Monthly
Songloft 2.9.0 through 2.13.5 ships an embedded Go backend that falls back to the fixed credential pair admin/admin whenever the administrator username and password are omitted from configuration, letting anyone who can reach the service on the local network log in as administrator through /api/v1/auth/login. From that session an attacker can rewrite library and configuration settings and install JavaScript plugins that execute inside the bundled QuickJS runtime, giving code execution in the server context; the mobile/embedded startup path binds 0.0.0.0, which is what makes the service LAN-reachable in the first place. The issue is unauthenticated from the network perspective (CVSS:4.0 AV:A/AC:L/PR:N/UI:N, 8.7; assessed as CVSS:3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is bounded by two things: the attacker must be on an adjacent network, and operators who set a strong admin password are not affected. A public technical writeup describing the admin-takeover attack exists and is referenced by the CVE record, though it is not verified as working exploit code; vendor-released patch 2.13.6 is available and the priority label is this_week. No public exploit code is confirmed and the CVE is not listed as actively exploited (CISA KEV).
Third-party authorization credentials were embedded directly in client-side JavaScript served by the Foxit website (foxit.com), letting any visitor read them without authentication or user interaction and potentially reuse them against the third-party service they authorize. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, base 8.6 High) fits that exposure exactly, including the scope change that reflects impact landing on a separate third-party system rather than on foxit.com itself. EUVD records the affected range as foxit.com before 2026-10-29, and no public exploit code was identified at time of analysis; realistic risk depends on the privileges of the specific third-party service the leaked credentials grant, which has not been disclosed.
Supermicro's X12SPI BMC firmware (01.07.20) does not enforce the integrity and encryption requirements it is supposed to apply to IPMI commands, so an attacker who can reach the management interface can craft packets that execute arbitrary commands inside an already-active IPMI session. The CVSS vector is unauthenticated (PR:N), but exploitation is conditional: the BMC must be network-reachable and a live session must already exist for the attacker to act against, which is why the assessed severity combines high confidentiality, integrity and availability impact with high attack complexity. There is no KEV listing, EPSS is 0.34% (27th percentile) and no public exploit code was identified at time of analysis; the vuln.today decision label is this_week, a genuine but non-emergency priority.
Kiloview E3 NDI encoder firmware before version 1.30 signs session JSON Web Tokens with a single HMAC-SHA256 secret that is hardcoded in the firmware image and shared across every deployed device. Because the firmware is publicly downloadable from the vendor, anyone can extract that secret and forge valid session tokens, including administrative ones, then reach privileged device functions over the network without any credentials and without user interaction. The flaw is remotely exploitable and high impact for confidentiality, integrity and availability in our assessment; no public exploit code or confirmed active exploitation was identified at time of analysis, though the underlying technique requires only offline extraction of a static string plus network reachability to the authentication endpoint. Kiloview has released fixed firmware 1.30, and the vendor advisory (ICSA-26-295-01) is available.
Hard-coded cryptographic key in the NT OneAPP login flow enables remote attackers to decrypt captured authentication requests and recover plaintext user credentials and device information. The issue affects NT OneAPP from NewType Infortech (CPE version wildcard, so all versions unless the vendor states otherwise); exploitation requires the attacker to first obtain encrypted login traffic, which is why the independent assessment rates attack complexity high despite the unauthenticated network vector. No public exploit was identified at time of analysis, and no CISA KEV entry is associated with this CVE.
Unauthenticated remote command execution as root affects Cisco Expressway Series (Expressway-C and Expressway-E) deployments that expose the database service. The flaw combines reusable persistent cookies with a failure to validate client certificates when clustering TLS Verify Mode is set to Enabled, so an attacker in possession of the cookies can connect to the database service and invoke RPC commands to run arbitrary OS commands as root. The CVSS 3.1 score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); no public exploit code was identified at time of analysis, and exploitation requires network reachability to the database and clustering service.
Apache IoTDB 2.0.0 through 2.0.11 mishandles identity in its Legacy Pipe receiver: the handshake and sendPipeData handlers execute data loading and deletion under a hardcoded SUPER_USER (root) identity instead of the caller's own. An authenticated account holding SYSTEM-level privileges such as USE_PIPE or MAINTAIN - but deliberately lacking WRITE_DATA or DELETE_DATA on the target databases - can send crafted PipeData messages and have write/delete operations performed as root, fully bypassing the permission model. Integrity and availability of the targeted data are at risk (the assessed vector scores no confidentiality impact), exploitation requires a valid low-privilege login and a reachable Legacy Pipe interface, EPSS is low at 0.26% (16th percentile), and no public exploit has been identified at time of analysis.
