CVE-2026-84398
CM2507 IP cameras accept an empty password for a privileged account exposed through its ONVIF management service. An attacker with network a
CVSS
7.5
High
EPSS
0.4%
p36
KEV
—
Exploit Today
11
0-100
Published: Sep 18, 2026 · Last modified: Sep 19, 2026 · CWE-258
0.4%EPSS · 30 days0.4%
2026-10-142026-11-11
CM2507 IP cameras accept an empty password for a privileged account exposed through its ONVIF management service. An attacker with network access to the affected device could access privileged management functions and obtain device, user, media-profile, and stream configuration information.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1268129.8 CRI—
———blueprintUE Self-Hosted Edition before 4.3.7 contains an insecure default configuration in its Docker Compose examples that sets MYSQL_ALLOW_EMPTY_PASSWORD=yes in database.env and publishes MariaDB on port 3306. Unauthenticated attackers reaching the Docker host on port 3306 can log in as root without a password to read, modify, or delete user accounts, blueprints, and all databases.5hCVE-2026-1137369.8 CRI60.7%
——18A vulnerability has been found in D-Link DHP-W610AV 1.02EUb03. The impacted element is the function login_prepare_hnap of the file etc/defnodes/defaultvalue.xml of the component HNAP Login. The manipulation of the argument Password leads to empty password in configuration file. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.14dCVE-2025-15679—5.1%
——2Under certain circumstances such as reset to factory default operation, the BMC root account is made active without a password on BullSequana XH3406 and XH3515.28d