Monthly
An authentication bypass in OpenBMC's phosphor-net-ipmid IPMI stack lets a network attacker with no credentials complete IPMI 2.0 RAKP session authentication and obtain full BMC control. A crafted RAKP Message 1 forces the handler to return before the authentication object's constructor defaults are overwritten, so the service accepts a RAKP Message 3 whose HMAC is keyed with the hard-coded 20-byte 'userKey' derived from the string '0penBmc' combined with an often-predictable 'bmcRandomNum'. The flaw affects downstream vendors that ship phosphor-net-ipmid as their IPMI implementation, including NVIDIA and H3C, and runZero published a public advisory; no CISA KEV entry or EPSS score was supplied, and no patched version was identified in the provided data.
We need answer JSON only. Need understand CVE. Need synthesize. Need fill fields. Let's parse data. CVE-2026-57147. PraisonAI multi-agent system. Prior to 0.1.6, praisonai_platform/services/auth_service.py assigns public dev-secret-change-me value to JWT_SECRET when PLATFORM_JWT_SECRET unset, production guard does not run when PLATFORM_ENV unset because defaults dev. Remote unauthenticated attacker can mint HS256 token arbitrary sub/email, AuthService._verify_token() and get_current_user dependency accept forged identity for protected API routes. Fixed in praisonai-platform 0.1.6. CVSS 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. CWE-798. Reported by GitHub_M. CPEs: cpe:2.3:a:mervinpraison:praisonai:*:*:*:*:*:*:*:*, cpe:2.3:a:mervinpraison:praisonai-platform:*:*:*:*:*:*:*:* Tags: Authentication Bypass, Praisonai, Praisonai Platform References: GHSA-cwj8-7gp2-ggcw, PR 1793, commit e0fb..., release tag v4.6.51 (interesting? maybe unrelated release?). Source code evidence: advisory summary. Package praisonai-platform PyPI latest tested 0.1.4, current 2026-06-01. Weakness CWE-798 + CWE-1188. Detail of code. Also fix diff shows examples eval changes, not auth_service? Maybe PR includes unrelated? But description says fixed in 0.1.6. "Package: pip/praisonai-platform — vulnerable: <= 0.1.4 — fixed in: 0.1.6" Hmm maybe <=0.1.5? We say prior to 0.1.6. Need product_name: 1-3 words. likely "PraisonAI Platform" or "praisonai-platform". Use "PraisonAI Platform". Summary not copy description. Need mention specific. Technical context. Risk assessment: CVSS 9.8, EPSS? Not provided. We need say EPSS unknown/not provided. KEV? Input no KEV field. We have no KEV status. POC? Not provided, but exploit technique described publicly in GHSA. Need use only phrases: if neither POC no KEV? But source advisory with detailed exploit maybe no explicit POC. We can say "no public exploit identified at time of analysis" perhaps but technical advisory demonstrates forging token. Need not overstate
Hard-coded bootloader credentials in the ANJIA AJL33PC0801 IP camera allow any attacker with physical device access to authenticate to the bootloader without knowing a legitimate password. Successful exploitation grants full control over firmware loading and system configuration, enabling persistent device compromise, implant installation, or complete operational disruption. CISA issued ICS advisory ICSA-26-251-01 for this vulnerability; no public exploit or CISA KEV listing has been identified at time of analysis.
