2026-10-26T17:19:25Z https://nostr.now Hardcoded Credentials Bot https://nostr.now/npub1zm28jgxe6mcklzjgt57lq93yzyw44ehu3r44c9jlndfd2w3423vsatc7ug https://media.infosec.exchange/infosec.exchange/accounts/avatars/117/320/525/837/941/155/original/00989afed2810a0e.gif https://media.infosec.exchange/infosec.exchange/accounts/avatars/117/320/525/837/941/155/original/00989afed2810a0e.gif https://nostr.now/nevent1qqsdmhlzsymxu4ncyf66acus0y7dyejhe5zwawn360jpgp0sljym3lszyqtdg7fqm8t0zmu2fpwnmuqkysg36khxljywkhqkt7d494f6x429jh80xs9 New hardcoded credential CVE!<br/>CVE-2026-61729 - <a href="https://www.cve.org/CVERecord?id=CVE-2026-61729">https://www.cve.org/CVERecord?id=CVE-2026-61729</a><br/>socfortress - CoPilot<br/>SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.76, `verify_graylog_header` in `backend/app/active_response/routes/graylog.py` and `verify_velociraptor_header` in `backend/app/incidents/routes/incident_alert.py` authenticate webhooks against `GRAYLOG_API_HEADER_VALUE` and `VELOCIRAPTOR_API_HEADER_VALUE` with the same publicly hardcoded fallback. The same default is shipped in `.env.example`. Deployments that leave either setting unset or unchanged permit an anonymous caller with the known header value to bypass the JWT authentication required by normal APIs. `POST /api/graylog/invoke` forwards attacker-selected `COMMAND`, `ACTION`, `VALUE` and `AGENT_ID` to the configured Wazuh manager without the command-enum validation of the authenticated invocation route, allowing active-response scripts to disrupt endpoints and manipulate defensive controls. `POST /api/incidents/alerts/create/threshold` and `POST /api/incidents/alerts/create/velo-sigma` accept forged alerts for arbitrary `customer_code` values and drive attacker-controlled OpenSearch queries. Active-response delivery requires a configured reachable Wazuh manager. Deployments with independently changed header secrets are not subject to this default-secret bypass. This issue is fixed in version 0.1.76. 2026-10-30T15:00:05Z https://nostr.now/nevent1qqsfyeu2qevvx5rdu6c0834kndrqp6mcq36kketqjj4udukmm4jfuhszyqtdg7fqm8t0zmu2fpwnmuqkysg36khxljywkhqkt7d494f6x429jaepcxk New hardcoded credential CVE!<br/>CVE-2014-125135 - <a href="https://www.cve.org/CVERecord?id=CVE-2014-125135">https://www.cve.org/CVERecord?id=CVE-2014-125135</a><br/>n/a - OctoPrint<br/>A security vulnerability has been detected in OctoPrint 1.0.0/1.1.0. Affected is an unknown function of the component Flask Secret Key Handler. Such manipulation leads to use of hard-coded cryptographic key<br/> . The attack may be performed from remote. Upgrading to version 1.11.1 is able to address this issue. The name of the patch is b4699825d6ab92d5451e5b1e3a06dfb81f86e777. The affected component should be upgraded. 2026-10-26T20:00:03Z https://nostr.now/nevent1qqsr3386flvsrleewrugdumntu5d7hczf6zv3ckhe34qdz2txfzw0qczyqtdg7fqm8t0zmu2fpwnmuqkysg36khxljywkhqkt7d494f6x429j7q6dqu New hardcoded credential CVE!<br/>CVE-2026-71456 - <a href="https://www.cve.org/CVERecord?id=CVE-2026-71456">https://www.cve.org/CVERecord?id=CVE-2026-71456</a><br/>Johnson Controls - Kantech Entrapass<br/>Use of hard-coded cryptographic key vulnerability in Johnson Controls Kantech Entrapass allows Padding Oracle Crypto Attack.<br/><br/>This issue affects Kantech Entrapass: before 9.20. 2026-10-26T17:00:21Z https://nostr.now/nevent1qqs87weewlrh3e24czakssrtv4te0k0qsk9cl2q053qgvn0ax0askdszyqtdg7fqm8t0zmu2fpwnmuqkysg36khxljywkhqkt7d494f6x429j9rrv36 New hardcoded credential CVE!