CWE-798: Hard-coded credentials
1,917 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 12 of them as exploited in the wild.
- Published CVEs
- 1,917
- Last 12 months
- 386
- Critical
- 838
- Known exploited
- 12
Critical 838High 627Medium 416Low 35Not scored 1
CVEs per yearBy the year they were published
- 20151
- 201613
- 201795
- 2018143
- 2019132
- 2020186
- 2021172
- 2022201
- 2023184
- 2024204
- 2025223
- 2026346
Known exploitedNewest addition to KEV first
- CVE-2026-22769
Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability. This is considered critical as an…
Dell · RecoverPoint for Virtual Machines
ExploitedCritical10.0 - CVE-2025-14611
Gladinet CentreStack and TrioFox Hard Coded AES Keys
Gladinet · CentreStack and TrioFox
ExploitedHigh7.1 - CVE-2019-6693
Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to…
Fortinet · FortiGate
ExploitedMedium6.5 - CVE-2025-30406
Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal's hardcoded…
Gladinet · CentreStack
ExploitedCritical9.0 - CVE-2024-20439
A vulnerability in Cisco Smart Licensing Utility (CSLU) could allow an unauthenticated, remote attacker to log into an affected system by using a static…
Cisco · Cisco Smart License Utility
ExploitedCritical9.8 - CVE-2021-44207
Acclaim USAHERDS through 7.4.0.1 uses hard-coded credentials.
Product not named
ExploitedHigh8.1 - CVE-2024-28987
SolarWinds Web Help Desk Hardcoded Credential Vulnerability
SolarWinds · Web Help Desk
ExploitedCritical9.1 - CVE-2024-3272
D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi hard-coded credentials
D-Link · DNS-320L
ExploitedCritical9.8 - CVE-2023-6448
Unitronics VisiLogic uses a default administrative password
Unitronics · VisiLogic
ExploitedCritical9.8 - CVE-2022-28810
Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS commands as SYSTEM via the…
Product not named
ExploitedMedium6.8
Newest CVEs
- CVE-2026-19124
Multiple Vulnerabilities in IBM API Connect
IBM · API Connect
Medium6.8 - CVE-2026-17403
Multiple Vulnerabilities in IBM API Connect
IBM · API Connect
Critical9.0 - CVE-2026-17360
Multiple Vulnerabilities in IBM API Connect
IBM · API Connect
Critical9.8 - CVE-2026-19703
A weak password hashing vulnerability has been identified on SonicOS virtual appliances, which in specific conditions could potentially enable an attacker with…
SonicWall · SonicOS
Medium5.1 - CVE-2026-89017
Skyline DataMiner BrokerGateway Embedded API Key Authentication Bypass
Skyline Communications · DataMiner
High8.7 - CVE-2026-88979
Kubeflow Pipelines: Unauthenticated SSRF vulnerability in Kubeflow Pipelines TensorBoard proxy
kubeflow · pipelines
Medium5.8 - CVE-2026-123135
langgenius dify Sandbox Run __init__.py hard-coded credentials
langgenius · dify
Medium5.3 - CVE-2026-54374
VitaFit Android < 2.8.1.0 Hardcoded Credentials Disclosure
Shenzhen Shine Industrial Co., Ltd. · VitaFit
High8.7 - CVE-2026-121144
Hardcoded Credentials Vulnerability in Tata Motors iRA and iRA.ev mobile application
Tata Motors · Tata Motors iRA 2.0
High8.8 - CVE-2026-121609
Qihoo 360 Whole Home Router M5 Boot Script mpt start hard-coded credentials
Qihoo 360 · Whole Home Router M5
Critical10.0