Common Weakness Enumeration
CWE-321
AllowedUse of Hard-coded Cryptographic Key
Abstraction: Variant · Status: Draft
The product uses a hard-coded, unchangeable cryptographic key.
682 vulnerabilities reference this CWE, most recent first.
CVE-2026-110612 (GCVE-0-2026-110612)
Vulnerability from cvelistv5 – Published: 2026-10-14 14:16 – Updated: 2026-10-14 18:04
VLAI
EPSS
VEX
Title
vlife through 2.0.1 Authentication Bypass via Hardcoded JWT Secret in TokenUtil
Summary
vlife through 2.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs using the hardcoded HS256 signing key in TokenUtil. Attackers can sign a token with superUser=true and arbitrary groupIds claims to gain super administrator access to any URL on vlife instances.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 18:03 UTC
CWE
- CWE-321 - Use of Hard-coded Cryptographic Key
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/vlife-h… | third-party-advisory |
| https://github.com/wwwlike/vlife/blob/4f03b19b91d… | technical-description |
| https://github.com/wwwlike/vlife/blob/4f03b19b91d… | technical-description |
| https://github.com/wwwlike/vlife | product |
| https://www.vulncheck.com/advisories/vlife-throug… | third-party-advisory |
Date Public
2026-10-14 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110612",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T18:03:43.850224Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T18:04:15.576Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/vlife-hardcoded-jwt-secret-token-forgery"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "vlife",
"repo": "https://github.com/wwwlike/vlife",
"vendor": "wwwlike",
"versions": [
{
"lessThanOrEqual": "2.0.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "vlife through 2.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs using the hardcoded HS256 signing key in TokenUtil. Attackers can sign a token with superUser=true and arbitrary groupIds claims to gain super administrator access to any URL on vlife instances."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-321",
"description": "Use of Hard-coded Cryptographic Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T14:16:52.666Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/vlife-hardcoded-jwt-secret-token-forgery"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/wwwlike/vlife/blob/4f03b19b91d82781939653f5b0d9a70721734d6d/vlife-boot-starter-web/src/main/java/cn/wwwlike/web/security/filter/TokenUtil.java#L33-L58"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/wwwlike/vlife/blob/4f03b19b91d82781939653f5b0d9a70721734d6d/vlife-base/src/main/java/cn/wwwlike/config/VlifeUrlDecisionManager.java#L25"
},
{
"tags": [
"product"
],
"url": "https://github.com/wwwlike/vlife"
},
{
"name": "VulnCheck Advisory: vlife through 2.0.1 Authentication Bypass via Hardcoded JWT Secret in TokenUtil",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/vlife-through-2.0.1-authentication-bypass-via-hardcoded-jwt-secret-in-tokenutil"
}
],
"title": "vlife through 2.0.1 Authentication Bypass via Hardcoded JWT Secret in TokenUtil",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-110612",
"datePublished": "2026-10-14T14:16:52.666Z",
"dateReserved": "2026-10-14T13:07:24.212Z",
"dateUpdated": "2026-10-14T18:04:15.576Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110214 (GCVE-0-2026-110214)
Vulnerability from cvelistv5 – Published: 2026-10-13 18:50 – Updated: 2026-10-13 19:23
VLAI
EPSS
VEX
Title
Snowy 3.6.5 Hard-coded Download Signature Key Allows Unauthenticated File Download
Summary
Snowy 3.6.5 contains a hard-coded HMAC key vulnerability that allows unauthenticated attackers to forge download signatures for the /dev/file/download endpoint by using the published FILE_DOWNLOAD_SIGN_SECRET constant. Attackers can compute HMAC-SHA256 signatures of guessed file ids offline to download stored files such as avatars, editor images and attachments.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 19:23 UTC
CWE
- CWE-321 - Use of Hard-coded Cryptographic Key
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/snowy-d… | third-party-advisory |
| https://github.com/xiaonuobase/Snowy/blob/v3.6.5/… | technical-description |
| https://github.com/xiaonuobase/Snowy/blob/v3.6.5/… | technical-description |
| https://github.com/xiaonuobase/Snowy/blob/v3.6.5/… | technical-description |