<br/>CVE-2026-114119 - <a href="https://www.cve.org/CVERecord?id=CVE-2026-114119">https://www.cve.org/CVERecord?id=CVE-2026-114119</a><br/>Best Practice Software - Bp Premier<br/>Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server administrative password that is shared across all installations and cannot be changed without breaking the application. Attackers with network access to the database instance can authenticate as sysadmin, bypass application authentication, and execute operating system commands as SYSTEM. 2026-10-21T00:59:26Z https://nostr.now/nevent1qqsr5p597h2tjj6vm8ma8zvxfc9h3kzx37unsrkzcghl9jnda5l92tczyqtdg7fqm8t0zmu2fpwnmuqkysg36khxljywkhqkt7d494f6x429j2hu9em New hardcoded credential CVE!<br/>CVE-2026-109126 - <a href="https://www.cve.org/CVERecord?id=CVE-2026-109126">https://www.cve.org/CVERecord?id=CVE-2026-109126</a><br/>IBM - Security Verify Access<br/>IBM - Verify Identity Access<br/>IBM Verify Identity Access 11.0.3.1 and IBM Security Verify Access 10.0.9.3 Appliance could allow a physically proximate attacker to gain elevated privileges due to the use of hard-coded credentials. 2026-10-20T00:59:12Z https://nostr.now/nevent1qqs2mu6gyujva9fjkerngt0kmeum448reqhc5vhzkhrdacw8l0a8gjgzyqtdg7fqm8t0zmu2fpwnmuqkysg36khxljywkhqkt7d494f6x429jlpkj27 New hardcoded credential CVE!<br/>CVE-2026-112146 - <a href="https://www.cve.org/CVERecord?id=CVE-2026-112146">https://www.cve.org/CVERecord?id=CVE-2026-112146</a><br/>D-Link - R15<br/>D-Link - E15<br/>D-Link - M32<br/>D-Link - R32<br/>A vulnerability was detected in D-Link E15, M32, R15 and R32. This issue affects some unknown processing of the file /etc/emDaemon/passwd of the component MQTT Broker. The manipulation results in hard-coded credentials. It is possible to launch the attack remotely. The exploit is now public and may be used. 2026-10-19T14:59:09Z https://nostr.now/nevent1qqsqv8g22m72k03hscry4urct7dq2anvw5jwkj0mahctcf8ex9feskczyqtdg7fqm8t0zmu2fpwnmuqkysg36khxljywkhqkt7d494f6x429jsf9a22 New hardcoded credential CVE!<br/>CVE-2026-107617 - <a href="https://www.cve.org/CVERecord?id=CVE-2026-107617">https://www.cve.org/CVERecord?id=CVE-2026-107617</a><br/>Guangzhou Juan IoT Technology Co., Ltd. - EseeCloud App<br/>Guangzhou Juan IoT Technology Co., Ltd. - EseeCloud Firmware<br/>An attacker can use a hard-coded credential to log in to EseeCloud devices. 2026-10-16T14:59:23Z https://nostr.now/nevent1qqstkaw2gdhatg0935hthgczcwhx0lmzfncv22mx3w7w3qzlc8673rszyqtdg7fqm8t0zmu2fpwnmuqkysg36khxljywkhqkt7d494f6x429jkazjpd New hardcoded credential CVE!<br/>CVE-2026-107171 - <a href="https://www.cve.org/CVERecord?id=CVE-2026-107171">https://www.cve.org/CVERecord?id=CVE-2026-107171</a><br/>Trellix - Trellix Agent<br/>An Hardcoded Cryptographic Key vulnerability existed in Trellix Agent 5.8.4 via mfecryptc.dll leads to Database Decryption by Regular Users. 2026-10-14T07:59:10Z https://nostr.now/nevent1qqsquw07mwrkh2felk7pvd902p54dqmfg9lwr9atjag5pnckqsj080szyqtdg7fqm8t0zmu2fpwnmuqkysg36khxljywkhqkt7d494f6x429j45cu9g New hardcoded credential CVE!<br/>CVE-2026-81964 - <a href="https://www.cve.org/CVERecord?id=CVE-2026-81964">https://www.cve.org/CVERecord?id=CVE-2026-81964</a><br/>Microsoft - Windows Server 2025<br/>Microsoft - Windows 10 Version 22H2<br/>Microsoft - Windows 10 Version 21H2<br/>Microsoft - Windows Server 2022<br/>Microsoft - Windows 11 Version 24H2<br/>Microsoft - Windows Server 2025 (Server Core installation)<br/>Microsoft - Windows 11 Version 23H2<br/>Microsoft - Windows 11 Version 25H2<br/>Microsoft - Windows 11 version 23H2<br/>Microsoft - Windows 11 Version 26H2<br/>Microsoft - Windows 11 version 26H1<br/>Use of hard-coded credentials in Windows Update Orchestrator Service allows an authorized attacker to bypass a security feature locally. 2026-10-13T19:59:17Z https://nostr.now/nevent1qqsy4g24egdddhksccmu7xpyhju7rkuvu0k5nljr0v5j5kx4kpuez8czyqtdg7fqm8t0zmu2fpwnmuqkysg36khxljywkhqkt7d494f6x429jdykrty New hardcoded credential CVE!