CVE-2026-49008
By accessing unencrypted information in the device firmware, an attacker can obtain credentials related to the integrity verification of a s
CVSS
6.5
Medio
EPSS
0.2%
p7
KEV
—
Exploit Today
2
0-100
Publicado: 7 ago 2026 · Última mod.: 7 ago 2026 · CWE-321
0.2%EPSS · 30 días0.2%
2026-08-072026-08-08
By accessing unencrypted information in the device firmware, an attacker can obtain credentials related to the integrity verification of a specific application function on the device.
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-54218—19.0%
——6Use of hard-coded cryptographic key vulnerability in Tobit Laboratories AG TeamDavid's Webbox. For users created locally in David, passwords are stored in various
files using only obfuscation. Any user with access to the server’s file
system, or who can otherwise extract files from the server (see
vulnerability “Random File Read”), can potentially obtain affected
users’ passwords. This issue affects TeamDavid through Rollout 524.2dCVE-2026-490065.3 MED4.4%
——1By accessing unencrypted information in the device firmware, an attacker can obtain credentials related to TLS transmission.2dCVE-2026-184118.1 ALT26.1%
——8The KARR Security System and SWDS dealer-installed automotive anti-theft systems use a shared Bluetooth authentication key across affected devices. An attacker within Bluetooth range can leverage this weakness to issue unauthorized commands to the vehicle, potentially allowing unauthorized access to vehicle functions, including door unlocking and engine immobilization.3dCVE-2026-148049.1 CRÍ22.8%
——7Use of hard-coded cryptographic key vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Read Sensitive Constants Within an Executable.
This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1.5dCVE-2026-187549.1 CRÍ23.7%
——7The
product firmware contains an embedded, static RSA private key utilized by the
Lighttpd web server for TLS termination. Exposure of this private key allows
malicious actors to breach the confidentiality and integrity of HTTPS
communications, enabling traffic decryption and server spoofing.5dCVE-2026-187539.1 CRÍ23.7%
——7The
product firmware contains an embedded, static RSA private key utilized by the
Lighttpd web server for TLS termination. Exposure of this private key allows
malicious actors to breach the confidentiality and integrity of HTTPS
communications, enabling traffic decryption and server spoofing.5d