CVE-2026-16504
Deployment of the VPS.org one-click Zulip template deploys a hardcoded application signing key, a default database password ("zulip"), and D
CVSS
9.8
Crítica
EPSS
0.5%
p42
KEV
—
Exploit Today
13
0-100
Publicado: 31 de jul. de 2026 · Última mod.: 23 de out. de 2026 · CWE-321 · CWE-1188 · CWE-1393
0.5%EPSS · 30 dias0.5%
2026-10-092026-11-06
Deployment of the VPS.org one-click Zulip template deploys a hardcoded application signing key, a default database password ("zulip"), and DISABLE_HTTPS=True.
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-173568.7 ALT—
———IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a local attacker to obtain sensitive information due to the use of a hard-coded cryptographic key.6hCVE-2026-173106.5 MÉD—
———IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to the use of a hard-coded cryptographic key.6hCVE-2026-74756——
——0Some docker-compose shipped by the project exposes by default Webadmin REST API publically without proper authentication setup.
Version 3.9.1 onward sets a random credential by default on unprotected webadmin endpoints to prevent this while retain convenience.16hCVE-2026-1157396.5 MÉD26.9%
——8Hard-coded Cryptographic Key vulnerability exists in the DLP on-prem extensions version 11.13.1 and earlier allows a remote attacker to decrypt credentials and evidence files.2dCVE-2026-92887—13.3%
——4Incorrect default value in the REST API framework's .rest.xml definition parser (ModelApiReader) in Apache OFBiz through 24.09.07 on all platforms allows a remote, unauthenticated attacker to invoke a REST API operation without providing valid credentials via a .rest.xml resource or operation definition that omits the auth attribute, which ModelApiReader incorrectly resolves to false instead of the true default declared by rest-api.xsd.
Users are recommended to upgrade to version 24.09.08, which fixes this issue.2dCVE-2026-105330—13.9%
——4Use of Hard-coded Cryptographic Key in JWT token authentication in Apache OFBiz 24.09.06 and 24.09.07 on all platforms allows an unauthenticated, network-reachable attacker to obtain full administrative access via a forged JWT signed with the factory-default security.token.key value that CVE-2026-31986 removed from newly generated configurations, on a deployment that upgraded from a release predating that fix while retaining its existing security.properties with security.internal.sso.enabled set to true. Users are recommended to upgrade to version 24.09.08. Upgrading alone does not replace an already-configured key: deployments that carried framework/security/config/security.properties forward from a release predating the CVE-2026-31986 fix must also run './gradlew rotateSecretKeys' after upgrading, since the existing generateSecretKeys task leaves an already-set value untouched.2d