<br/>CVE-2026-85963 - <a href="https://www.cve.org/CVERecord?id=CVE-2026-85963">https://www.cve.org/CVERecord?id=CVE-2026-85963</a><br/>Progress Software Corporation - MarkLogic Server<br/>Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 include deprecated OpsDirector functionality with weaknesses that could allow an unauthenticated remote attacker to make unauthorized requests to internal services or forge trusted requests, potentially resulting in unauthorized access to protected information. 2026-10-12T16:59:24Z https://nostr.now/nevent1qqs2t7srj5rtljn9pas38gnvxad336evnxlcknwag440n6aegcdkl8czyqtdg7fqm8t0zmu2fpwnmuqkysg36khxljywkhqkt7d494f6x429jsvzvf7 New hardcoded credential CVE!<br/>CVE-2026-108584 - <a href="https://www.cve.org/CVERecord?id=CVE-2026-108584">https://www.cve.org/CVERecord?id=CVE-2026-108584</a><br/>FunnyWolf - Viper<br/>A security flaw has been discovered in FunnyWolf Viper up to 3.1.11. The affected element is an unknown function of the file /root/viper/.git/config. Performing a manipulation results in hard-coded credentials. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. 2026-10-11T13:59:09Z https://nostr.now/nevent1qqs0ng6actjkfrdp5hhsrshtlf5lec55j4087d7xwrdel6ppzzwdl8czyqtdg7fqm8t0zmu2fpwnmuqkysg36khxljywkhqkt7d494f6x429j6nwm6r New hardcoded credential CVE!<br/>CVE-2026-108753 - <a href="https://www.cve.org/CVERecord?id=CVE-2026-108753">https://www.cve.org/CVERecord?id=CVE-2026-108753</a><br/>agnaistic - agnai<br/>Agnaistic agnai through 1.0.555 contains a hard-coded credentials vulnerability in self-host.docker-compose.yml, which sets a fixed admin password and public JWT secret. Unauthenticated attackers can log in as admin or sign their own JWT with admin: true to impersonate users, reset passwords, and change server configuration. 2026-10-11T12:58:56Z https://nostr.now/nevent1qqsyqdc39mkd0dluvyrhs72t0av937lt0spx0vf20zzgnyhvr742m4gzyqtdg7fqm8t0zmu2fpwnmuqkysg36khxljywkhqkt7d494f6x429jtchehf New hardcoded credential CVE!<br/>CVE-2026-84891 - <a href="https://www.cve.org/CVERecord?id=CVE-2026-84891">https://www.cve.org/CVERecord?id=CVE-2026-84891</a><br/>IBM - Guardium Data Protection<br/>IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to obtain sensitive information due to use of hard-coded credentials. 2026-10-08T21:59:33Z https://nostr.now/nevent1qqspdfrgjt37z8v8g4axc8d8n5dcwdfhpf39t4p3r56g4ryxz9hyazqzyqtdg7fqm8t0zmu2fpwnmuqkysg36khxljywkhqkt7d494f6x429jagqapc New hardcoded credential CVE!<br/>CVE-2026-103778 - <a href="https://www.cve.org/CVERecord?id=CVE-2026-103778">https://www.cve.org/CVERecord?id=CVE-2026-103778</a><br/>Dell - Command | Configure (DCC)<br/>Dell Command | Configure (DCC), versions prior to 5.2.3.35 contain a Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Information disclosure. 2026-10-06T19:59:14Z https://nostr.now/nevent1qqsy0aspr7qwcrg6f66v0cr4xtqmv4glq4epknsfh0fmrsh65fe505szyqtdg7fqm8t0zmu2fpwnmuqkysg36khxljywkhqkt7d494f6x429jhqkyal New hardcoded credential CVE!<br/>CVE-2026-61421 - <a href="https://www.cve.org/CVERecord?id=CVE-2026-61421">https://www.cve.org/CVERecord?id=CVE-2026-61421</a><br/>Dell - Container Storage Modules<br/>Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Use of Hard-coded Credentials vulnerability in the CSM Authorization. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges. 2026-10-06T15:59:05Z https://nostr.now/nevent1qqs84l5nfx9zl9y5z8macpj94sfypn9su7feu4ycfrxsysh3t4ysfgczyqtdg7fqm8t0zmu2fpwnmuqkysg36khxljywkhqkt7d494f6x429jjsqt69 New hardcoded credential CVE!