Authentication bypass and SYSTEM-level command execution in Best Practice Software Bp Premier before 1.14.1.1128 stem from a hardcoded, installation-wide Microsoft SQL Server sysadmin password, allowing unauthenticated remote attackers with TCP access to the database to bypass application authentication and execute operating system commands as SYSTEM under the documented default SQL service configuration. The credential is shared across all installations and cannot be changed without breaking the application, so no in-product hardening is possible pending the vendor patch. No public exploit code or CISA KEV entry was identified at time of analysis, but the main constraint is database reachability: deployments exposing SQL Server port 1433 or attackers already on the clinic LAN can exploit it.
Unauthenticated remote attackers can bypass Socket.IO authentication on self-hosted Trigger.dev webapps before 4.5.4 because the /coordinator namespace authenticates against a source-published default COORDINATOR_SECRET ('coordinator-secret') that is absent from the self-hosting docs, .env.example, and Helm values, so operators who never overrode it ship the published value. With that value an attacker can emit READY_FOR_EXECUTION to pull a run's decrypted environment variables (V1/marqs deployments, provided an internal runId is known) or send TASK_RUN_FAILED_TO_RUN, TASK_RUN_COMPLETED, CHECKPOINT_CREATED and similar events to tamper with arbitrary runs. No public exploit code or confirmed active exploitation was identified at time of analysis; exposure is confined to self-hosted deployments left on the default secret, and Trigger.dev Cloud is not implicated by this self-host default-configuration issue.
Hard-coded credentials in IBM Verify Identity Access 11.0.3.1 and IBM Security Verify Access 10.0.9.3 appliances can let an attacker in physical or adjacent-network proximity gain elevated privileges, with CVSS 3.1 score 8.8 reflecting high confidentiality, integrity, and availability impact. The CVSS vector indicates no privileges or user interaction are required (PR:N/UI:N), but the adjacent-network attack vector limits exposure to attackers who can reach the appliance locally or on an adjacent segment. No public exploit code or confirmed active exploitation was identified at time of analysis.
Songloft 2.9.0 through 2.13.5 ships an embedded Go backend that falls back to the fixed credential pair admin/admin whenever the administrator username and password are omitted from configuration, letting anyone who can reach the service on the local network log in as administrator through /api/v1/auth/login. From that session an attacker can rewrite library and configuration settings and install JavaScript plugins that execute inside the bundled QuickJS runtime, giving code execution in the server context; the mobile/embedded startup path binds 0.0.0.0, which is what makes the service LAN-reachable in the first place. The issue is unauthenticated from the network perspective (CVSS:4.0 AV:A/AC:L/PR:N/UI:N, 8.7; assessed as CVSS:3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is bounded by two things: the attacker must be on an adjacent network, and operators who set a strong admin password are not affected. A public technical writeup describing the admin-takeover attack exists and is referenced by the CVE record, though it is not verified as working exploit code; vendor-released patch 2.13.6 is available and the priority label is this_week. No public exploit code is confirmed and the CVE is not listed as actively exploited (CISA KEV).
Third-party authorization credentials were embedded directly in client-side JavaScript served by the Foxit website (foxit.com), letting any visitor read them without authentication or user interaction and potentially reuse them against the third-party service they authorize. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, base 8.6 High) fits that exposure exactly, including the scope change that reflects impact landing on a separate third-party system rather than on foxit.com itself. EUVD records the affected range as foxit.com before 2026-10-29, and no public exploit code was identified at time of analysis; realistic risk depends on the privileges of the specific third-party service the leaked credentials grant, which has not been disclosed.
Supermicro's X12SPI BMC firmware (01.07.20) does not enforce the integrity and encryption requirements it is supposed to apply to IPMI commands, so an attacker who can reach the management interface can craft packets that execute arbitrary commands inside an already-active IPMI session. The CVSS vector is unauthenticated (PR:N), but exploitation is conditional: the BMC must be network-reachable and a live session must already exist for the attacker to act against, which is why the assessed severity combines high confidentiality, integrity and availability impact with high attack complexity. There is no KEV listing, EPSS is 0.34% (27th percentile) and no public exploit code was identified at time of analysis; the vuln.today decision label is this_week, a genuine but non-emergency priority.