| https://www.vulncheck.com/advisories/snowy-3.6.5-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| xiaonuobase | Snowy |
Affected:
3.6.5 , ≤ 3.6.5
(semver)
|
Date Public
2026-10-13 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110214",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T19:23:04.714455Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T19:23:28.663Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/snowy-dev-file-access-control"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Snowy",
"repo": "https://github.com/xiaonuobase/Snowy",
"vendor": "xiaonuobase",
"versions": [
{
"lessThanOrEqual": "3.6.5",
"status": "affected",
"version": "3.6.5",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Snowy 3.6.5 contains a hard-coded HMAC key vulnerability that allows unauthenticated attackers to forge download signatures for the /dev/file/download endpoint by using the published FILE_DOWNLOAD_SIGN_SECRET constant. Attackers can compute HMAC-SHA256 signatures of guessed file ids offline to download stored files such as avatars, editor images and attachments."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-321",
"description": "Use of Hard-coded Cryptographic Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T18:50:03.179Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/snowy-dev-file-access-control"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/xiaonuobase/Snowy/blob/v3.6.5/snowy-plugin/snowy-plugin-dev/src/main/java/vip/xiaonuo/dev/modular/file/service/impl/DevFileServiceImpl.java#L419-L445"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/xiaonuobase/Snowy/blob/v3.6.5/snowy-plugin/snowy-plugin-dev/src/main/java/vip/xiaonuo/dev/modular/file/service/impl/DevFileServiceImpl.java#L78"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/xiaonuobase/Snowy/blob/v3.6.5/snowy-web-app/src/main/java/vip/xiaonuo/core/config/GlobalConfigure.java#L174-L175"
},
{
"name": "VulnCheck Advisory: Snowy 3.6.5 Hard-coded Download Signature Key Allows Unauthenticated File Download",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/snowy-3.6.5-hard-coded-download-signature-key-allows-unauthenticated-file-download"
}
],
"title": "Snowy 3.6.5 Hard-coded Download Signature Key Allows Unauthenticated File Download",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-110214",
"datePublished": "2026-10-13T18:50:03.179Z",
"dateReserved": "2026-10-13T17:59:15.959Z",
"dateUpdated": "2026-10-13T19:23:28.663Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109813 (GCVE-0-2026-109813)
Vulnerability from cvelistv5 – Published: 2026-10-16 02:57 – Updated: 2026-10-16 13:54
VLAI
EPSS
VEX
Title
Shared Hard-coded Root CA Private Key
Summary
A hard-coded cryptographic key vulnerability exists in the `/usr/bin/sysman` of some of Moxa's industrial computing products. An unauthenticated attacker with adjacent network access could exploit the exposed private key material to compromise the confidentiality and integrity of communications.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 13:53 UTC
CWE
- CWE-321 - Use of Hard-coded Cryptographic Key
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.moxa.com/en/support/product-support/s… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Moxa | AIG-302 Series |
Affected:
1.0.0 , ≤ 1.4.0
(custom)
Unaffected: 1.4.1 (custom) cpe:2.3:a:moxa:aig-302_series:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109813",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T13:53:34.503674Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T13:54:15.659Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "AIG-302 Series",
"vendor": "Moxa",
"versions": [
{
"lessThanOrEqual": "1.4.0",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "1.4.1",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:moxa:aig-302_series:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.4.0",
"versionStartIncluding": "1.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:moxa:aig-302_series:1.4.1:*:*:*:*:*:*:*",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ievgen Bondarenko"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A hard-coded cryptographic key vulnerability exists in the `/usr/bin/sysman` of some of Moxa\u0027s\u0026nbsp;industrial computing products. An unauthenticated attacker with adjacent network access could exploit the exposed private key material to compromise the confidentiality and integrity of communications."