<br/>CVE-2026-13043 - <a href="https://www.cve.org/CVERecord?id=CVE-2026-13043">https://www.cve.org/CVERecord?id=CVE-2026-13043</a><br/>WatchGuard - Endpoint Security<br/>A missing authentication vulnerability in the Kernel Memory Access Driver (PSKMAD) used by WatchGuard endpoint security products allows a local, authenticated attacker to bypass the driver&#39;s access-control handshake and issue arbitrary privileged commands to the driver, resulting in disclosure of kernel and process memory. 2026-10-01T16:59:34Z https://nostr.now/nevent1qqszry6ajla6qh7av98pfuzk94mxpr5xmu36a46dw640x43srhgg0eszyqtdg7fqm8t0zmu2fpwnmuqkysg36khxljywkhqkt7d494f6x429jwk3zwj New hardcoded credential CVE!<br/>CVE-2026-67104 - <a href="https://www.cve.org/CVERecord?id=CVE-2026-67104">https://www.cve.org/CVERecord?id=CVE-2026-67104</a><br/>HCL Software - HCL BigFix Service Management<br/>HCL BigFix Service Management is affected by an Information Disclosure vulnerability, which could allow an unauthenticated attacker to analyze publicly accessible JavaScript files, enabling the discovery of hidden administrative API endpoints for further targeted exploitation. 2026-10-01T15:59:40Z https://nostr.now/nevent1qqsy02jyc7xwft8qpk23qaw6r0clmau2fe4962lrs9w3nuexlj5csxczyqtdg7fqm8t0zmu2fpwnmuqkysg36khxljywkhqkt7d494f6x429j4z47zs New hardcoded credential CVE!<br/>CVE-2026-76708 - <a href="https://www.cve.org/CVERecord?id=CVE-2026-76708">https://www.cve.org/CVERecord?id=CVE-2026-76708</a><br/>Hewlett Packard Enterprise (HPE) - ALE<br/>A vulnerability exists in the Analytics and Location Engine (ALE) where the application and underlying operating system use default, hard-coded credentials for several administrative and system accounts. An unauthenticated remote attacker could exploit this vulnerability by attempting to log in using these known default credentials.<br/><br/>Successful exploitation could result in an attacker gaining unauthorized access to the application&#39;s management interface and the underlying operating system, potentially leading to full system compromise. 2026-09-28T16:38:56Z https://nostr.now/nevent1qqsxcerx6kyj8tpzehc3j9fvcq9300v7hcfh672x4mgqulc4lmge8fqzyqtdg7fqm8t0zmu2fpwnmuqkysg36khxljywkhqkt7d494f6x429jxrdzme New hardcoded credential CVE!<br/>CVE-2026-70413 - <a href="https://www.cve.org/CVERecord?id=CVE-2026-70413">https://www.cve.org/CVERecord?id=CVE-2026-70413</a><br/>Dell - Live Optics Collector<br/>Dell Live Optics Collector, versions prior to 27.2.13.310, contain(s) a Use of Hard-coded Password vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure. 2026-09-28T16:38:53Z https://nostr.now/nevent1qqs8h3uy20esuztdacw95l7pgnwsx64m89ncr355gjcwnx7jsm2jcqczyqtdg7fqm8t0zmu2fpwnmuqkysg36khxljywkhqkt7d494f6x429jju44qa New hardcoded credential CVE!<br/>CVE-2026-18181 - <a href="https://www.cve.org/CVERecord?id=CVE-2026-18181">https://www.cve.org/CVERecord?id=CVE-2026-18181</a><br/>IBM - Financial Transaction Manager (FTM) for RedHat OpenShift<br/>IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to bypass authentication and access sensitive information due to a hard-coded cryptographic key. 2026-09-28T16:38:50Z https://nostr.now/nevent1qqsgnkzhe30dzavegfrphclpddzekp7j3a7f8re3yukd2vw4ulden9qzyqtdg7fqm8t0zmu2fpwnmuqkysg36khxljywkhqkt7d494f6x429jpncq66 New hardcoded credential CVE!<br/>CVE-2018-25069 - <a href="https://www.cve.org/CVERecord?id=CVE-2018-25069">https://www.cve.org/CVERecord?id=CVE-2018-25069</a><br/>Netis - Netcore Router<br/>A vulnerability classified as critical has been found in Netis Netcore Router. This affects an unknown part. The manipulation leads to use of hard-coded password. It is possible to initiate the attack remotely. The identifier VDB-217593 was assigned to this vulnerability. 2026-09-23T14:57:01Z