Kiloview E3 NDI encoder firmware before version 1.30 signs session JSON Web Tokens with a single HMAC-SHA256 secret that is hardcoded in the firmware image and shared across every deployed device. Because the firmware is publicly downloadable from the vendor, anyone can extract that secret and forge valid session tokens, including administrative ones, then reach privileged device functions over the network without any credentials and without user interaction. The flaw is remotely exploitable and high impact for confidentiality, integrity and availability in our assessment; no public exploit code or confirmed active exploitation was identified at time of analysis, though the underlying technique requires only offline extraction of a static string plus network reachability to the authentication endpoint. Kiloview has released fixed firmware 1.30, and the vendor advisory (ICSA-26-295-01) is available.
Hard-coded cryptographic key in the NT OneAPP login flow enables remote attackers to decrypt captured authentication requests and recover plaintext user credentials and device information. The issue affects NT OneAPP from NewType Infortech (CPE version wildcard, so all versions unless the vendor states otherwise); exploitation requires the attacker to first obtain encrypted login traffic, which is why the independent assessment rates attack complexity high despite the unauthenticated network vector. No public exploit was identified at time of analysis, and no CISA KEV entry is associated with this CVE.
Unauthenticated remote command execution as root affects Cisco Expressway Series (Expressway-C and Expressway-E) deployments that expose the database service. The flaw combines reusable persistent cookies with a failure to validate client certificates when clustering TLS Verify Mode is set to Enabled, so an attacker in possession of the cookies can connect to the database service and invoke RPC commands to run arbitrary OS commands as root. The CVSS 3.1 score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); no public exploit code was identified at time of analysis, and exploitation requires network reachability to the database and clustering service.
Apache IoTDB 2.0.0 through 2.0.11 mishandles identity in its Legacy Pipe receiver: the handshake and sendPipeData handlers execute data loading and deletion under a hardcoded SUPER_USER (root) identity instead of the caller's own. An authenticated account holding SYSTEM-level privileges such as USE_PIPE or MAINTAIN - but deliberately lacking WRITE_DATA or DELETE_DATA on the target databases - can send crafted PipeData messages and have write/delete operations performed as root, fully bypassing the permission model. Integrity and availability of the targeted data are at risk (the assessed vector scores no confidentiality impact), exploitation requires a valid low-privilege login and a reachable Legacy Pipe interface, EPSS is low at 0.26% (16th percentile), and no public exploit has been identified at time of analysis.
Authentication bypass and SYSTEM-level command execution in Best Practice Software Bp Premier before 1.14.1.1128 stem from a hardcoded, installation-wide Microsoft SQL Server sysadmin password, allowing unauthenticated remote attackers with TCP access to the database to bypass application authentication and execute operating system commands as SYSTEM under the documented default SQL service configuration. The credential is shared across all installations and cannot be changed without breaking the application, so no in-product hardening is possible pending the vendor patch. No public exploit code or CISA KEV entry was identified at time of analysis, but the main constraint is database reachability: deployments exposing SQL Server port 1433 or attackers already on the clinic LAN can exploit it.
Unauthenticated remote attackers can bypass Socket.IO authentication on self-hosted Trigger.dev webapps before 4.5.4 because the /coordinator namespace authenticates against a source-published default COORDINATOR_SECRET ('coordinator-secret') that is absent from the self-hosting docs, .env.example, and Helm values, so operators who never overrode it ship the published value. With that value an attacker can emit READY_FOR_EXECUTION to pull a run's decrypted environment variables (V1/marqs deployments, provided an internal runId is known) or send TASK_RUN_FAILED_TO_RUN, TASK_RUN_COMPLETED, CHECKPOINT_CREATED and similar events to tamper with arbitrary runs. No public exploit code or confirmed active exploitation was identified at time of analysis; exposure is confined to self-hosted deployments left on the default secret, and Trigger.dev Cloud is not implicated by this self-host default-configuration issue.
Hard-coded credentials in IBM Verify Identity Access 11.0.3.1 and IBM Security Verify Access 10.0.9.3 appliances can let an attacker in physical or adjacent-network proximity gain elevated privileges, with CVSS 3.1 score 8.8 reflecting high confidentiality, integrity, and availability impact. The CVSS vector indicates no privileges or user interaction are required (PR:N/UI:N), but the adjacent-network attack vector limits exposure to attackers who can reach the appliance locally or on an adjacent segment. No public exploit code or confirmed active exploitation was identified at time of analysis.