}
],
"value": "A hard-coded cryptographic key vulnerability exists in the `/usr/bin/sysman` of some of Moxa\u0027s\u00a0industrial computing products. An unauthenticated attacker with adjacent network access could exploit the exposed private key material to compromise the confidentiality and integrity of communications."
}
],
"impacts": [
{
"capecId": "CAPEC-37",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-37: Retrieve Embedded Sensitive Data"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-321",
"description": "CWE-321: Use of Hard-coded Cryptographic Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T02:57:52.388Z",
"orgId": "2e0a0ee2-d866-482a-9f5e-ac03d156dbaa",
"shortName": "Moxa"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.moxa.com/en/support/product-support/security-advisory/mpsa-262560-cve-2026-109812,-cve-2026-109813-vulnerabilities-in-industrial-computing-products"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Please refer to Moxa Security Advisory:\u0026nbsp;\u003cdiv\u003ehttps://www.moxa.com/en/support/product-support/security-advisory/mpsa-262560-cve-2026-109812,-cve-2026-109813-vulnerabilities-in-industrial-computing-products\u003c/div\u003e"
}
],
"value": "Please refer to Moxa Security Advisory:\u00a0https://www.moxa.com/en/support/product-support/security-advisory/mpsa-262560-cve-2026-109812,-cve-2026-109813-vulnerabilities-in-industrial-computing-products"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Shared Hard-coded Root CA Private Key",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "2e0a0ee2-d866-482a-9f5e-ac03d156dbaa",
"assignerShortName": "Moxa",
"cveId": "CVE-2026-109813",
"datePublished": "2026-10-16T02:57:52.388Z",
"dateReserved": "2026-10-13T03:55:38.782Z",
"dateUpdated": "2026-10-16T13:54:15.659Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109424 (GCVE-0-2026-109424)
Vulnerability from cvelistv5 – Published: 2026-10-12 19:35 – Updated: 2026-10-13 17:19
VLAI
EPSS
VEX
Title
NetEase Cloud Music Weak Encryption via eapi/xeapi
Summary
NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a weak encryption vulnerability where /eapi/ and /xeapi/ API response bodies are decrypted using a fixed, publicly documented AES-128-ECB key with no integrity credential. Attackers who can intercept or originate server responses can construct valid ciphertext under the known key with PKCS#7 padding, enabling the client to accept forged API responses that serve as a prerequisite for further exploitation such as reaching the os.navigateExternal bridge.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 17:19 UTC
CWE
- CWE-321 - Use of Hard-coded Cryptographic Key
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://gist.github.com/LeoWSY-hashblue/10e5383fc… | technical-description |
| https://hr.163.com/product.html/music | product |
| https://www.vulncheck.com/advisories/netease-clou… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NetEase | NetEase Cloud Music for Windows |
Affected:
3.1.38
(custom)
Affected: 3.1.39.205426 (custom) |
Date Public
2026-09-29 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109424",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T17:19:10.711877Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T17:19:55.260Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "NetEase Cloud Music for Windows",
"vendor": "NetEase",
"versions": [
{
"status": "affected",
"version": "3.1.38",
"versionType": "custom"
},
{
"status": "affected",
"version": "3.1.39.205426",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "LeoWSY-hashblue"
}
],
"datePublic": "2026-09-29T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a weak encryption vulnerability where /eapi/ and /xeapi/ API response bodies are decrypted using a fixed, publicly documented AES-128-ECB key with no integrity credential. Attackers who can intercept or originate server responses can construct valid ciphertext under the known key with PKCS#7 padding, enabling the client to accept forged API responses that serve as a prerequisite for further exploitation such as reaching the os.navigateExternal bridge."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-321",
"description": "Use of Hard-coded Cryptographic Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T19:35:20.198Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Disclosure",
"tags": [
"technical-description"
],
"url": "https://gist.github.com/LeoWSY-hashblue/10e5383fc2d4d75faf74a9507c6bba9f"
},
{
"name": "Product Page",
"tags": [
"product"
],
"url": "https://hr.163.com/product.html/music"
},
{
"name": "VulnCheck Advisory: NetEase Cloud Music Weak Encryption via eapi/xeapi",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netease-cloud-music-weak-encryption-via-eapi-xeapi"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "NetEase Cloud Music Weak Encryption via eapi/xeapi",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109424",
