Total
256 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-12504 | 2026-07-27 | N/A | N/A | ||
| Improper Authentication (CWE-287) in the PAM configuration in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a local attacker to authenticate as a uid=0 account without a password and obtain a root shell via an `/etc/passwd` entry with an empty password field. | |||||
| CVE-2026-34203 | 1 Networktocode | 1 Nautobot | 2026-07-24 | N/A | 2.7 LOW |
| Nautobot is a Network Source of Truth and Network Automation Platform. Prior to versions 2.4.30 and 3.0.10, user creation and editing via the REST API fails to apply the password validation rules defined by Django's AUTH_PASSWORD_VALIDATORS setting (which defaults to an empty list, i.e., no specific rules, but can be configured in Nautobot's nautobot_config.py to apply various rules if desired). This can potentially allow for the creation or modification of users to have passwords that are weak or otherwise do not comply with configured standards. This issue has been patched in versions 2.4.30 and 3.0.10. | |||||
| CVE-2026-9394 | 2026-07-23 | 1.8 LOW | 3.1 LOW | ||
| A vulnerability was determined in Besen BS20 EV Charging Station up to 20260426. This impacts an unknown function of the component Bluetooth Low Energy Handler. Executing a manipulation can lead to weak password requirements. The attack needs to be done within the local network. This attack is characterized by high complexity. The exploitability is said to be difficult. The original disclosure mentions, that "[t]hese vulnerabilities have been reported to Besen and we have received their acknowlegement that they are reviewing this as of April 2026." | |||||
| CVE-2026-11493 | 2026-07-23 | 4.3 MEDIUM | 5.0 MEDIUM | ||
| A weakness has been identified in Tenda AC15 15.03.05.19. The impacted element is an unknown function of the file /etc_ro/smb.conf of the component Samba. Executing a manipulation can lead to weak password requirements. The attack is only possible within the local network. A high complexity level is associated with this attack. The exploitability is regarded as difficult. The exploit has been made available to the public and could be used for attacks. | |||||
| CVE-2026-56577 | 2026-07-22 | N/A | 3.1 LOW | ||
| HCL MyCloud was affected with Weak Password Policy. It may increase the risk of account compromise through brute-force or credential-based attacks. | |||||
| CVE-2026-33771 | 1 Juniper | 1 Ctp Operating System | 2026-07-13 | N/A | 7.4 HIGH |
| A Weak Password Requirements vulnerability in the password management function of Juniper Networks CTP OS might allow an unauthenticated, network-based attacker to exploit weak passwords of local accounts and potentially take full control of the device. The password management menu enables the administrator to set password complexity requirements, but these settings are not saved. The issue can be verified with the menu option "Show password requirements". Failure to enforce the intended requirements can lead to weak passwords being used, which significantly increases the likelihood that an attacker can guess these and subsequently attain unauthorized access. This issue affects CTP OS versions 9.2R1 and 9.2R2. | |||||
| CVE-2025-28200 | 1 Govicture | 2 Rx1800, Rx1800 Firmware | 2026-07-05 | N/A | 9.8 CRITICAL |
| Victure RX1800 EN_V1.0.0_r12_110933 was discovered to utilize a weak default password which includes the last 8 digits of the Mac address. | |||||
| CVE-2025-63747 | 1 Testmanagement | 1 Qatraq | 2026-07-05 | N/A | 9.8 CRITICAL |
| QaTraq 6.9.2 ships with administrative account credentials which are enabled in default installations and permit immediate login via the web application login page. Because the account provides administrative privileges in the default configuration, an attacker who can reach the login page can gain administrative access. | |||||
| CVE-2024-42850 | 1 Silverpeas | 1 Silverpeas | 2026-07-05 | N/A | 9.8 CRITICAL |
| An issue in the password change function of Silverpeas v6.4.2 and lower allows for the bypassing of password complexity requirements. | |||||
| CVE-2026-35097 | 2026-06-30 | N/A | N/A | ||
