CVE-2026-118790
Multiple hardcoded credentials are embedded within product components and administrative functionalities. These credentials may enable unaut
CVSS
—
Sem CVSS
EPSS
—
KEV
—
Exploit Today
—
0-100
Publicado: 9 de nov. de 2026 · Última mod.: 9 de nov. de 2026 · CWE-798
Ainda não há histórico EPSS suficiente.
Multiple hardcoded credentials are embedded within product components and administrative functionalities. These credentials may enable unauthorized access to privileged accounts, services, or application features across affected deployments.
- www.acn.gov.ithttps://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical
- www.cgm.comhttps://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-1246245.3 MÉD—
———A weakness has been identified in PipraPay 3.0.0. Affected by this vulnerability is the function hash_hmac of the file pp-content/pp-include/pp-adapter.php of the component pp-token anti-CSRF Handler. Executing a manipulation can lead to hard-coded credentials. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.1hCVE-2026-112168——
———The Magistra software uses weak custom encryption, relies on an outdated compression algorithm to protect the database, and contains embedded secrets.2hCVE-2026-118465——
———Shared components expose hard-coded Access, workgroup, CCBasic, DBISAM, and related database credentials that are identical across installations.3hCVE-2026-118458——
———The shared AIS login routing selects a production-shipped test DAO and plaintext comparison for the H and V application codes, accepting fixed administrator accounts.3hCVE-2026-191246.8 MÉD24.6%
——7IBM API Connect 10.0.8.0 through 10.0.8.12 could allow an attacker with access to stored data to decrypt sensitive credentials due to the use of a hard-coded cryptographic key. The key protecting stored credentials is built into the product, so credentials could be decrypted if the stored data is obtained.2dCVE-2026-174039.0 CRÍ43.1%
——13IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to gain full administrative control due to the use of hard-coded credentials.2d