"datePublished": "2026-10-12T19:35:20.198Z",
"dateReserved": "2026-10-12T15:52:36.681Z",
"dateUpdated": "2026-10-13T17:19:55.260Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108860 (GCVE-0-2026-108860)
Vulnerability from cvelistv5 – Published: 2026-10-11 13:26 – Updated: 2026-10-14 16:47
VLAI
EPSS
VEX
Title
BotSharp through 5.2.0 Authentication Bypass via Hard-Coded JWT Signing Key
Summary
BotSharp through 5.2.0 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge bearer tokens using the hard-coded Jwt:Key in WebStarter appsettings.json. Attackers can sign tokens with the committed HMAC secret and fixed botsharp issuer and audience to impersonate any known user, including administrators, on Authorize-protected API routes.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 16:47 UTC
CWE
- CWE-321 - Use of Hard-coded Cryptographic Key
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/scishar… | third-party-advisory |
| https://github.com/SciSharp/BotSharp/blob/a11ee03… | technical-description |
| https://github.com/SciSharp/BotSharp/blob/a11ee03… | technical-description |
| https://github.com/SciSharp/BotSharp | product |
| https://www.vulncheck.com/advisories/botsharp-thr… | third-party-advisory |
Date Public
2026-10-11 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108860",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T16:47:16.407934Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T16:47:26.986Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "BotSharp",
"repo": "https://github.com/SciSharp/BotSharp",
"vendor": "SciSharp",
"versions": [
{
"lessThanOrEqual": "5.2.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-11T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "BotSharp through 5.2.0 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge bearer tokens using the hard-coded Jwt:Key in WebStarter appsettings.json. Attackers can sign tokens with the committed HMAC secret and fixed botsharp issuer and audience to impersonate any known user, including administrators, on Authorize-protected API routes."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-321",
"description": "Use of Hard-coded Cryptographic Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T13:26:07.369Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/scisharp-botsharp-public-jwt-signing-key"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/SciSharp/BotSharp/blob/a11ee0317cab5c619df1cb5d0c4fc39d1b6e30b4/src/WebStarter/appsettings.json#L16-L20"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/SciSharp/BotSharp/blob/a11ee0317cab5c619df1cb5d0c4fc39d1b6e30b4/src/Infrastructure/BotSharp.OpenAPI/BotSharpOpenApiExtensions.cs#L46-L57"
},
{
"tags": [
"product"
],
"url": "https://github.com/SciSharp/BotSharp"
},
{
"name": "VulnCheck Advisory: BotSharp through 5.2.0 Authentication Bypass via Hard-Coded JWT Signing Key",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/botsharp-through-5.2.0-authentication-bypass-via-hard-coded-jwt-signing-key"
}
],
"title": "BotSharp through 5.2.0 Authentication Bypass via Hard-Coded JWT Signing Key",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-108860",
"datePublished": "2026-10-11T13:26:07.369Z",
"dateReserved": "2026-10-11T13:12:04.527Z",
"dateUpdated": "2026-10-14T16:47:26.986Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108798 (GCVE-0-2026-108798)
Vulnerability from cvelistv5 – Published: 2026-10-12 04:00 – Updated: 2026-10-16 12:45
VLAI
EPSS
VEX
Title
ZKTeco BioTime hard-coded key
Summary
A vulnerability was found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This issue affects some unknown processing. The manipulation results in use of hard-coded cryptographic key
. The attack may be launched remotely. Upgrading to version 9.5.6 Build 3623 is capable of addressing this issue. It is suggested to upgrade the affected component.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 17:24 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/416575 | vdb-entry |
| https://vuldb.com/vuln/416575/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-108798 | third-party-advisory |
| https://vuldb.com/submit/961812 | third-party-advisory |
| https://www.zkteco.com/en/Security_Bulletinsibs/27 | patch |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108798",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T17:24:00.902350Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T17:24:13.777Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:zkteco:biotime:*:*:*:*:*:*:*:*"
],
"product": "BioTime",
"vendor": "ZKTeco",
"versions": [
{
"status": "affected",
"version": "9.5.6 Build 20260130.3206"
},
{
"status": "unaffected",
