Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-1392
Weakness type CWE-1392 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 34 | 33 | 0 |
Monthly trend
▂▁▁▂▁▄▅▆▂█▆
2025-12 1 · 2026-01 0 · 2026-02 0 · 2026-03 1 · 2026-04 0 · 2026-05 4 · 2026-06 5 · 2026-07 7 · 2026-08 1 · 2026-09 9 · 2026-10 6
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2026-58453 | 9.3 | 79.3 | — | JAIOTlink C492A-W6 4.8.30.57701411 Hard-coded Credentials via anyka_ipc |
| CVE-2026-41939 | 9.3 | 64.9 | — | Care Everywhere Gateway 14.3.10 Hard-coded Credentials RCE via WildFly |
| CVE-2026-58466 | 9.3 | 55.9 | — | AutoBangumi < 3.2.8 - Hard-coded Default Credentials via add_default_user() |
| CVE-2026-68503 | 9.8 | 54.2 | — | LazyOwn: Default C2 Operator Credentials Enable Administrative Access to C2 Dashboard |
| CVE-2026-31837 | 8.7 | 52.3 | — | Istio JWKS resolver to prevent private key material from being exposed when JWKS fetch … |
| CVE-2026-78573 | 9.8 | 46.3 | — | IBM ContextForge MCP Gateway is affected by use of default credentials |
| CVE-2026-86464 | 9.9 | 44.6 | — | — |
| CVE-2026-90940 | 6.9 | 44.6 | — | novel-plus through 5.3.3 Default Cache Management Password in the Front Portal |
| CVE-2026-111329 | 9.3 | 43.8 | — | JuggleIM im-server through 1.8.16 Default Admin Credentials in Admin Console |
| CVE-2026-44761 | 9.1 | 41.3 | — | Insecure Sample Credentials in SAP Commerce Cloud |
| CVE-2026-76155 | 9.3 | 41.1 | — | Datiphy Data Management Center - Use of Default Credentials |
| CVE-2026-46386 | 9.9 | 40.8 | — | OpenProject: Pre-authentication RCE in openproject/openproject Docker image via default… |
| CVE-2026-45039 | 9.8 | 40.2 | — | RustFS: Internode RPC HMAC secret falls back to public default credential, enabling pee… |
| CVE-2026-90498 | 5.5 | 39.4 | — | lenve vhr vhr.sql default credentials |
| CVE-2026-108263 | 9.9 | 36.1 | — | Astron Agent: Unsandboxed code-node leads to cross-tenant RCE |
| CVE-2026-100103 | 10.0 | 35.2 | — | Authentication bypass via default auth token in P4Search |
| CVE-2026-3144 | 9.8 | 34.0 | — | IBM API Connect Default Credentials |
| CVE-2026-9844 | 8.8 | 33.3 | — | Vulnerability in navify® Digital Pathology |
| CVE-2018-25147 | 9.3 | 31.4 | — | Microhard Systems IPn4G 1.1.0 Default Credentials Authentication Bypass |
| CVE-2026-111693 | 9.3 | 30.2 | — | DataBuff ai-apm-web through 0.1.10 Hard-Coded Default Admin Credentials |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| ibm | 4 |
| cisa | 2 |
| dell | 2 |
| 201206030 | 1 |
| andritz | 1 |
| brickcom | 1 |
| care everywhere | 1 |
| danelec | 1 |
| databufflabs | 1 |
| datiphy | 1 |
| eclipse foundation | 1 |
| estrellaxd | 1 |
| grisuno | 1 |
| iflytek | 1 |
| innotim software, telecommunications and consultancy trade ltd. co | 1 |
