Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2614)
CWE-79 (1799)
CWE-416 (1282)
CWE-862 (1168)
CWE-89 (1090)
CWE-22 (1018)
CWE-125 (867)
CWE-200 (840)
CWE-306 (832)
CWE-122 (826)
CWE-20 (789)
CWE-78 (701)
CWE-918 (685)
CWE-787 (677)
CWE-94 (637)
CWE-863 (603)
CWE-74 (600)
CWE-639 (534)
CWE-400 (513)
CWE-269 (499)
CWE-119 (494)
CWE-502 (467)
CWE-770 (432)
CWE-287 (424)
CWE-121 (404)
CWE-77 (372)
CWE-190 (362)
CWE-362 (321)
CWE-352 (271)
CWE-285 (241)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-42869 |
critical | 10.0 | 0.0056 | 2026-05-11 | SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations nee | |
CVE-2026-11414 |
critical | 10.0 | 0.0048 | 2026-06-05 | A hard-coded cryptographic key is used by Altium Enterprise Server to sign file download URLs in the | |
CVE-2026-45336 |
critical | 10.0 | 0.0056 | 2026-07-16 | HireFlow is a web-based interview management system for managing candidates, scheduling interviews, | |
CVE-2026-8982 |
critical | 10.0 | 0.0048 | 2026-07-21 | Two undocumented privileged accounts exist in Autel Maxi Charger Single firmware through V1.03.51. T | |
CVE-2026-8983 |
critical | 10.0 | 0.0069 | 2026-07-21 | Autel Maxi Charger Single firmware through V1.03.51 contains a hard-coded authentication token that | |
CVE-2026-18452 |
critical | 10.0 | 0.0063 | 2026-07-31 | DMS+ (Non-Mobile) developed by Rich Source has a Use of Hard-coded Credentials vulnerability. Unauth | |
CVE-2026-46386 |
critical | 9.9 | 0.0049 | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to , the official openproje | |
CVE-2026-42376 |
critical | 9.8 | 0.0046 | 2026-05-04 | D-Link DIR-456U Hardware Revision A1 (End-of-Life, EOL) contains a hardcoded telnet backdoor. The de | |
CVE-2026-7414 |
critical | 9.8 | 0.0053 | 2026-05-07 | Yarbo firmware v2.3.9 contains hardcoded administrative credentials embedded in the firmware image. | |
CVE-2026-50083 |
critical | 9.8 | 0.0036 | 2026-06-12 | The Aqara IAM/SSO Gateway (gw-builder.aqara.com) used a hardcoded OAuth client credential, which is | |
CVE-2026-47846 |
critical | 9.8 | 0.0048 | 2026-06-18 | Bitnami Cassandra container images are affected by a retained default superuser vulnerability. When | |
CVE-2026-49352 |
critical | 9.8 | 0.0060 | 2026-07-15 | 9Router is an AI router & token saver. From 0.2.21 until 0.4.44, 9Router used the hardcoded fallback | |
CVE-2026-13446 |
critical | 9.8 | 0.0038 | 2026-07-17 | IBM Langflow OSS 1.0.0 through 1.10.1 contains hard-coded credentials, such as a password or cryptog | |
CVE-2026-47410 |
critical | 9.8 | 0.0045 | 2026-07-21 | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior | |
CVE-2026-65879 |
critical | 9.8 | 0.0051 | 2026-07-27 | Joomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wide secret | |
CVE-2026-76466 |
critical | 9.8 | 0.0042 | 2026-10-21 | A vulnerability in the database service feature of Cisco Expressway Series could allow an unauthenti | |
CVE-2026-11746 |
critical | 9.4 | 0.0023 | 2026-06-22 | A vulnerability has been identified in centraldogma-server versions prior to 0.84.0, where enabling | |
CVE-2026-71960 |
critical | 9.3 | 0.0053 | 2026-08-19 | Cudy WR3000 2.0 running firmware before 2.5.24 contains a hard-coded JWT HMAC signing secret vulnera | |
CVE-2026-114119 |
critical | 9.3 | 0.0043 | 2026-10-21 | Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server administr | |
CVE-2026-35503 |
critical | 9.3 | 0.0055 | 2026-04-24 | A vulnerability in SenseLive X3050’s web management interface allows authentication logic to be perf | |
CVE-2026-24444 |
critical | 9.3 | 0.0053 | 2026-05-28 | SDMC NE6037 cable modem routers running firmware 7.1.6.0.25 and 7.1.6.1.9_B9 contain a hardcoded pas | |
CVE-2026-11849 |
critical | 9.3 | 0.0035 | 2026-06-12 | The iRM-IEI Remote Management developed by IEI Integration Corp has a Hardcoded Credentials vulnera | |
CVE-2026-61740 |
critical | 9.3 | 0.0051 | 2026-07-15 | LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.4, when LightRAG is d | |
CVE-2026-69102 |
critical | 9.3 | 0.0064 | 2026-08-11 | MaxKey contains an unauthorized access vulnerability due to a hard-coded JWT signing secret in appli | |