| KTM System e-BOK enforces a maximum password length of six numeric digits and does not permit the use of any alphabetic, special, or extended characters. This issue was fixed in the patch published in June 2026. | |||||
| CVE-2026-6284 | 2026-06-17 | N/A | 9.1 CRITICAL | ||
| An attacker with network access to the PLC is able to brute force discover passwords to gain unauthorized access to systems and services. The limited password complexity and no password input limiters makes brute force password enumeration possible. | |||||
| CVE-2026-41038 | 1 Qntmnet | 2 Qn-i-470, Qn-i-470 Firmware | 2026-06-17 | N/A | 8.8 HIGH |
| This vulnerability exists in Quantum Networks router due to lack of enforcement of strong password policies in the web-based management interface. An attacker on the same network could exploit this vulnerability by performing password guessing or brute-force attacks against user accounts, leading to unauthorized access to the targeted device. | |||||
| CVE-2026-27575 | 1 Vikunja | 1 Vikunja | 2026-06-17 | N/A | 9.1 CRITICAL |
| Vikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, the application allows users to set weak passwords (e.g., 1234, password) without enforcing minimum strength requirements. Additionally, active sessions remain valid after a user changes their password. An attacker who compromises an account (via brute-force or credential stuffing) can maintain persistent access even after the victim resets their password. Version 2.0.0 contains a fix. | |||||
| CVE-2026-25715 | 2026-06-17 | N/A | 9.8 CRITICAL | ||
| The web management interface of the device allows the administrator username and password to be set to blank values. Once applied, the device permits authentication with empty credentials over the web management interface and Telnet service. This effectively disables authentication across all critical management channels, allowing any network-adjacent attacker to gain full administrative control without credentials. | |||||
| CVE-2026-1408 | 1 Beetel | 2 777vr1, 777vr1 Firmware | 2026-06-17 | 1.2 LOW | 2.0 LOW |
| A weakness has been identified in Beetel 777VR1 up to 01.00.09/01.00.09_55. This vulnerability affects unknown code of the component UART Interface. Executing a manipulation can lead to weak password requirements. The physical device can be targeted for the attack. The attack requires a high level of complexity. It is stated that the exploitability is difficult. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2025-9964 | 2026-06-17 | N/A | N/A | ||
| No password for the root user is set in Novakon P series. This allows phyiscal attackers to enter the console easily. This issue affects P series: P – V2001.A.C518o2 until P-2.0.05 Build 2026.02.06 (commit d0f97fd9). | |||||
| CVE-2025-9514 | 1 Macrozheng | 1 Mall | 2026-06-17 | 2.6 LOW | 3.7 LOW |
| A vulnerability has been found in macrozheng mall up to 1.0.3. This impacts an unknown function of the component Registration. Such manipulation leads to weak password requirements. The attack can be executed remotely. Attacks of this nature are highly complex. The exploitability is said to be difficult. The vendor deleted the GitHub issue for this vulnerability without and explanation. | |||||
| CVE-2025-8549 | 1 Pybbs Project | 1 Pybbs | 2026-06-17 | 2.6 LOW | 3.7 LOW |
| A vulnerability was found in atjiu pybbs up to 6.0.0. It has been classified as critical. Affected is the function update of the file src/main/java/co/yiiu/pybbs/controller/admin/UserAdminController.java. The manipulation leads to weak password requirements. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The patch is identified as d09cb19a8e7d7e5151282926ada54080244d499f. It is recommended to apply a patch to fix this issue. | |||||
| CVE-2025-8182 | 1 Tenda | 2 Ac18, Ac18 Firmware | 2026-06-17 | 5.1 MEDIUM | 5.6 MEDIUM |
| A vulnerability has been found in Tenda AC18 15.03.05.19 and classified as problematic. This vulnerability affects unknown code of the file /etc_ro/smb.conf of the component Samba. The manipulation leads to weak password requirements. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. | |||||
| CVE-2025-68963 | 1 Huawei | 2 Emui, Harmonyos | 2026-06-17 | N/A | 5.7 MEDIUM |
| Man-in-the-middle attack vulnerability in the Clone module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. | |||||