Alertas de Seguridad de la Información

I Crítico vulnerabilidad

22/06/2026

[CVE-2026-12628] IBM Storage Protect Client 8.1.0.0 through 8.2.1.0 and IBM Storage Protect Snapshot For Windows 8.1.…

IBM Storage Protect Client 8.1.0.0 through 8.2.1.0 and IBM Storage Protect Snapshot For Windows 8.1.0.0 through 8.2.1.0 could allow a remote attacker to bypass authentication due to the use of a hardcoded credential in the FlashCopy Manager (FCM) authentication mechanism. The application contains a static credential embedded in multiple authentication code paths, and does not properly validate aut…

nvdcriticovulnerabilidad CVSS 9.1 NVD

K Crítico vulnerabilidad

21/06/2026

[CVE-2026-56265] Crawl4AI before 0.8.7 contains an authentication bypass vulnerability due to a hardcoded default JWT…

Crawl4AI before 0.8.7 contains an authentication bypass vulnerability due to a hardcoded default JWT signing key in the Docker API server. Attackers who know the default key can forge valid authentication tokens for any user, bypassing authentication and gaining full access to protected functionality.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

18/06/2026

[CVE-2026-47846] Bitnami Cassandra container images are affected by a retained default superuser vulnerability. When …

Bitnami Cassandra container images are affected by a retained default superuser vulnerability. When a custom administrator account is configured via the CASSANDRA_USER environment variable, the container initialization script creates the new superuser account but fails to drop the built-in cassandra account in certain scenarios. This leaves the default cassandra:cassandra superuser active as an un…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

16/06/2026

[CVE-2026-22312] The device has a webserver that exposes a REST API authenticated with a constant token. The unauthen…

The device has a webserver that exposes a REST API authenticated with a constant token. The unauthenticated API can be used by an attacker to get access to system settings, modify the configuration and execute some commands (e.g. system reboot).

nvdaltovulnerabilidad CVSS 8.6 NVD

A Crítico vulnerabilidad

12/06/2026

[CVE-2026-50091] Aqara Home Android (com.lumiunited.aqarahome) 6.0.0 (and white-label clients embedding the same libl…

Aqara Home Android (com.lumiunited.aqarahome) 6.0.0 (and white-label clients embedding the same liblumidevsdk.so) uses hard-coded cryptographic keys, which is an instance of "CWE-321: Use of Hard-coded Cryptographic Key" and has an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (9.1 Critical).

nvdcriticovulnerabilidad CVSS 9.1 NVD

A Crítico vulnerabilidad

12/06/2026

[CVE-2026-50083] The Aqara IAM/SSO Gateway (gw-builder.aqara.com) used a hardcoded OAuth client credential, which is …

The Aqara IAM/SSO Gateway (gw-builder.aqara.com) used a hardcoded OAuth client credential, which is an instance of "CWE-798: Use of Hard-coded Credentials." This issue has an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (9.1 Critical). When combined with CVE-2026-50082, CVE-50084, and CVE-50085, this can lead to a fully unauthenticated, remote takeover of affected devices.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

12/06/2026

[CVE-2026-10557] The Yarbo Android and iOS applications contain hard-coded MQTT broker credentials that are identical…

The Yarbo Android and iOS applications contain hard-coded MQTT broker credentials that are identical for all users and all devices. These credentials are embedded in the application binary and are readily extractable via APK decompilation. The credentials provide access to cloud MQTT brokers carrying real-time telemetry for the entire global Yarbo robot fleet. They allow both wildcard subscription…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

12/06/2026

[CVE-2026-11849] The  iRM-IEI Remote Management developed by IEI Integration Corp has a Hardcoded Credentials vulnera…

The  iRM-IEI Remote Management developed by IEI Integration Corp has a Hardcoded Credentials vulnerability, allowing unauthenticated remote attackers to exploit hard-coded credentials to gain administrative privileges on the database.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

09/06/2026

[CVE-2026-47281] Missing authorization in Visual Studio Code allows an unauthorized attacker to elevate privileges ov…

Missing authorization in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.

nvdcriticovulnerabilidad CVSS 9.6 NVD

A Crítico vulnerabilidad

05/06/2026

[CVE-2026-11414] A hard-coded cryptographic key is used by Altium Enterprise Server to sign file download URLs in the…

A hard-coded cryptographic key is used by Altium Enterprise Server to sign file download URLs in the Vault service. Because the key is identical across all installations, an unauthenticated network attacker who can reach the server can forge valid download signatures and retrieve files from the Vault storage area without any authentication, session, or credentials. A separate path traversal vuln…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

05/06/2026

[CVE-2025-71317] NetMan 204 contains a hard-coded backdoor account with the username and password 'eurek' that grants…

NetMan 204 contains a hard-coded backdoor account with the username and password 'eurek' that grants administrative access. A remote, unauthenticated attacker can authenticate through the cgi-bin/login.cgi endpoint (for example /cgi-bin/login.cgi?username=eurek&password=eurek, which due to lax parameter validation can be shortened to /cgi-bin/login.cgi?username=eurek%20eurek) to obtain administrat…

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Alto vulnerabilidad

04/06/2026

[CVE-2026-50213] The account validation endpoint /v1/User/validate returns comprehensive user profile data sheets, wh…

The account validation endpoint /v1/User/validate returns comprehensive user profile data sheets, which can be crawled by iterating predictable identification strings.

nvdaltovulnerabilidad CVSS 7.5 NVD

S Alto vulnerabilidad

03/06/2026

[CVE-2026-8876] Version 3.0.7 of the Securly Chrome Extension contains hardcoded, plaintext AES passphrases in secur…

Version 3.0.7 of the Securly Chrome Extension contains hardcoded, plaintext AES passphrases in securly.min.js. These keys decrypt crisis alert keyword data and intervention site data.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-36606] Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 encrypts configuration backups with …

Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 encrypts configuration backups with a hardcoded DES key using single DES in ECB mode. An attacker who obtains a backup file can decrypt it to recover all stored credentials including admin password, WiFi PSK, and DDNS credentials.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

02/06/2026

[CVE-2019-25722] Dräger SC Monitoring devices (SC 6002XL, SC 6802XL, SC 7000, SC 8000, SC 9000 XL) contain hard-coded…

Dräger SC Monitoring devices (SC 6002XL, SC 6802XL, SC 7000, SC 8000, SC 9000 XL) contain hard-coded plaintext credentials in source code and a denial-of-service vulnerability that allows local and remote attackers to compromise device integrity across all software versions. A local attacker with direct device access can use the hard-coded credentials to access service and clinical accounts and al…

nvdaltovulnerabilidad CVSS 7.6 NVD