"version": "9.5.6 Build 3623"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "bashdar (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB Vulnerability Moderation Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This issue affects some unknown processing. The manipulation results in use of hard-coded cryptographic key\r . The attack may be launched remotely. Upgrading to version 9.5.6 Build 3623 is capable of addressing this issue. It is suggested to upgrade the affected component."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:ND/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-321",
"description": "Use of Hard-coded Cryptographic Key",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-320",
"description": "Key Management Error",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T12:45:54.553Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-416575 | ZKTeco BioTime hard-coded key",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/416575"
},
{
"name": "VDB-416575 | CTI Indicators (IOB, IOC, TTP)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/416575/cti"
},
{
"name": "CVE-2026-108798 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-108798"
},
{
"name": "Submit #961812 | ZKTeco BioTime 9.5.6 Build 20260130.3206 Cryptographic Issues",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/961812"
},
{
"tags": [
"patch"
],
"url": "https://www.zkteco.com/en/Security_Bulletinsibs/27"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-11T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-11T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-16T14:49:29.000Z",
"value": "VulDB entry last update"
}
],
"title": "ZKTeco BioTime hard-coded key",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-108798",
"datePublished": "2026-10-12T04:00:12.485Z",
"dateReserved": "2026-10-11T09:11:26.300Z",
"dateUpdated": "2026-10-16T12:45:54.553Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108336 (GCVE-0-2026-108336)
Vulnerability from cvelistv5 – Published: 2026-10-14 21:41 – Updated: 2026-10-16 18:26
VLAI
EPSS
VEX
Title
Token Signing Key Allows Unauthenticated Administrative Access
Summary
When the default self-signed certificate is used, an attacker could gain administrative access to the application.
The SSL certificate for the web interface is used to sign JWT access tokens that are used to validate that the user is logged in. When the default SSL certificate is used, an attacker could have the capability to sign JWT access tokens and bypass login.
An attacker could gain administrative access to the application and perform actions like configuring the service or requesting log collection. Device credentials and customer data cannot be accessed with this vulnerability.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 18:25 UTC
CWE
- CWE-321 - Use of hard-coded cryptographic key
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Hitachi Vantara | Remot Ops Agent |
Unaffected:
2.1
Affected: 1.60 , ≤ 2.0 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108336",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:25:31.458651Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:26:15.816Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Remot Ops Agent",
"vendor": "Hitachi Vantara",
"versions": [
{
"status": "unaffected",
"version": "2.1"
},
{
"lessThanOrEqual": "2.0",
"status": "affected",
"version": "1.60",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Internal"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eWhen the default self-signed certificate is used, an attacker could gain administrative access to the\u0026nbsp;\u003cspan\u003eapplication.\u003c/span\u003e\u003c/p\u003e\u003cp\u003eThe SSL certificate for the web interface is used to sign JWT access tokens that are used to validate that\u0026nbsp;\u003cspan\u003ethe user is logged in. When the default SSL certificate is used, an attacker could have the capability to sign\u0026nbsp;\u003c/span\u003e\u003cspan\u003eJWT access tokens and bypass login.\u003c/span\u003e\u003c/p\u003e\u003cp\u003eAn attacker could gain administrative access to the application and perform actions like configuring the\u0026nbsp;\u003cspan\u003eservice or requesting log collection. Device credentials and customer data cannot be accessed with this\u0026nbsp;\u003c/span\u003e\u003cspan\u003evulnerability.\u003c/span\u003e\u003c/p\u003e"
}
],
"value": "When the default self-signed certificate is used, an attacker could gain administrative access to the\u00a0application.\n\n\n\nThe SSL certificate for the web interface is used to sign JWT access tokens that are used to validate that\u00a0the user is logged in. When the default SSL certificate is used, an attacker could have the capability to sign\u00a0JWT access tokens and bypass login.\n\n\n\nAn attacker could gain administrative access to the application and perform actions like configuring the\u00a0service or requesting log collection. Device credentials and customer data cannot be accessed with this\u00a0vulnerability."