We need answer JSON only. Need synthesize. Must use data. Need be careful with every field strings. We need analyze CVE-2026-79396. Need not copy description. Need incorporate all data. Need investigate references? We have references to GitHub and NVD. We need produce original synthesis. Let's parse input. CVE ID: CVE-2026-79396 Description: Use of hardcoded default credentials in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier stores static account credentials in unencrypted plaintext within bin/config.xml and compiled into the Sofia executable, allowing remote attackers to gain full administrative control over the camera. CVSS Score: 9.8 CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CWE: CWE-798 EPSS 0.18% percentile 8% Reported by mitre CPE: cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:* Tags: Authentication Bypass, N A ENISA EUVD ID: EUVD-2026-76189 Affected versions: ["n/a n/a"] References: cveorg None https://github.com/ShiroiBoushi/vulnerability-research/tree/main/CVE-2026-79396 euvd advisory https://nvd.nist.gov/vuln/detail/CVE-2026-79396 Need output product_name: 1-3 words. "Xiongmai IP Camera" or "Xiongmai XM530". Product specific. I think "Xiongmai IP Camera" 3 words? Xiongmai IP Camera = 3. Or "Xiongmai XM530" = 2. Probably "Xiongmai XM530". Need product name not vendor alone. Use Xiongmai IP Camera maybe. Summary: 2-3 sentences. Do not start with A vulnerability. Start with specific impact verb and product. We can say "Hardcoded default credentials in Xiongmai XM530 IP camera firmware HMT.CM2005-v220608.1837 and earlier allow remote unauthenticated attackers to achieve full administrative control by extracting or reusing static plaintext credentials from bin/config.xml and the Sofia executable." Need mention if actively exploited? KEV absent. POC? Reference is GitHub vulnerability-research. Could mean POC exists? But not explicitly says POC. We can mention "public proof-of-concept/research is accessible on GitHub" perhaps. E
Sensitive health-data exposure in the Lenovo Health Android application (distributed exclusively in the Chinese market) stems from hardcoded credentials (CWE-798) that let an attacker access users' health-related information without legitimate authentication. Reported by Lenovo PSIRT and tracked under a single Lenovo advisory, it carries a CVSS 4.0 base of 9.3 driven by high confidentiality impact. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Hardcoded or algorithmically derivable Wi-Fi credentials in the Softish C6 Ear Camera (firmware 1.3.1_Code 132) and companion EarVision Android application (1.3.1) allow an adjacent-network attacker to reconstruct the device's access-point password without authentication. Once the attacker connects to the camera's private Wi-Fi network, the live video stream, device management interfaces, status pages, and the firmware-update endpoint become fully accessible. The vulnerability was disclosed via CISA ICS-CERT advisory VA-26-251-01 and carries a CVSS 4.0 score of 8.7 reflecting high impact across confidentiality, integrity, and availability within the vulnerable system.
Hard-coded credentials in Dell Secure Connect Gateway (SCG) 5.0 expose both the Appliance and Application deployments to unauthenticated remote information disclosure. Any attacker who discovers or reverse-engineers the embedded static credentials - which cannot be changed by administrators - can authenticate to the gateway without valid user accounts and access sensitive information. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no privileges or user interaction; no public exploit or CISA KEV listing is recorded at time of analysis.
Hard-coded credentials embedded in Dell Secure Connect Gateway 5.0 allow a remote, unauthenticated attacker to authenticate to the service using the static credentials and access sensitive information. Both the Appliance variant (all versions prior to 5.36.00.16) and the Application variant (all versions prior to 5.36.00.00) are affected, as confirmed by Dell advisory DSA-2026-382. No public exploit code or active exploitation has been identified, but CWE-798 credentials are static across all unpatched installations worldwide, meaning any party with knowledge of them can exploit any exposed instance without further effort.
Hard-coded credentials in Dell Secure Connect Gateway (SCG) 5.0 expose sensitive information to unauthenticated remote attackers across both the Appliance and Application deployment variants. The vulnerability (CWE-798) allows an attacker who discovers or possesses the embedded credentials to authenticate without authorization and access confidential data. Dell has released patched versions under advisory DSA-2026-382, and no public exploits or CISA KEV listing have been identified at time of analysis.
We need answer JSON only. Need synthesize. Need follow precision. Let's parse input. CVE-2026-71801 description: s-pms SPMS-Server through v1.0 hardcoded default access token secret core config file, not overridden/removed production. Remote unauthenticated attacker can locally forge valid admin session tokens bypass auth gaining full unauthorized access to protected backend APIs. CVSS 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. CWE-798 hardcoded credentials. EPSS 0.24% percentile 15. Reported by mitre. CPE cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:* (bad). Tags: Authentication Bypass, N A. EUVD. References: github issue, nvd. Need output fields. product_name: "SPMS-Server" maybe 1-3 words. s-pms SPMS-Server. Could be "SPMS-Server". Summary: original synthesis. Don't copy description. Start with specific impact verb and product. E.g. "Authentication bypass in SPMS-Server through v1.0 allows remote unauthenticated attackers to forge administrative session tokens and access protected backend APIs." Mention hardcoded default token secret, not overridden production. No KEV, no POC? POC? References github issue maybe vulnerability report not POC? Input does not have POC explicitly. Need not claim POC exists. EPSS low 0.24 percentile 15. "No public exploit identified at time of analysis" though GitHub issue maybe report. Need use only phrases. KEV not present. Use "no public exploit identified at time of analysis". But maybe references include github issue; it's vulnerability disclosure not necessarily exploit. We can mention POC status? Need no. Technical_context: CWE-798 Use of Hard-coded Credentials. Underlying auth likely token-based with secret stored in config. CPE is n/a but affected product is SPMS-Server through v1.0. Explain hardcoded default access token secret in core config; not overridden production profile leads to token forgery. Use CWE. risk_assessment: Assess CVSS 9.8 critical, AV:N/AC:L/PR:N/UI:N, high C/I/A. EPSS 0.24 percentile 15 suggests low likelihood of wid
An authentication bypass in OpenBMC's phosphor-net-ipmid IPMI stack lets a network attacker with no credentials complete IPMI 2.0 RAKP session authentication and obtain full BMC control. A crafted RAKP Message 1 forces the handler to return before the authentication object's constructor defaults are overwritten, so the service accepts a RAKP Message 3 whose HMAC is keyed with the hard-coded 20-byte 'userKey' derived from the string '0penBmc' combined with an often-predictable 'bmcRandomNum'. The flaw affects downstream vendors that ship phosphor-net-ipmid as their IPMI implementation, including NVIDIA and H3C, and runZero published a public advisory; no CISA KEV entry or EPSS score was supplied, and no patched version was identified in the provided data.
