CVE-2026-18411
The KARR Security System and SWDS dealer-installed automotive anti-theft systems use a shared Bluetooth authentication key across affected d
CVSS
8.1
Alto
EPSS
—
KEV
—
Exploit Today
0
0-100
Publicado: 5 ago 2026 · Última mod.: 6 ago 2026 · CWE-321
Sin historial EPSS suficiente todavía.
The KARR Security System and SWDS dealer-installed automotive anti-theft systems use a shared Bluetooth authentication key across affected devices. An attacker within Bluetooth range can leverage this weakness to issue unauthorized commands to the vehicle, potentially allowing unauthorized access to vehicle functions, including door unlocking and engine immobilization.
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-148049.1 CRÍ22.8%
——7Use of hard-coded cryptographic key vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Read Sensitive Constants Within an Executable.
This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1.3dCVE-2026-187549.1 CRÍ23.6%
——7The
product firmware contains an embedded, static RSA private key utilized by the
Lighttpd web server for TLS termination. Exposure of this private key allows
malicious actors to breach the confidentiality and integrity of HTTPS
communications, enabling traffic decryption and server spoofing.2dCVE-2026-187539.1 CRÍ23.6%
——7The
product firmware contains an embedded, static RSA private key utilized by the
Lighttpd web server for TLS termination. Exposure of this private key allows
malicious actors to breach the confidentiality and integrity of HTTPS
communications, enabling traffic decryption and server spoofing.2dCVE-2025-15627—11.5%
——3A cryptographic
weakness exists in the Omada adoption protocol.
The protocol relies on hard-coded cryptographic keys to establish trust and
protect authentication exchanges between controllers and managed devices during
device adoption.
An attacker may
be able to impersonate trusted controllers or managed devices and gain access
to sensitive adoption-related communications.10hCVE-2026-165049.8 CRÍ18.7%
——6Deployment of the VPS.org one-click Zulip template deploys a hardcoded application signing key, a default database password ("zulip"), and DISABLE_HTTPS=True.3dCVE-2026-58465.7 MED5.9%
——2The affected Watchfire Controller Software contains self-signed hard-coded RSA private keys and corresponding X.509 certificates used for authenticating and encrypting HTTPS/TLS connections to the controller's built-in web management interface. These keys are embedded in plaintext within the application patch binaries in the firmware directly from Watchfire's Remote Support filestore.6d