}
],
"impacts": [
{
"capecId": "CAPEC-115",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-115 Authentication Bypass"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-321",
"description": "CWE-321 Use of hard-coded cryptographic key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T21:41:40.417Z",
"orgId": "dce6e192-ff49-4263-9134-f0beccb9bc13",
"shortName": "HITVAN"
},
"references": [
{
"url": "https://knowledge.hitachivantara.com/portal/app/portlets/results/viewsolution.jsp?solutionid=261012131624707\u0026guest=0"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eReplace the default self-signed certificate for the web interface with a different one.\u0026nbsp;\u003cspan\u003eThis vulnerability is addressed in Remote Ops Agent version 2.1.\u003c/span\u003e\u003c/p\u003e"
}
],
"value": "Replace the default self-signed certificate for the web interface with a different one.\u00a0This vulnerability is addressed in Remote Ops Agent version 2.1."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Token Signing Key Allows Unauthenticated Administrative Access",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "dce6e192-ff49-4263-9134-f0beccb9bc13",
"assignerShortName": "HITVAN",
"cveId": "CVE-2026-108336",
"datePublished": "2026-10-14T21:41:40.417Z",
"dateReserved": "2026-10-09T19:44:30.543Z",
"dateUpdated": "2026-10-16T18:26:15.816Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107171 (GCVE-0-2026-107171)
Vulnerability from cvelistv5 – Published: 2026-10-14 07:11 – Updated: 2026-10-14 15:57
VLAI
EPSS
VEX
Summary
An Hardcoded Cryptographic Key vulnerability existed in Trellix Agent 5.8.4 via mfecryptc.dll leads to Database Decryption by Regular Users.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 15:57 UTC
CWE
- CWE-321 - Use of Hard-coded Cryptographic Key
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Trellix | Trellix Agent |
Affected:
5.8.4
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107171",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T15:57:27.562383Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T15:57:50.108Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Trellix Agent",
"vendor": "Trellix",
"versions": [
{
"status": "affected",
"version": "5.8.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An Hardcoded Cryptographic Key vulnerability existed in Trellix Agent 5.8.4 via mfecryptc.dll leads to Database Decryption by Regular Users."
}
],
"value": "An Hardcoded Cryptographic Key vulnerability existed in Trellix Agent 5.8.4 via mfecryptc.dll leads to Database Decryption by Regular Users."
}
],
"impacts": [
{
"capecId": "CAPEC-191",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-191: Read Sensitive Constants Within an Executable"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-321",
"description": "CWE-321: Use of Hard-coded Cryptographic Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T07:11:09.227Z",
"orgId": "01626437-bf8f-4d1c-912a-893b5eb04808",
"shortName": "trellix"
},
"references": [
{
"url": "https://support.trellix.com/s/article/000015866"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "01626437-bf8f-4d1c-912a-893b5eb04808",
"assignerShortName": "trellix",
"cveId": "CVE-2026-107171",
"datePublished": "2026-10-14T07:11:09.227Z",
"dateReserved": "2026-10-07T11:57:02.729Z",
"dateUpdated": "2026-10-14T15:57:50.108Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106172 (GCVE-0-2026-106172)
Vulnerability from cvelistv5 – Published: 2026-10-13 17:37 – Updated: 2026-10-14 09:31
VLAI
EPSS
VEX
Summary
A use of hard-coded cryptographic key vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4 all versions, FortiSandbox Cloud 5.2.0 through 5.2.1, FortiSandbox Cloud 5.0.0 through 5.0.6, FortiSandbox Cloud 4.4 all versions may allow attacker to escalation of privilege via specially crafted HTTP requests
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 00:00 UTC
CWE
- CWE-321 - Escalation of privilege
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Fortinet | FortiSandbox |
Affected:
5.2.0 , ≤ 5.2.1
(semver)
Affected: 5.0.0 , ≤ 5.0.6 (semver) Affected: 4.4.0 , ≤ 4.4.10 (semver) cpe:2.3:a:fortinet:fortisandbox:5.2.1:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:5.2.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:5.0.6:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:5.0.5:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:5.0.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:5.0.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:5.0.2:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:5.0.1:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:5.0.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.4.10:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.4.9:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.4.8:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.4.7:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.4.6:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.4.5:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.4.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.4.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.4.2:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.4.1:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.4.0:*:*:*:*:*:*:* |
|
| Fortinet | FortiSandbox Cloud |
Affected:
5.0.4 , ≤ 5.0.6
(semver)
