Set up in your agent.

One prompt to get started. Paste it into your coding agent to connect cve.new through MCP and bring vulnerability context into your workflow.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

Skip to content
cve.newCreate a CVE report

Your agent Now with CVE context

Find published vulnerabilities, affected versions, and available fixes.
Bring the source evidence into your coding agent to investigate what affects your project.

MoxsoSponsored by MoxsoBuild security habits with adaptive training and phishing simulations.Opens in a new tab
ORIGINAL EVIDENCE. READY FOR YOUR WORKFLOW.CVE / OSV / CISA KEV

Find vulnerabilities that affect you.

Explore advisories by severity, ecosystem, and known exploitation. Take the evidence into your next agent session.

Recent security developments
Severity
Clear filters
39 matching advisories · 30 shown
Explore packages Subscribe to these results
Follow substantive record changes →
SEVERITYVULNERABILITY / AFFECTED PACKAGESPUBLISHED
critical9.8
CVE-2026-126797

NextScan 1.1.0 through 1.2.0 Hardcoded JWT Key Authentication Bypass in ns-admin

NextScan 1.1.0 through 1.2.0 contains an authentication bypass vulnerability in ns-admin that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key. Attackers can sign an HS256 X-Access-Token carrying the public super administrator role ID to gain full access to user management, scan tasks and stored vulnerability results.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

tongcheng-security-team · NextScan
critical9.8
CVE-2026-64682

AstroBlocks: Admin session tokens can be forged due to a hard-coded fallback JWT secret and a mismatched environment variable name

AstroBlocks is a block-first CMS for Astro projects. Prior to version 3.4.0, admin session tokens can be forged due to a hard-coded fallback JWT secret and a mismatched environment variable name. An attacker who knows the public fallback value (readable in the published package) can forge a valid session token with role: "owner" and obtain full administrative control of the CMS — creating/deleting content, users, media, redirects, and configuration. This issue has been patched in version 3.4.0.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

NauelG · astro-blocks
medium5.9
CVE-2026-0003

Use of a per-part static key in the ASP Bootloader could allow an attacker to downgrade the Secure Encrypted Virtualization (SEV) firmware and exploit known…

Use of a per-part static key in the ASP Bootloader could allow an attacker to downgrade the Secure Encrypted Virtualization (SEV) firmware and exploit known vulnerabilities to decrypt memory potentially resulting in loss of confidentiality.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

AMD · AMD EPYC™ 9004 Series Processors / AMD · AMD EPYC™ 7003 Series Processors
medium6.2
CVE-2026-124602

Hardcoded RSA Private Key and Public Key Exposure in GV-Access Android Application v1.6.1

The RSA cryptographic key material, including a private key and public key, is embedded within the GV-Access application package. Because Android applications can be extracted and reverse engineered, storing private cryptographic keys directly inside the client application may allow an attacker to recover the keys and potentially use them to impersonate the application, decrypt protected data, or generate unauthorized cryptographic operations.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

GeoVision Inc. · GV-Access
medium6.2
CVE-2026-124604

Hardcoded RSA Private Key and Public Key Exposure in GV-Cloud Android Application v1.5.1

The RSA cryptographic key material, including a private key and public key, is embedded within the GV-Cloud application package. Because Android applications can be extracted and reverse engineered, storing private cryptographic keys directly inside the client application may allow an attacker to recover the keys and potentially use them to impersonate the application, decrypt protected data, or generate unauthorized cryptographic operations.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

GeoVision Inc. · GV-Cloud
medium6.2
CVE-2026-124599

Hardcoded RSA Private Key and Public Key Exposure in GV-Face Android Application v2.2.1

The RSA cryptographic key material, including a private key and public key, is embedded within the application package. Because Android applications can be extracted and reverse engineered, storing private cryptographic keys directly inside the client application may allow an attacker to recover the keys and potentially use them to impersonate the application, decrypt protected data, or generate unauthorized cryptographic operations.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

GeoVision Inc. · GV-Face
high7.5
CVE-2026-124598

Hardcoded API Key Discovered in GV-Face Android Application v2.2.1

An API key is hardcoded and retrievable from the GV-Face package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

GeoVision Inc. · GV-Face
critical9.8
CVE-2026-125383

INDOTALENT WHMS before 10.20261109 Hard-Coded JWT Signing Key Authentication Bypass