We need answer JSON only. Need understand CVE. Need synthesize. Need fill fields. Let's parse data. CVE-2026-57147. PraisonAI multi-agent system. Prior to 0.1.6, praisonai_platform/services/auth_service.py assigns public dev-secret-change-me value to JWT_SECRET when PLATFORM_JWT_SECRET unset, production guard does not run when PLATFORM_ENV unset because defaults dev. Remote unauthenticated attacker can mint HS256 token arbitrary sub/email, AuthService._verify_token() and get_current_user dependency accept forged identity for protected API routes. Fixed in praisonai-platform 0.1.6. CVSS 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. CWE-798. Reported by GitHub_M. CPEs: cpe:2.3:a:mervinpraison:praisonai:*:*:*:*:*:*:*:*, cpe:2.3:a:mervinpraison:praisonai-platform:*:*:*:*:*:*:*:* Tags: Authentication Bypass, Praisonai, Praisonai Platform References: GHSA-cwj8-7gp2-ggcw, PR 1793, commit e0fb..., release tag v4.6.51 (interesting? maybe unrelated release?). Source code evidence: advisory summary. Package praisonai-platform PyPI latest tested 0.1.4, current 2026-06-01. Weakness CWE-798 + CWE-1188. Detail of code. Also fix diff shows examples eval changes, not auth_service? Maybe PR includes unrelated? But description says fixed in 0.1.6. "Package: pip/praisonai-platform — vulnerable: <= 0.1.4 — fixed in: 0.1.6" Hmm maybe <=0.1.5? We say prior to 0.1.6. Need product_name: 1-3 words. likely "PraisonAI Platform" or "praisonai-platform". Use "PraisonAI Platform". Summary not copy description. Need mention specific. Technical context. Risk assessment: CVSS 9.8, EPSS? Not provided. We need say EPSS unknown/not provided. KEV? Input no KEV field. We have no KEV status. POC? Not provided, but exploit technique described publicly in GHSA. Need use only phrases: if neither POC no KEV? But source advisory with detailed exploit maybe no explicit POC. We can say "no public exploit identified at time of analysis" perhaps but technical advisory demonstrates forging token. Need not overstate
Hard-coded bootloader credentials in the ANJIA AJL33PC0801 IP camera allow any attacker with physical device access to authenticate to the bootloader without knowing a legitimate password. Successful exploitation grants full control over firmware loading and system configuration, enabling persistent device compromise, implant installation, or complete operational disruption. CISA issued ICS advisory ICSA-26-251-01 for this vulnerability; no public exploit or CISA KEV listing has been identified at time of analysis.
