Set up in your agent.

One prompt to get started. Paste it into your coding agent to connect cve.new through MCP and bring vulnerability context into your workflow.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

Skip to content
cve.newCreate a CVE report

Your agent Now with CVE context

Find published vulnerabilities, affected versions, and available fixes.
Bring the source evidence into your coding agent to investigate what affects your project.

MoxsoSponsored by MoxsoBuild security habits with adaptive training and phishing simulations.Opens in a new tab
ORIGINAL EVIDENCE. READY FOR YOUR WORKFLOW.CVE / OSV / CISA KEV

Find vulnerabilities that affect you.

Explore advisories by severity, ecosystem, and known exploitation. Take the evidence into your next agent session.

Recent security developments
Severity
Clear filters
19 matching advisories · 19 shown
Explore packages Subscribe to these results
Follow substantive record changes →
SEVERITYVULNERABILITY / AFFECTED PACKAGESPUBLISHED
high8.4
CVE-2025-53697

Use of default credentials vulnerability in Johnson Controls iSTAR Ultra, Johnson Controls iSTAR Ultra SE, Johnson Controls iSTAR Ultra G2, Johnson Controls…

Use of default credentials vulnerability in Johnson Controls iSTAR Ultra, Johnson Controls iSTAR Ultra SE, Johnson Controls iSTAR Ultra G2, Johnson Controls iSTAR Ultra G2 SE, and Johnson Controls iSTAR Edge G2 allows CAPEC‑560: Use of Default Credentials.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Johnson Controls · iSTAR Ultra / Johnson Controls · iSTAR Ultra SE
critical9.2
CVE-2026-124006

Dixell/Copeland XWEB EVO Predictable Root Password Generation

XWEB EVO through 5.8.8 contains a predictable credential generation vulnerability that allows attackers to derive the Linux root password by computing a fixed prefix combined with a daily password value. Attackers can calculate the deterministic root credential, which before 5.7.0 was identical across all units and from 5.7.0 onward remains derivable from the MAC-based daily password, to gain unauthorized root access to the underlying operating system. This product line reached it's end of service date in March 2026.

No structured fix or guidance is available here. Check the latest publisher advisory.

Public exploit reference

Copeland · XWEB EVO
critical9.3
CVE-2026-127063

The third-party RMM+ extension for ConnectWise ScreenConnect uses a static API secret by default.

The third-party RMM+ extension for ConnectWise ScreenConnect uses a static API secret by default. The value can be changed by an administrator; however, environments retaining the default value may allow unauthorized access to extension API functionality, including the ability to send commands to managed agents. This issue is specific to the third-party extension and does not affect the ScreenConnect server or client.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

DataComm · RMM+
high7.1
CVE-2026-81936

Default OpenBMC Root Credential Reintroduced After Reset to Defaults in ThinkSystem v4 XCC3

An internal security review identified a development regression from ThinkSystem v4 XClarity Controller 3 (XCC3) versions (2.51) IHX432Y to (2.56) IHX436K which re-introduces the default OpenBMC root password upon performing an XCC Reset to Default operation.  An attacker can gain access to enabled administrative interfaces of XCC using the default OpenBMC credential re-introduced after Reset to Default. Additionally, this provides access to the underlying XCC Operating System which is not normally accessible. Only these versions are affected and are no longer available for download. Process enhancements have also been made to prevent and identify potential future regression.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Lenovo · XClarity Controller
unknown
CVE-2026-111257

Apache TomEE: Well-known administrative credentials created at startup

With the default configuration and no users defined in the default user database, TomEE silently adds an administrative user with a well-known password at startup. A remote attacker can use these credentials to authenticate to web applications that use the default realm and grant access to any authenticated user or to the TomEE administrative role. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Apache Software Foundation · Apache TomEE / Apache Software Foundation · Apache TomEE
critical9.8
CVE-2026-125384

INDOTALENT WHMS before 10.20261109 Default Administrator Credentials via UserAdminSeeder

INDOTALENT WHMS before 10.20261109 contains a default credentials vulnerability that allows unauthenticated attackers to gain administrator access because UserAdminSeeder creates admin@root.com with password 123456. Attackers can log in with these credentials, which carry every admin role and no forced password change, to fully control deployments that kept them.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

go2ismail · Asp.Net-Core-Inventory-Order-Management-System
medium6.1
CVE-2026-118792

Default ODBC credentials

Default credentials permit access through AcuXDBC.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

CompuGroup Medical · Wingesfar
medium6.9
CVE-2026-123553

OpenAM before 16.1.4 Default Credentials in Built-in Accounts Allow Unauthenticated Login

OpenAM before 16.1.4 ships built-in identities in the Top Level Realm (demo, anonymous, wsc, wsp, SecurityTokenService and agentAuth) with passwords that are identical on every installation, publicly known, and able to authenticate. Unauthenticated remote attackers can log in as these identities to obtain authenticated sessions, and the agent identities can read the configuration of other agent profiles.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

OpenIdentityPlatform · OpenAM / OpenIdentityPlatform · OpenAM
high8.3
CVE-2026-123998

Hisense VIDAA Smart TV MQTT Broker Authentication Bypass

Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an authentication bypass vulnerability in its remote-control MQTT broker on TCP port 36669, which accepts publicly documented default credentials and an ineffective 4-digit pairing PIN with no rate limiting or lockout, allowing a brute force of the entire code space in about five seconds, while some actions require no pairing at all. A LAN-adjacent attacker can exploit this to inject key events, change volume, switch input sources, enumerate inputs, launch arbitrary installed applications, and monitor pairing activity, posing a significant risk in hotel deployments where untrusted LAN access is common.