INDOTALENT WHMS (Asp.Net-Core-Inventory-Order-Management-System) before 10.20261109 contains an authentication bypass vulnerability caused by a hard-coded JWT signing key, issuer and audience in appsettings.json. Unauthenticated remote attackers can forge tokens for any user ID and role that the Tokens/DI.cs validator trusts, gaining administrator access to the entire API.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

go2ismail · Asp.Net-Core-Inventory-Order-Management-System
critical9.8
CVE-2026-125370

Kubero 3.0.0 through 3.1.1 Authentication Bypass via Hardcoded JWT Secret

Kubero 3.0.0 through 3.1.1 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge administrative JWTs by using a hardcoded fallback signing secret when JWT_SECRET is unset. Attackers can sign tokens with arbitrary role, userGroups and permissions claims, which JwtStrategy.validate() trusts without a database lookup, to take control of pipelines, applications, users and API tokens.

No structured fix or guidance is available here. Check the latest publisher advisory.

Public exploit reference

kubero-dev · kubero
medium6.6
CVE-2026-112164

Hardcoded AES Key Enables Credential Disclosure

The LaserGest mobile application encrypts stored assistance portal credentials with a hardcoded AES key and IV, allowing an attacker with access to the application package to recover them in cleartext.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

laservideo · lasergest
medium5.8
CVE-2026-118464

AIS shared cryptographic services use fixed cryptographic secrets

Shared cryptographic services use fixed vendor-wide secrets, deterministic IVs, null salts, and reversible transformations to protect credentials, IPC data, configuration values, and clinical fields.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

CompuGroup Medical · Infantia / CompuGroup Medical · Profim
high8.0
CVE-2026-118460

AIS embedded private keys enable practitioner impersonation

Embedded private keys protected by a shared password can be used to sign practitioner assertions for arbitrary practitioner identifiers, enabling unauthorized practitioner token requests.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

CompuGroup Medical · Infantia / CompuGroup Medical · Profim
high8.7
CVE-2026-17356

Multiple Vulnerabilities in IBM API Connect

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a local attacker to obtain sensitive information due to the use of a hard-coded cryptographic key.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

IBM · API Connect
medium6.5
CVE-2026-17310

Multiple Vulnerabilities in IBM API Connect

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to the use of a hard-coded cryptographic key.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

IBM · API Connect
medium6.5
CVE-2026-115739

Hard-coded Cryptographic Key vulnerability exists in the DLP on-prem extensions version 11.13.1 and earlier allows a remote attacker to decrypt credentials…

Hard-coded Cryptographic Key vulnerability exists in the DLP on-prem extensions version 11.13.1 and earlier allows a remote attacker to decrypt credentials and evidence files.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Trellix · DLP on-prem extensions
critical9.8
CVE-2026-105330

Apache OFBiz: Use of Hard-coded Cryptographic Key in JWT Token Authentication Enables Unauthenticated Administrative Access

Use of Hard-coded Cryptographic Key in JWT token authentication in Apache OFBiz 24.09.06 and 24.09.07 on all platforms allows an unauthenticated, network-reachable attacker to obtain full administrative access via a forged JWT signed with the factory-default security.token.key value that CVE-2026-31986 removed from newly generated configurations, on a deployment that upgraded from a release predating that fix while retaining its existing security.properties with security.internal.sso.enabled set to true. Users are recommended to upgrade to version 24.09.08. Upgrading alone does not replace an already-configured key: deployments that carried framework/security/config/security.properties forward from a release predating the CVE-2026-31986 fix must also run './gradlew rotateSecretKeys' after upgrading, since the existing generateSecretKeys task leaves an already-set value untouched.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Apache Software Foundation · Apache OFBiz
high7.8
CVE-2026-92199

Quest Foglight for Databases EncryptionUtil Hardcoded Encyption Key Local Privilege Escalation Vulnerability

Quest Foglight for Databases EncryptionUtil Hardcoded Encyption Key Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Quest Foglight for Databases. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Quest · Foglight for Databases
low2.4
CVE-2026-82154

Dell OS Recovery tool versions, prior to 2.4.4, contain a use of Hard-coded Cryptographic Key vulnerability.