Affected: 5.0.0 , ≤ 5.0.2 (semver) Affected: 4.4.0 , ≤ 4.4.9 (semver) cpe:2.3:a:fortinet:fortisandboxcloud:5.0.6:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandboxcloud:5.0.5:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandboxcloud:5.0.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandboxcloud:5.0.2:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandboxcloud:5.0.1:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandboxcloud:5.0.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandboxcloud:4.4.9:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandboxcloud:4.4.8:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandboxcloud:4.4.7:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandboxcloud:4.4.6:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandboxcloud:4.4.5:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandboxcloud:4.4.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandboxcloud:4.4.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandboxcloud:4.4.2:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandboxcloud:4.4.1:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandboxcloud:4.4.0:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-106172",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T03:59:41.448Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:fortinet:fortisandbox:5.2.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:5.2.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:5.0.6:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:5.0.5:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:5.0.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:5.0.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:5.0.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:5.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:5.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.4.10:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.4.9:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.4.8:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.4.7:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.4.6:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.4.5:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.4.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.4.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.4.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.4.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.4.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "FortiSandbox",
"vendor": "Fortinet",
"versions": [
{
"lessThanOrEqual": "5.2.1",
"status": "affected",
"version": "5.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.0.6",
"status": "affected",
"version": "5.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.4.10",
"status": "affected",
"version": "4.4.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortisandboxcloud:5.0.6:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandboxcloud:5.0.5:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandboxcloud:5.0.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandboxcloud:5.0.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandboxcloud:5.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandboxcloud:5.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandboxcloud:4.4.9:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandboxcloud:4.4.8:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandboxcloud:4.4.7:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandboxcloud:4.4.6:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandboxcloud:4.4.5:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandboxcloud:4.4.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandboxcloud:4.4.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandboxcloud:4.4.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandboxcloud:4.4.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandboxcloud:4.4.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "FortiSandbox Cloud",
"vendor": "Fortinet",
"versions": [
{
"lessThanOrEqual": "5.0.6",
"status": "affected",
"version": "5.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.0.2",
"status": "affected",
"version": "5.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.4.9",
"status": "affected",
"version": "4.4.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A use of hard-coded cryptographic key vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4 all versions, FortiSandbox Cloud 5.2.0 through 5.2.1, FortiSandbox Cloud 5.0.0 through 5.0.6, FortiSandbox Cloud 4.4 all versions may allow attacker to escalation of privilege via specially crafted HTTP requests"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:F/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-321",
"description": "Escalation of privilege",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T09:31:14.985Z",
"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"shortName": "fortinet"
},
"references": [
{
"name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-179",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-179"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to upcoming FortiSandbox version 5.2.2 or above\nUpgrade to FortiSandbox version 5.0.7 or above\nUpgrade to upcoming FortiSandbox Cloud version 5.2.2 or above"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"assignerShortName": "fortinet",
"cveId": "CVE-2026-106172",
"datePublished": "2026-10-13T17:37:16.459Z",
"dateReserved": "2026-10-06T16:19:44.280Z",
"dateUpdated": "2026-10-14T09:31:14.985Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105392 (GCVE-0-2026-105392)
Vulnerability from cvelistv5 – Published: 2026-10-05 19:45 – Updated: 2026-10-06 17:21
VLAI
EPSS
VEX
Title
Lybbn Django-Vue-Lyadmin JWT Signing settings.py hard-coded key
Summary
A vulnerability has been found in Lybbn Django-Vue-Lyadmin up to 3.2.12. The impacted element is an unknown function of the file backend/application/settings.py of the component JWT Signing. The manipulation of the argument SECRET_KEY leads to use of hard-coded cryptographic key
. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The project maintainer explains: "The issue with this key is described in the documentation. Developers need to manually change their keys before deployment."
