected system significantly amplifies real-world operational risk beyond the moderate CVSS score.
Hard-coded credentials in TÜBİTAK BİLGEM's Liderahenk Linux endpoint management platform (all versions before 3.5.5) let a remote, unauthenticated attacker log in using built-in default/common username-password pairs, yielding an authentication bypass with high confidentiality and integrity impact. Because Liderahenk centrally administers fleets of Pardus/Linux clients, valid access to its management interface exposes managed-endpoint policies and configuration. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the flaw was reported by Turkey's national CERT (TR-CERT).
Hard-coded HMAC credential exposure in Resamania's Virtuagym mobile application allows a low-privileged attacker to forge unlimited physical access QR codes, bypassing facility entry controls permanently. The static HMAC key - derived from the badge_number parameter - is retrievable via an authenticated API call, and the QR code generation logic can be extracted by reverse engineering the unobfuscated APK. Generated codes remain valid indefinitely regardless of subsequent password changes or session logouts, meaning revocation of legitimate access does not invalidate attacker-forged credentials. No public exploit has been identified at time of analysis, though the low technical barrier significantly elevates practical exploitability.
Hard-coded credentials in all versions of the Furuno FA-50 maritime AIS transponder allow any attacker with knowledge of the static credentials and access to the vessel's internal network to authenticate to the device's settings screen and alter the vessel's identification number. Modification of the AIS identification number (MMSI) carries serious maritime safety implications, enabling vessel impersonation or disruption of AIS-based collision avoidance and vessel tracking systems. Disclosed via JPCERT coordination and JVN advisory JVNVU95422936; no public exploit has been identified at time of analysis.
Persistent storage exhaustion and file overwrite in DJI consumer/prosumer drone firmware allows an attacker with local or adjacent access to disable flight logging and block firmware updates. The onboard FTP service ships hardcoded credentials shared across affected models (CWE-798), and any party who reaches the drone's internal network or USB RNDIS interface can authenticate and write unlimited files to /blackbox/upgrade/, overwriting existing files. Uploaded data survives reboot and factory reset, making the condition durable. No public exploit identified at time of analysis; CIRCL-reported with CVSS 4.0 base 9.3.
Authentication bypass in vas3k TaxHacker through version 0.8.2 is possible because the JWT Secret Handler in `lib/config.ts` falls back to a hard-coded value for `BETTER_AUTH_SECRET` when the environment variable is not explicitly set at deployment. Because TaxHacker is open-source on GitHub, the default secret is publicly readable, enabling any remote unauthenticated attacker to forge valid JWT tokens and impersonate arbitrary users - including administrators - against any misconfigured instance. No vendor patch exists; the maintainer had not responded to the disclosure issue at time of analysis, and publicly available exploit code is indicated by the CVSS 4.0 E:P flag.
Hard-coded credentials embedded in VOCALOID6 by Yamaha Corporation allow an attacker to impersonate a legitimate VOCALOID6 Editor client and authenticate to Yamaha's backend activation and content delivery servers. The CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector indicates this is network-exploitable without authentication or user interaction, as the credentials are distributed within publicly available client software. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the advisory was coordinated through JPCERT/CC (JVNVU90210212).
Hard-coded and predictable credentials in Splunk AI Toolkit versions below 6.0.0 expose connected container services to unauthorized access by any low-privileged Splunk user. The toolkit generates or stores credentials for its container integrations using predictable or fixed default values, which are retrievable through the AI Toolkit Connections tab without requiring elevated Splunk roles. No public exploit has been identified at time of analysis, and no CISA KEV listing exists, but a vendor patch (6.0.0) is available per advisory SVD-2026-0808, reported by Cisco.
Unauthenticated arbitrary database query execution in the Shinobi open-source video management/NVR platform (versions prior to commit 5a76c74f) lets attackers who can reach the child node service run SQL against the backend. By presenting a hardcoded connection key during the child-node WebSocket handshake, an attacker bypasses authentication and dispatches queries through the onWebSocketDataFromChildNode handler to read and modify user records and camera configuration. Reported by VulnCheck with a CVSS 4.0 base score of 9.3; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Hardcoded HTTP Digest authentication credentials baked into CP Plus CP-XR-DE21-S Router firmware grant any adjacent-network attacker full administrative access without valid credentials. Because the credentials are identical across every device running the affected firmware, a single firmware extraction exposes the entire deployed population. No active exploitation is confirmed by CISA KEV, but the trivially low exploitation complexity and total administrative compromise make this a high-priority remediation target for any network where this router is deployed.
