CWE-798: Hard-coded credentials
1,907 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 12 of them as exploited in the wild.
- Published CVEs
- 1,907
- Last 12 months
- 376
- Critical
- 835
- Known exploited
- 12
Critical 835High 624Medium 412Low 35Not scored 1
CVEs per yearBy the year they were published
- 202211
- 2025196
- 2025192
- 2025193
- 2025173
- 202514
- 2026281
- 2026214
- 2026191
- 2026131
- 2026105
- 202643
Known exploitedNewest addition to KEV first
- CVE-2026-22769
Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability. This is considered critical as an…
Dell · RecoverPoint for Virtual Machines
ExploitedCritical10.0 - CVE-2025-14611
Gladinet CentreStack and TrioFox Hard Coded AES Keys
Gladinet · CentreStack and TrioFox
ExploitedHigh7.1 - CVE-2019-6693
Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to…
Fortinet · FortiGate
ExploitedMedium6.5 - CVE-2025-30406
Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal's hardcoded…
Gladinet · CentreStack
ExploitedCritical9.0 - CVE-2024-20439
A vulnerability in Cisco Smart Licensing Utility (CSLU) could allow an unauthenticated, remote attacker to log into an affected system by using a static…
Cisco · Cisco Smart License Utility
ExploitedCritical9.8 - CVE-2021-44207
Acclaim USAHERDS through 7.4.0.1 uses hard-coded credentials.
Product not named
ExploitedHigh8.1 - CVE-2024-28987
SolarWinds Web Help Desk Hardcoded Credential Vulnerability
SolarWinds · Web Help Desk
ExploitedCritical9.1 - CVE-2024-3272
D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi hard-coded credentials
D-Link · DNS-320L
ExploitedCritical9.8 - CVE-2023-6448
Unitronics VisiLogic uses a default administrative password
Unitronics · VisiLogic
ExploitedCritical9.8 - CVE-2022-28810
Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS commands as SYSTEM via the…
Product not named
ExploitedMedium6.8
Newest CVEs
- CVE-2026-119736
Attendo Admin Android 3.0.13 Hard-coded MQTT Broker Credentials
Petpooja · Attendo (formerly Petpooja Payroll)
High8.8 - CVE-2026-7003
WIT SynApps Runtime 1.4.11 Hardcoded OAuth Credentials Disclosure
WIT · SynApps Runtime
Medium6.9 - CVE-2026-61729
SOCFortress CoPilot: Hardcoded Default Header Secret - Unauthenticated Active-Response Invocation and Alert Injection
socfortress · CoPilot
Critical9.4 - CVE-2026-119662
Songloft 2.9.0 before 2.13.6 Hardcoded Admin Credentials in Embedded Backend
songloft-org · songloft
High8.7 - CVE-2026-111419
Hardcoded API Token in Foxit Official Website
Foxit Software Inc. · foxit.com
High8.6 - CVE-2026-118601
Alpine iLX-F511 SSH Hard-Coded Credentials Remote Code Execution Vulnerability
Alpine · iLX-F511
Medium6.3 - CVE-2026-18449
Supermicro BMC contains a SMCRAKP Fixed Key vulnerability
SMCI · X12SPI
High7.5 - CVE-2026-54631
Part-DB: Hardcoded APP_SECRET enables forged remember-me cookie
Part-DB · Part-DB-server
Medium6.3 - CVE-2026-92450
Kiloview E3 NDI Encoder Use of Hard-coded Credentials
Kiloview · E3 Firmware
High8.7 - CVE-2026-114219
NewType Infortech｜NT OneAPP - Hard-coded Credentials
NewType Infortech · NT OneAPP
Critical9.1