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 17:20 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/413586 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/413586/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-105392 | third-party-advisory |
| https://vuldb.com/submit/982747 | third-party-advisory |
| https://github.com/lybbn/django-vue-lyadmin/issues/3 | exploitissue-tracking |
| https://github.com/lybbn/django-vue-lyadmin/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Lybbn | Django-Vue-Lyadmin |
Affected:
3.2.0
Affected: 3.2.1 Affected: 3.2.2 Affected: 3.2.3 Affected: 3.2.4 Affected: 3.2.5 Affected: 3.2.6 Affected: 3.2.7 Affected: 3.2.8 Affected: 3.2.9 Affected: 3.2.10 Affected: 3.2.11 Affected: 3.2.12 cpe:2.3:a:lybbn:django-vue-lyadmin:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105392",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T17:20:40.726914Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T17:21:01.014Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:lybbn:django-vue-lyadmin:*:*:*:*:*:*:*:*"
],
"modules": [
"JWT Signing"
],
"product": "Django-Vue-Lyadmin",
"vendor": "Lybbn",
"versions": [
{
"status": "affected",
"version": "3.2.0"
},
{
"status": "affected",
"version": "3.2.1"
},
{
"status": "affected",
"version": "3.2.2"
},
{
"status": "affected",
"version": "3.2.3"
},
{
"status": "affected",
"version": "3.2.4"
},
{
"status": "affected",
"version": "3.2.5"
},
{
"status": "affected",
"version": "3.2.6"
},
{
"status": "affected",
"version": "3.2.7"
},
{
"status": "affected",
"version": "3.2.8"
},
{
"status": "affected",
"version": "3.2.9"
},
{
"status": "affected",
"version": "3.2.10"
},
{
"status": "affected",
"version": "3.2.11"
},
{
"status": "affected",
"version": "3.2.12"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "HiiragiHaru (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in Lybbn Django-Vue-Lyadmin up to 3.2.12. The impacted element is an unknown function of the file backend/application/settings.py of the component JWT Signing. The manipulation of the argument SECRET_KEY leads to use of hard-coded cryptographic key\r . Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The project maintainer explains: \"The issue with this key is described in the documentation. Developers need to manually change their keys before deployment.\""
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-321",
"description": "Use of Hard-coded Cryptographic Key",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-320",
"description": "Key Management Error",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T19:45:12.468Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-413586 | Lybbn Django-Vue-Lyadmin JWT Signing settings.py hard-coded key",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/413586"
},
{
"name": "VDB-413586 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/413586/cti"
},
{
"name": "CVE-2026-105392 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-105392"
},
{
"name": "Submit #982747 | Lybbn Django-Vue-Lyadmin 6dcf930833d76d51780e12e024254a431e653f69 Hard-coded Cryptographic Key",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/982747"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/lybbn/django-vue-lyadmin/issues/3"
},
{
"tags": [
"product"
],
"url": "https://github.com/lybbn/django-vue-lyadmin/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-05T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-05T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-05T12:43:37.000Z",
"value": "VulDB entry last update"
}
],
"title": "Lybbn Django-Vue-Lyadmin JWT Signing settings.py hard-coded key",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-105392",
"datePublished": "2026-10-05T19:45:12.468Z",
"dateReserved": "2026-10-05T10:38:25.971Z",
"dateUpdated": "2026-10-06T17:21:01.014Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
Prevention schemes mirror that of hard-coded password storage.
No CAPEC attack patterns related to this CWE.