Export limit exceeded: 421919 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (437 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-125370 | 1 Kubero-dev | 1 Kubero | 2026-11-10 | 9.8 Critical |
| Kubero 3.0.0 through 3.1.1 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge administrative JWTs by using a hardcoded fallback signing secret when JWT_SECRET is unset. Attackers can sign tokens with arbitrary role, userGroups and permissions claims, which JwtStrategy.validate() trusts without a database lookup, to take control of pipelines, applications, users and API tokens. | ||||
| CVE-2026-124602 | 1 Geovision Inc. | 1 Gv-access | 2026-11-10 | 6.2 Medium |
| The RSA cryptographic key material, including a private key and public key, is embedded within the GV-Access application package. Because Android applications can be extracted and reverse engineered, storing private cryptographic keys directly inside the client application may allow an attacker to recover the keys and potentially use them to impersonate the application, decrypt protected data, or generate unauthorized cryptographic operations. | ||||
| CVE-2026-124604 | 1 Geovision Inc. | 1 Gv-cloud | 2026-11-10 | 6.2 Medium |
| The RSA cryptographic key material, including a private key and public key, is embedded within the GV-Cloud application package. Because Android applications can be extracted and reverse engineered, storing private cryptographic keys directly inside the client application may allow an attacker to recover the keys and potentially use them to impersonate the application, decrypt protected data, or generate unauthorized cryptographic operations. | ||||
| CVE-2026-124599 | 1 Geovision Inc. | 1 Gv-face | 2026-11-10 | 6.2 Medium |
| The RSA cryptographic key material, including a private key and public key, is embedded within the application package. Because Android applications can be extracted and reverse engineered, storing private cryptographic keys directly inside the client application may allow an attacker to recover the keys and potentially use them to impersonate the application, decrypt protected data, or generate unauthorized cryptographic operations. | ||||
| CVE-2026-124598 | 1 Geovision Inc. | 1 Gv-face | 2026-11-10 | 7.5 High |
| An API key is hardcoded and retrievable from the GV-Face package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key. | ||||
| CVE-2026-125383 | 2026-11-09 | 9.8 Critical | ||
| INDOTALENT WHMS (Asp.Net-Core-Inventory-Order-Management-System) before 10.20261109 contains an authentication bypass vulnerability caused by a hard-coded JWT signing key, issuer and audience in appsettings.json. Unauthenticated remote attackers can forge tokens for any user ID and role that the Tokens/DI.cs validator trusts, gaining administrator access to the entire API. | ||||
| CVE-2026-118460 | 1 Compugroup Medical | 4 Infantia, Phronesis, Profim and 1 more | 2026-11-09 | N/A |
| Embedded private keys protected by a shared password can be used to sign practitioner assertions for arbitrary practitioner identifiers, enabling unauthorized practitioner token requests. | ||||
| CVE-2026-118464 | 1 Compugroup Medical | 4 Infantia, Phronesis, Profim and 1 more | 2026-11-09 | N/A |
| Shared cryptographic services use fixed vendor-wide secrets, deterministic IVs, null salts, and reversible transformations to protect credentials, IPC data, configuration values, and clinical fields. | ||||
| CVE-2026-112164 | 2026-11-09 | N/A | ||
| The LaserGest mobile application encrypts stored assistance portal credentials with a hardcoded AES key and IV, allowing an attacker with access to the application package to recover them in cleartext. | ||||
| CVE-2026-17310 | 1 Ibm | 1 Api Connect | 2026-11-08 | 6.5 Medium |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to the use of a hard-coded cryptographic key. | ||||
| CVE-2026-17356 | 1 Ibm | 1 Api Connect | 2026-11-07 | 8.7 High |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a local attacker to obtain sensitive information due to the use of a hard-coded cryptographic key. | ||||