Hard-coded credentials in the Bendix EC80ESP and EC80ESP+ Brake ECU family allow an adjacent-network attacker to bypass authentication and disable automatic traction control and electronic stability program functions on commercial heavy vehicles. All ten identified EC80ESP/EC80ESP+ variants across J1708, CAN, PLC, and TPMS configurations are affected, with no version exclusion identified in CPE data. No public exploit or KEV-confirmed active exploitation has been identified, though the safety-critical nature of the affected system significantly amplifies real-world operational risk beyond the moderate CVSS score.
Hard-coded credentials in TÜBİTAK BİLGEM's Liderahenk Linux endpoint management platform (all versions before 3.5.5) let a remote, unauthenticated attacker log in using built-in default/common username-password pairs, yielding an authentication bypass with high confidentiality and integrity impact. Because Liderahenk centrally administers fleets of Pardus/Linux clients, valid access to its management interface exposes managed-endpoint policies and configuration. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the flaw was reported by Turkey's national CERT (TR-CERT).
Hard-coded HMAC credential exposure in Resamania's Virtuagym mobile application allows a low-privileged attacker to forge unlimited physical access QR codes, bypassing facility entry controls permanently. The static HMAC key - derived from the badge_number parameter - is retrievable via an authenticated API call, and the QR code generation logic can be extracted by reverse engineering the unobfuscated APK. Generated codes remain valid indefinitely regardless of subsequent password changes or session logouts, meaning revocation of legitimate access does not invalidate attacker-forged credentials. No public exploit has been identified at time of analysis, though the low technical barrier significantly elevates practical exploitability.
Hard-coded credentials in all versions of the Furuno FA-50 maritime AIS transponder allow any attacker with knowledge of the static credentials and access to the vessel's internal network to authenticate to the device's settings screen and alter the vessel's identification number. Modification of the AIS identification number (MMSI) carries serious maritime safety implications, enabling vessel impersonation or disruption of AIS-based collision avoidance and vessel tracking systems. Disclosed via JPCERT coordination and JVN advisory JVNVU95422936; no public exploit has been identified at time of analysis.
Persistent storage exhaustion and file overwrite in DJI consumer/prosumer drone firmware allows an attacker with local or adjacent access to disable flight logging and block firmware updates. The onboard FTP service ships hardcoded credentials shared across affected models (CWE-798), and any party who reaches the drone's internal network or USB RNDIS interface can authenticate and write unlimited files to /blackbox/upgrade/, overwriting existing files. Uploaded data survives reboot and factory reset, making the condition durable. No public exploit identified at time of analysis; CIRCL-reported with CVSS 4.0 base 9.3.
Authentication bypass in vas3k TaxHacker through version 0.8.2 is possible because the JWT Secret Handler in `lib/config.ts` falls back to a hard-coded value for `BETTER_AUTH_SECRET` when the environment variable is not explicitly set at deployment. Because TaxHacker is open-source on GitHub, the default secret is publicly readable, enabling any remote unauthenticated attacker to forge valid JWT tokens and impersonate arbitrary users - including administrators - against any misconfigured instance. No vendor patch exists; the maintainer had not responded to the disclosure issue at time of analysis, and publicly available exploit code is indicated by the CVSS 4.0 E:P flag.
Hard-coded credentials embedded in VOCALOID6 by Yamaha Corporation allow an attacker to impersonate a legitimate VOCALOID6 Editor client and authenticate to Yamaha's backend activation and content delivery servers. The CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector indicates this is network-exploitable without authentication or user interaction, as the credentials are distributed within publicly available client software. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the advisory was coordinated through JPCERT/CC (JVNVU90210212).
Hard-coded and predictable credentials in Splunk AI Toolkit versions below 6.0.0 expose connected container services to unauthorized access by any low-privileged Splunk user. The toolkit generates or stores credentials for its container integrations using predictable or fixed default values, which are retrievable through the AI Toolkit Connections tab without requiring elevated Splunk roles. No public exploit has been identified at time of analysis, and no CISA KEV listing exists, but a vendor patch (6.0.0) is available per advisory SVD-2026-0808, reported by Cisco.