We need answer JSON only. Need synthesize. Must use data. Need be careful with every field strings. We need analyze CVE-2026-79396. Need not copy description. Need incorporate all data. Need investigate references? We have references to GitHub and NVD. We need produce original synthesis. Let's parse input. CVE ID: CVE-2026-79396 Description: Use of hardcoded default credentials in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier stores static account credentials in unencrypted plaintext within bin/config.xml and compiled into the Sofia executable, allowing remote attackers to gain full administrative control over the camera. CVSS Score: 9.8 CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CWE: CWE-798 EPSS 0.18% percentile 8% Reported by mitre CPE: cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:* Tags: Authentication Bypass, N A ENISA EUVD ID: EUVD-2026-76189 Affected versions: ["n/a n/a"] References: cveorg None https://github.com/ShiroiBoushi/vulnerability-research/tree/main/CVE-2026-79396 euvd advisory https://nvd.nist.gov/vuln/detail/CVE-2026-79396 Need output product_name: 1-3 words. "Xiongmai IP Camera" or "Xiongmai XM530". Product specific. I think "Xiongmai IP Camera" 3 words? Xiongmai IP Camera = 3. Or "Xiongmai XM530" = 2. Probably "Xiongmai XM530". Need product name not vendor alone. Use Xiongmai IP Camera maybe. Summary: 2-3 sentences. Do not start with A vulnerability. Start with specific impact verb and product. We can say "Hardcoded default credentials in Xiongmai XM530 IP camera firmware HMT.CM2005-v220608.1837 and earlier allow remote unauthenticated attackers to achieve full administrative control by extracting or reusing static plaintext credentials from bin/config.xml and the Sofia executable." Need mention if actively exploited? KEV absent. POC? Reference is GitHub vulnerability-research. Could mean POC exists? But not explicitly says POC. We can mention "public proof-of-concept/research is accessible on GitHub" perhaps. E
Sensitive health-data exposure in the Lenovo Health Android application (distributed exclusively in the Chinese market) stems from hardcoded credentials (CWE-798) that let an attacker access users' health-related information without legitimate authentication. Reported by Lenovo PSIRT and tracked under a single Lenovo advisory, it carries a CVSS 4.0 base of 9.3 driven by high confidentiality impact. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Hardcoded or algorithmically derivable Wi-Fi credentials in the Softish C6 Ear Camera (firmware 1.3.1_Code 132) and companion EarVision Android application (1.3.1) allow an adjacent-network attacker to reconstruct the device's access-point password without authentication. Once the attacker connects to the camera's private Wi-Fi network, the live video stream, device management interfaces, status pages, and the firmware-update endpoint become fully accessible. The vulnerability was disclosed via CISA ICS-CERT advisory VA-26-251-01 and carries a CVSS 4.0 score of 8.7 reflecting high impact across confidentiality, integrity, and availability within the vulnerable system.
Hard-coded credentials in Dell Secure Connect Gateway (SCG) 5.0 expose both the Appliance and Application deployments to unauthenticated remote information disclosure. Any attacker who discovers or reverse-engineers the embedded static credentials - which cannot be changed by administrators - can authenticate to the gateway without valid user accounts and access sensitive information. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no privileges or user interaction; no public exploit or CISA KEV listing is recorded at time of analysis.
Hard-coded credentials embedded in Dell Secure Connect Gateway 5.0 allow a remote, unauthenticated attacker to authenticate to the service using the static credentials and access sensitive information. Both the Appliance variant (all versions prior to 5.36.00.16) and the Application variant (all versions prior to 5.36.00.00) are affected, as confirmed by Dell advisory DSA-2026-382. No public exploit code or active exploitation has been identified, but CWE-798 credentials are static across all unpatched installations worldwide, meaning any party with knowledge of them can exploit any exposed instance without further effort.
Hard-coded credentials in Dell Secure Connect Gateway (SCG) 5.0 expose sensitive information to unauthenticated remote attackers across both the Appliance and Application deployment variants. The vulnerability (CWE-798) allows an attacker who discovers or possesses the embedded credentials to authenticate without authorization and access confidential data. Dell has released patched versions under advisory DSA-2026-382, and no public exploits or CISA KEV listing have been identified at time of analysis.
We need answer JSON only. Need synthesize. Need follow precision. Let's parse input. CVE-2026-71801 description: s-pms SPMS-Server through v1.0 hardcoded default access token secret core config file, not overridden/removed production. Remote unauthenticated attacker can locally forge valid admin session tokens bypass auth gaining full unauthorized access to protected backend APIs. CVSS 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. CWE-798 hardcoded credentials. EPSS 0.24% percentile 15. Reported by mitre. CPE cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:* (bad). Tags: Authentication Bypass, N A. EUVD. References: github issue, nvd. Need output fields. product_name: "SPMS-Server" maybe 1-3 words. s-pms SPMS-Server. Could be "SPMS-Server". Summary: original synthesis. Don't copy description. Start with specific impact verb and product. E.g. "Authentication bypass in SPMS-Server through v1.0 allows remote unauthenticated attackers to forge administrative session tokens and access protected backend APIs." Mention hardcoded default token secret, not overridden production. No KEV, no POC? POC? References github issue maybe vulnerability report not POC? Input does not have POC explicitly. Need not claim POC exists. EPSS low 0.24 percentile 15. "No public exploit identified at time of analysis" though GitHub issue maybe report. Need use only phrases. KEV not present. Use "no public exploit identified at time of analysis". But maybe references include github issue; it's vulnerability disclosure not necessarily exploit. We can mention POC status? Need no. Technical_context: CWE-798 Use of Hard-coded Credentials. Underlying auth likely token-based with secret stored in config. CPE is n/a but affected product is SPMS-Server through v1.0. Explain hardcoded default access token secret in core config; not overridden production profile leads to token forgery. Use CWE. risk_assessment: Assess CVSS 9.8 critical, AV:N/AC:L/PR:N/UI:N, high C/I/A. EPSS 0.24 percentile 15 suggests low likelihood of wid