CWE-259

224 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 1 of them as exploited in the wild.

Critical 64High 53Medium 85Low 21Not scored 1

CVEs per yearBy the year they were published

CVE-2026-20316
Cisco Secure Firewall Management Center Software Static Credential Vulnerability
Cisco · Cisco Secure Firewall Management Center (FMC)
ExploitedMedium5.3

CVE-2026-123135
langgenius dify Sandbox Run __init__.py hard-coded credentials
langgenius · dify
Medium5.3
CVE-2026-97355
Apache OFBiz: Hard-coded Credentials in AdminServer Enable Unauthenticated Denial of Service
Apache Software Foundation · Apache OFBiz
Not scored
CVE-2026-121609
Qihoo 360 Whole Home Router M5 Boot Script mpt start hard-coded credentials
Qihoo 360 · Whole Home Router M5
Critical10.0
CVE-2026-113736
D-Link DHP-W610AV HNAP Login defaultvalue.xml login_prepare_hnap empty password
D-Link · DHP-W610AV
Critical9.3
CVE-2026-112146
D-Link E15/M32/R15/R32 MQTT Broker passwd hard-coded credentials
D-Link · E15
Medium5.3
CVE-2026-110667
cemtan sar2html sar2html.py hard-coded credentials
cemtan · sar2html
Medium6.9
CVE-2026-108831
meetecho janus-gateway Admin API admin.js hard-coded credentials
meetecho · janus-gateway
Medium5.3
CVE-2026-108584
FunnyWolf Viper config hard-coded credentials
FunnyWolf · Viper
Medium6.9
CVE-2026-105147
SciPhi-AI R2R JWT Secret hard-coded credentials
SciPhi-AI · R2R
Medium6.9
CVE-2026-105141
topoteretes cognee JWT Signing Key get_api_auth_backend.py get_user_id_by_email hard-coded credentials
topoteretes · cognee
Medium5.3