| CVE-2026-92199 | 1 Quest | 1 Foglight For Databases | 2026-11-06 | N/A |
| Quest Foglight for Databases EncryptionUtil Hardcoded Encyption Key Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Quest Foglight for Databases. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the symmetricDecrypt method. The issue results from the use of a hard-coded cryptographic key. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-29967. | ||||
| CVE-2026-39810 | 1 Fortinet | 1 Forticlientems | 2026-11-06 | 5.2 Medium |
| A use of hard-coded cryptographic key vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.5, FortiClientEMS 7.4.0 through 7.4.1 may allow attacker to information disclosure via decrypting database dump. | ||||
| CVE-2026-106172 | 1 Fortinet | 2 Fortisandbox, Fortisandboxcloud | 2026-11-06 | 4.9 Medium |
| A use of hard-coded cryptographic key vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4 all versions, FortiSandbox Cloud 5.0.4 through 5.0.6, FortiSandbox Cloud 5.0.0 through 5.0.2, FortiSandbox Cloud 4.4 all versions may allow attacker to escalation of privilege via specially crafted HTTP requests | ||||
| CVE-2026-115739 | 1 Trellix | 1 Dlp On-prem Extensions | 2026-11-06 | 6.5 Medium |
| Hard-coded Cryptographic Key vulnerability exists in the DLP on-prem extensions version 11.13.1 and earlier allows a remote attacker to decrypt credentials and evidence files. | ||||
| CVE-2026-119597 | 1 Aidotnet | 1 Opendeepwiki | 2026-11-05 | 9.8 Critical |
| OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulnerability that allows unauthenticated attackers to forge administrator tokens using the publicly known Jwt:SecretKey in appsettings.json. Attackers can mint HS256 bearer tokens with an Admin role claim to access /api/admin endpoints and control users, roles, repositories, settings, and API keys. | ||||
| CVE-2026-91912 | 1 Dell | 1 Openmanage Enterprise | 2026-11-05 | 7.3 High |
| Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Use of Hard-coded Cryptographic Key vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure. | ||||
| CVE-2026-116747 | 1 Rajnandan1 | 1 Kener | 2026-11-05 | 8.1 High |
| Kener 3.0.0 before 4.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge session tokens by using the hardcoded DUMMY_SECRET fallback key. When KENER_SECRET_KEY is empty or unset, attackers knowing an administrator email can sign a kener-user cookie to access /manage/api with full administrative privileges or forge password-reset tokens. | ||||
| CVE-2026-105330 | 2 Apache, Apache Software Foundation | 2 Ofbiz, Apache Ofbiz | 2026-11-05 | N/A |
| Use of Hard-coded Cryptographic Key in JWT token authentication in Apache OFBiz 24.09.06 and 24.09.07 on all platforms allows an unauthenticated, network-reachable attacker to obtain full administrative access via a forged JWT signed with the factory-default security.token.key value that CVE-2026-31986 removed from newly generated configurations, on a deployment that upgraded from a release predating that fix while retaining its existing security.properties with security.internal.sso.enabled set to true. Users are recommended to upgrade to version 24.09.08. Upgrading alone does not replace an already-configured key: deployments that carried framework/security/config/security.properties forward from a release predating the CVE-2026-31986 fix must also run './gradlew rotateSecretKeys' after upgrading, since the existing generateSecretKeys task leaves an already-set value untouched. | ||||
| CVE-2026-102812 | 1 Tp-link | 2 Archer C20 V5, Re305 | 2026-11-04 | N/A |
| A hard-coded cryptographic key vulnerability exists in the user-configuration backup mechanism of TP-Link RE305 V3 and Archer C7 V5. A fixed AES-128 key and initialization vector are embedded in the firmware configuration-management component. An attacker who obtains an affected configuration backup file may extract the cryptographic material from the firmware and use it to decrypt the backup. Successful exploitation may disclose sensitive configuration information contained in a backup file, including administrator passwords and Wi-Fi credentials. | ||||