No structured fix or guidance is available here. Check the latest publisher advisory.

Public exploit reference

Hisense · VIDAA
high7.2
CVE-2026-94459

IRISPowerscan Default accounts with predictable credentials

IRISPowerscan contain default user accounts with predictable credentials. An unauthenticated attacker with access to an affected installation could use these credentials to authenticate to the application and access functionality available to the affected accounts, potentially resulting in unauthorised access or modification of application data and configuration.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

I.R.I.S S.A. · IRISPowerscan
critical9.8
CVE-2026-112354

Etrel INCH AC Charging Station Hard-coded Default Credentials

Etrel INCH AC charging station management web interface prior to firmware versions 7.1.2 and 8.0.1 contains a hard-coded default credentials vulnerability that allows remote attackers to gain full Administrator access by authenticating with the factory-default account. Attackers can log in over cleartext HTTP to obtain complete charger configuration, OCPP ChargePoint Identity, and CSMS WebSocket connection details, enabling unauthorized administrative control of the charging station.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Etrel d.o.o. · Etrel INCH
high8.7
CVE-2026-22105

Use of default password based on serial number

Delta UFC500 charging stations derive the default credentials of the Service account from character positions of the device serial number. An unauthenticated attacker with adjacent network access can reconstruct the resulting password, or exhaust the keyspace, and log in to read and change sensitive settings such as the OCPP backend.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

Delta Electronics · Delta UFC500 / Delta Electronics · Delta UFC500
high8.4
CVE-2026-22109

Default WebUI passwords stored in plaintext

The shipped WebUI template database retains the factory default passwords for all five account types in cleartext. Defaults are identical across devices and were unchanged on the tested unit.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

Delta Electronics · Delta UFC500 / Delta Electronics · Delta UFC500
high7.1
CVE-2026-77056

Use of Default Credentials in boneIO

boneIO black_debian_images ships with a Mosquitto MQTT broker that uses the same default credentials on all devices. These credentials are publicly documented on github, and there is no indication in the instructions to change them. A remote attacker can use them to gain full read and write access to the broker, allowing control of connected relays, blinds, and gates, and injection of fake entities into a linked Home Assistant installation.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

boneIO · black_debian_images
high7.5
CVE-2026-19741

OpenThread joiner autostart uses a publicly documented default Joining Device Credential (PSKd)

Zephyr's OpenThread integration defined CONFIG_OPENTHREAD_JOINER_PSKD with default "J01NME" in modules/openthread/Kconfig.thread (previously subsys/net/l2/openthread/Kconfig, then subsys/net/l2/openthread/Kconfig.thread). J01NME is the example Joining Device Credential used throughout the public OpenThread and Thread commissioning documentation, including Zephyr's own samples/net/sockets/echo_client/README.rst, so it is not a secret. A firmware image built with CONFIG_OPENTHREAD_JOINER_AUTOSTART=y that never overrode the PSKd therefore shipped with a publicly known joining credential compiled in, with no build-time or run-time warning.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

zephyrproject · zephyr
high7.4
CVE-2026-55457

Goobi viewer: Empty webapi.authorization.token default permits unauthenticated authorization bypass

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, Configuration.getWebApiToken returns the empty string when webapi.authorization.token is not configured. AuthorizationFilter compares the supplied token against this default without first checking that the configured token is non-empty. A request to any @AuthorizationBinding-protected endpoint with an empty ?token= value is therefore accepted. This issue has been patched in version 26.05.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

intranda · goobi-viewer-core
critical9.8
CVE-2026-112296

FlyCms through commit edfdf724 Default Super Administrator Credentials

FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super administrator access via the flycms account with password admin123. Attackers can log in through POST /api/auth/login, solving only the image captcha, to obtain full control of site content, users and configuration.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

sunkaifei · FlyCms
critical9.8
CVE-2026-58466

AutoBangumi < 3.2.8 - Hard-coded Default Credentials via add_default_user()

AutoBangumi before 3.2.8 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to authenticate as the administrator by using the publicly known default credentials seeded at startup via add_default_user() in the database user module when the users table is empty. Attackers can submit the default credentials to the authentication login endpoint to gain full control of the application, including RSS feed configuration, downloader configuration, and all authenticated API endpoints.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

EstrellaXD · Auto_Bangumi
medium6.0
CVE-2026-44273

Dell Wyse Management Suite (WMS), versions prior to WMS 2605, contain a Use of Default Credentials vulnerability.

Dell Wyse Management Suite (WMS), versions prior to WMS 2605, contain a Use of Default Credentials vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Information Disclosure.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Dell · Wyse Management Suite (WMS)