CVE-2026-100103
Perforce P4 Search container images prior to 2026.4.2 reset the service authentication token to a publicly documented default value. An unau
CVSS
—
Sin CVSS
EPSS
0.4%
p36
KEV
—
Exploit Today
11
0-100
Publicado: 5 oct 2026 · Última mod.: 6 oct 2026 · CWE-1392
0.4%EPSS · 30 días0.4%
2026-10-052026-10-21
Perforce P4 Search container images prior to 2026.4.2 reset the service authentication token to a publicly documented default value. An unauthenticated attacker with network access can obtain the highest application privilege, potentially leading to arbitrary code execution and compromise of the connected P4 Server.
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-779339.8 CRÍ27.2%
——8DB-GPT through 0.8.2 contains a hardcoded credentials vulnerability in its default docker-compose.yml that sets a static MYSQL_ROOT_PASSWORD and publishes port 3306 on all interfaces. Attackers reaching port 3306 or the shared dbgptnet network can authenticate as root@% to gain full database access including FILE and SUPER privileges.2dCVE-2026-1122969.8 CRÍ35.0%
——11FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super administrator access via the flycms account with password admin123. Attackers can log in through POST /api/auth/login, solving only the image captcha, to obtain full control of site content, users and configuration.3dCVE-2026-1119989.8 CRÍ44.1%
——13Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token. Attackers can send the fixed Bearer token to the gateway gRPC proxy port to manage namespaces, eventbuses, users, tokens, and role bindings, and read or publish events.3dCVE-2026-1116939.8 CRÍ30.5%
——9DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to gain administrator access using the built-in admin/Databuff@123 account. Attackers can POST these credentials to /webapi/api/v1/auth/login to obtain an administrator token and access all protected /webapi routes.6dCVE-2026-1113299.8 CRÍ44.1%
——13JuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow unauthenticated remote attackers to access the admin console on port 8090. Attackers can log in as administrator, even after account deletion since CheckLogin recreates it, to control tenant applications and app secrets.6dCVE-2026-1087837.3 ALT30.2%
——9A security vulnerability has been detected in PRVTPRO Amnezia-Web-Panel up to 1.6.2/1.7.2. This affects an unknown part of the file app.py of the component Backup Download. The manipulation leads to use of default credentials. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.9d