CVE Watch16 oct 2026

CVE-2026-111612

netdisk-fast-download through 0.4.8 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve donat

CVSS

7.5

Alto

EPSS

0.5%

p41

KEV

—

Exploit Today

0-100

Publicado: 16 oct 2026 · Última mod.: 16 oct 2026 · CWE-321

EPSS · 30d

0.5%EPSS · 30 días0.5%

2026-10-172026-10-20

Descripción técnica

netdisk-fast-download through 0.4.8 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve donated netdisk credentials via the /v2/randomAuth endpoint in ParserApi. Attackers can repeatedly call the endpoint and decrypt the encryptedAuth blob using the hard-coded AES key nfd_auth_key2026 to recover other users' cloud-drive cookies, tokens, or passwords.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-828918.1 ALT

—

——0IBM Guardium Data Protection 12.1, and 12.2 could allow a remote attacker to obtain sensitive information due to use of a hard-coded cryptographic key.21h CVE-2026-1134665.3 MED

—

——0A security vulnerability has been detected in MinIO up to RELEASE.2025-10-15T17-29-55Z. This issue affects the function globalDeploymentID/SessionTokenAuthenticate of the file cmd/common-main.go of the component Embedded Console. Such manipulation leads to use of hard-coded cryptographic key . It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. This vulnerability only affects products that are no longer supported by the maintainer.1d CVE-2026-1120145.5 MED

2.0%

——1LobsterAI before 2026.10.16 contains a hardcoded password vulnerability that allows attackers to decrypt exported provider API keys encrypted with the constant 'lobsterai-APP'. Attackers who obtain a providers export file can derive the AES-GCM key via PBKDF2 using the embedded salt and recover every third-party AI provider API key.1d CVE-2026-1116966.5 MED

21.8%

——7data-platform-open through commit efeacd3 uses a hardcoded, publicly known default AES key in AesPasswordEncAndDecServiceImpl, allowing authenticated attackers to decrypt stored datasource passwords. Attackers can obtain ciphertext passwords from the datasource detail API, for example via cross-workspace IDOR, and decrypt them offline to recover plaintext database credentials.5d CVE-2026-1116929.8 CRÍ

48.1%

——14DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin session tokens by using the hardcoded HMAC secret in JwtTokenService. Attackers can sign a payload of admin and a future expiry with the default dev-secret to gain full administrative access to protected /webapi routes, including the Doris SQL query API.5d CVE-2026-1116909.8 CRÍ

37.2%

——11Simple Admin Core through 1.8.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge super administrator tokens by using the hard-coded Auth.AccessSecret in api/etc/core.yaml. Attackers can sign a JWT with the public secret and roleId claim 001 to gain full administrative control over users, roles, menus, API authorities, configuration and tokens.2d