Dell OS Recovery tool versions, prior to 2.4.4, contain a use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to Information Disclosure.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Dell · OS Recovery tool
critical9.8
CVE-2026-120209

AJ-Report through 1.7.1 Authentication Bypass leading to RCE via Share-Token

AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens offline. Attackers can mint a token with reportCode 'dataSet' to access the testTransform endpoint, which passes scripts to GroovyClassLoader for unauthenticated remote code execution.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

anji-plus · AJ-Report
critical9.8
CVE-2026-61737

ng-antd-admin: Hardcoded JWT Secret allows Authentication Bypass in ng-antd-admin

ng-antd-admin is an Angular and NestJS administration system template. Prior to 22.0, a hardcoded default JWT secret permits token forgery when a deployment has not replaced the default secret, without a startup warning. An attacker can bypass authentication and authorization, impersonate any user including administrators, and access protected API endpoints, leading to account takeover, data leakage and unauthorized operations. Version 22.0 rejects the shipped secret in production but permits it with a warning in non-production environments.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

huajian123 · ng-antd-admin
high7.3
CVE-2026-91912

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Use of Hard-coded Cryptographic Key vulnerability.

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Use of Hard-coded Cryptographic Key vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Dell · OpenManage Enterprise
critical9.8
CVE-2026-119597

OpenDeepWiki through 2.0.6 Hard-coded JWT Signing Key Admin Token Forgery

OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulnerability that allows unauthenticated attackers to forge administrator tokens using the publicly known Jwt:SecretKey in appsettings.json. Attackers can mint HS256 bearer tokens with an Admin role claim to access /api/admin endpoints and control users, roles, repositories, settings, and API keys.

No structured fix or guidance is available here. Check the latest publisher advisory.

Public exploit reference

AIDotNet · OpenDeepWiki
high8.7
CVE-2025-62841

Hard-coded Cryptographic Key #2

An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid Backup Sync. If exploited, the vulnerability could allow remote attackers to compromise the security of the system.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

QNAP Systems Inc. · HBS 3 Hybrid Backup Sync / QNAP Systems Inc. · Hybrid Backup Sync
high8.7
CVE-2025-62839

Hard-coded Cryptographic Key #1

An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid Backup Sync. If exploited, the vulnerability could allow remote attackers to compromise the security of the system.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

QNAP Systems Inc. · HBS 3 Hybrid Backup Sync / QNAP Systems Inc. · Hybrid Backup Sync
critical9.8
CVE-2026-86384

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions…

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to credential exposure. The credentials may be used to access the system with privileges of the compromised user.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Dell · PowerProtect Data Domain
medium6.9
CVE-2026-102812

Hardcoded AES-128 Key and Fixed IV in Configuration Backup Encryption in TP-Link RE305 and Archer C7

A hard-coded cryptographic key vulnerability exists in the user-configuration backup mechanism of TP-Link RE305 V3 and Archer C7 V5. A fixed AES-128 key and initialization vector are embedded in the firmware configuration-management component. An attacker who obtains an affected configuration backup file may extract the cryptographic material from the firmware and use it to decrypt the backup.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

TP-Link Systems Inc. · RE305 v3 / TP-Link Systems Inc. · Archer C7 v5
critical9.8
CVE-2026-117564

nest-admin before 1.0.1 Authentication Bypass via Hardcoded JWT Secret

nest-admin before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens by using a hardcoded JWT_SECRET committed in .env.production. Attackers can sign tokens with the known secret that JwtStrategy and RbacGuard trust, impersonating any user ID or claiming the admin role for full administrative access.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

buqiyuan · nest-admin
high7.7
CVE-2026-111460

Static HTTPS private key and CA private key in firmware in OnCell G3150A-LTE Series

A hard-coded cryptographic key vulnerability exists in the OnCell G3150A-LTE Series. Under certain conditions, an unauthenticated remote attacker could obtain shared cryptographic key material and use it to impersonate affected devices that have not regenerated their cryptographic keys, potentially compromising the confidentiality and integrity of management communications.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

Moxa · OnCell G3150A-LTE Series
critical9.2
CVE-2026-116747

Kener 3.0.0 before 4.1.10 Authentication Bypass via Hardcoded Fallback JWT Secret

Kener 3.0.0 before 4.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge session tokens by using the hardcoded DUMMY_SECRET fallback key. When KENER_SECRET_KEY is empty or unset, attackers knowing an administrator email can sign a kener-user cookie to access /manage/api with full administrative privileges or forge password-reset tokens.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

rajnandan1 · kener
high7.5
CVE-2014-125135

OctoPrint Flask Secret Key hard-coded key

A security vulnerability has been detected in OctoPrint 1.0.0/1.1.0. Affected is an unknown function of the component Flask Secret Key Handler. Such manipulation leads to use of hard-coded cryptographic key . The attack may be performed from remote. Upgrading to version 1.11.1 is able to address this issue. The name of the patch is b4699825d6ab92d5451e5b1e3a06dfb81f86e777. The affected component should be upgraded.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

n/a · OctoPrint