CVE-2025-15628
Affected Omada devices rely on embedded certificates that are shared across deployments to establish trust between controllers and managed d
CVSS
—
Sin CVSS
EPSS
—
KEV
—
Exploit Today
—
0-100
Publicado: 3 ago 2026 · Última mod.: 3 ago 2026 · CWE-798
Sin historial EPSS suficiente todavía.
Affected Omada devices rely on embedded certificates that are shared across deployments to establish trust between controllers and managed devices. An attacker who obtains the embedded certificates may be able to impersonate trusted controllers or devices and intercept affected communications.
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-480319.1 CRÍ—
———go-base is a Go RESTful API Boilerplate template with JWT Authentication, backed by PostgreSQL. In versions prior to 2026-05-18, the JWT signing secret is hardcoded to the known string "random", letting any attacker who reads the public repository forge tokens for arbitrary users, including admin roles, and completely bypass authentication on all protected endpoints. This value is set in two places: the dev.env template (line 10) and a programmatic fallback in cmd/serve.go (line 35), so the application uses it even when no .env file is present. The original mitigation in auth/jwt/tokenauth.go (lines 22 to 25) only caught the exact string "random", letting other weak secrets through, and replaced it with an in-memory key that was not persisted, invalidating all tokens on every restart and effectively causing a denial-of-service. This issue has been fixed in version 2026-05-18.9hCVE-2026-653138.1 ALT7.4%
——2A provisioning script used when installing HIPASE-250 (formerly 250
SCALA) engineering workstations sets a fixed, hard-coded x11vnc
password. Because the same credential is applied to every workstation
provisioned this way, an attacker with adjacent-network access who
knows the password can gain VNC access to affected workstations.4dCVE-2026-1845210.0 CRÍ35.5%
——11DMS+ (Non-Mobile) developed by Rich Source has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can exploit a fixed API key to gain control over all installed DMS+ devices.3dCVE-2026-525399.1 CRÍ22.7%
——7Outstatic CMS <= 2.1.9 contains a hardcoded JWT signing secret. When the OST_TOKEN_SECRET environment variable is not set, the application falls back to the default value which is publicly visible in the source code repository. An unauthenticated remote attacker can exploit this by forging JWT session tokens with arbitrary user data and full administrative permissions.4dCVE-2026-632395.4 MED2.3%
——1A hard-coded AWS IAM credentials vulnerability
in Koollab LMS allowed
an attacker to access shared multi-tenant S3 buckets and SQS queues, exposing
sensitive data and enabling malicious content injection, job manipulation, or
email interception.5dCVE-2026-134637.5 ALT13.2%
——4IBM Cloud Pak System 2.3.5.0 could allow a local attacker to obtain sensitive information due to the insertion of credentials into log files.5d