CVE-2026-73519 |
critical | 9.3 | 0.0124 | 2026-08-12 | WolfStack before 25.9.2 contains a hard-coded cluster-authentication secret compiled into every buil | |
CVE-2026-59507 |
critical | 9.3 | 0.0034 | 2026-08-13 | : Use of Hard-coded Credentials : Exposure of Sensitive Information to an Unauthorized Actor : Impro | |
CVE-2026-67614 |
critical | 9.3 | 0.0096 | 2026-08-13 | CyberPanel before 3.0.0 contains a hard-coded JWT secret vulnerability in the WebTerminal FastAPI SS | |
CVE-2026-109566 |
critical | 9.3 | 0.0044 | 2026-10-12 | Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerability that allows rem | |
CVE-2025-40938 |
critical | 9.2 | 0.0038 | 2025-12-09 | A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). The affected device | |
CVE-2026-5189 |
critical | 9.2 | 0.0053 | 2026-04-15 | CWE-798: Use of Hard-coded Credentials in Sonatype Nexus Repository Manager versions 3.0.0 through 3 | |
CVE-2026-48242 |
critical | 9.2 | 0.0030 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains hardcoded MySQL database connection credentials (host, user | |
CVE-2026-7839 |
critical | 9.1 | 0.0066 | 2026-07-01 | UltraVNC repeater through 1.8.2.2 initializes the HTTP administration server with a hardcoded defaul | |
CVE-2026-48031 |
critical | 9.1 | 0.0063 | 2026-08-03 | go-base is a Go RESTful API Boilerplate template with JWT Authentication, backed by PostgreSQL. In v | |
CVE-2026-71238 |
critical | 9.1 | 0.0044 | 2026-08-05 | DjangoCRM ships with its Django SECRET_KEY hardcoded directly in the committed webcrm/settings.py ra | |
CVE-2026-114219 |
critical | 9.1 | 0.0034 | 2026-10-22 | NT OneAPP developed by NewType Infortech has a Hard-coded Credentials vulnerability. Unauthenticated | |
CVE-2026-42372 |
high | 8.8 | 0.0030 | 2026-05-04 | D-Link DIR-605L Hardware Revision A1 (End-of-Life, EOL) contains a hardcoded telnet backdoor. The de | |
CVE-2026-42373 |
high | 8.8 | 0.0047 | 2026-05-04 | D-Link DIR-605L Hardware Revision B2 (End-of-Life, EOL) contains a hardcoded telnet backdoor. The de | |
CVE-2026-42374 |
high | 8.8 | 0.0047 | 2026-05-04 | D-Link DIR-600L Hardware Revision B1 (End-of-Life) contains a hardcoded telnet backdoor. The device | |
CVE-2026-42375 |
high | 8.8 | 0.0047 | 2026-05-04 | D-Link DIR-600L Hardware Revision A1 (End-of-Life) contains a hardcoded telnet backdoor. The device | |
CVE-2026-5065 |
high | 8.8 | 0.0019 | 2026-05-27 | IBM Controller 11.0.1, 11.1.0, 11.1.1, and 11.1.2 contains hard-coded credentials, such as a passwor | |
CVE-2026-61684 |
high | 8.8 | 0.0039 | 2026-07-15 | FastGPT is a knowledge-based AI application platform. In 4.15.0-beta4, FastGPT plugin invoke reverse | |
CVE-2024-7952 |
high | 8.7 | 0.0054 | 2026-09-01 | A data exposure vulnerability exists in the affected product. There are hardcoded links in the sourc | |
CVE-2026-32834 |
high | 8.7 | 0.0045 | 2026-05-04 | Easy PayPal Events & Tickets plugin for WordPress before version 1.4 contains a hardcoded authentica | |
CVE-2026-33893 |
high | 8.7 | 0.0029 | 2026-05-12 | A vulnerability has been identified in Teamcenter V2312 (All versions < V2312.0014), Teamcenter V240 | |
CVE-2026-74892 |
high | 8.7 | 0.0051 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain a hardcoded default secret key in the standalone telem | |
CVE-2026-92450 |
high | 8.7 | 0.0037 | 2026-10-22 | The authentication framework used by affected Kiloview E3 NDI encoder firmware signs session JSON We | |
CVE-2026-22312 |
high | 8.6 | 0.0023 | 2026-06-16 | The device has a webserver that exposes a REST API authenticated with a constant token. The unauthen | |
CVE-2026-111419 |
high | 8.6 | 0.0043 | 2026-10-29 | A sensitive information exposure vulnerability exists on the Foxit official website because JavaScri | |
CVE-2026-114088 |
high | 8.3 | 0.0040 | 2026-10-21 | Trigger.dev before 4.5.4 contains a hardcoded default secret vulnerability in the /coordinator Socke | |
CVE-2026-40636 |
high | 7.8 | 0.0022 | 2026-05-11 | Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains a |