CWE-1188: Initialization of a Resource with an Insecure Default
The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.
A kind of CWE-1419 Incorrect Initialization of Resource.
From the CWE List. © The MITRE Corporation.
Newest
- traefik, red hat openshift dev spaces 3.27, openshift dev spaces 3.28 +1 more +3 moreTraefik mTLS bypass via fragmented ClientHello SNI extraction failure7.8 High
- error311 fileriseFileRise: Default Encryption Key Enables Token Forgery and Config Decryption8.2 High
- wwbn avideoWWBN AVideo has predictable default admin credentials in official Docker deployment path8.1 High
- mintplexlabs anythingllm, mintplex-labs anything-llm +1 moreAnythingLLM Permissable CORS policy7.1 High
- himmelblau-idm himmelblauHimmelblau unset domain configuration can allow any-tenant authentication at first login for remote deployments10.0 Critical
- cloudcli cloud cli, siteboon claudecodeui +1 moreCloud CLI WebSocket shell injection8.7 High
- cesanta mongoose web serverMongoose Web Server 6.9 Denial of Service via Socket Connection8.7 High
- amppsAMPPS 2.7 Denial of Service via Malformed Socket Connection8.7 High
- microsoft aci confidential containersMicrosoft ACI Confidential Containers Information Disclosure Vulnerability6.5 Medium
- datacast sfx2100 firmware, international datacasting corporation (idc) sfx2100 series superflex satellitereceiver +1 moreUnauthenticated RCE via SNMP Default Writable Community String10.0 Critical
- openclawOpenClaw < 2026.2.21 - OS-level Sandbox Bypass via --no-sandbox Flag4.8 Medium
- utt 810 firmwareUTT HiPER 810 / nv810v4 router firmware v1.5.0-140603 was discovered to contain insecure default...9.8 Critical
- beetel 777vr1, 777vr1 firmware +1 moreBeetel 777VR1 Telnet Service/SSH Service insecure default initialization of resource5.3 Medium
- milvusMilvus Allows Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise9.8 Critical
- brstefanovic advanced country blockerAdvanced Country Blocker <= 2.3.1 - Unauthenticated Authorization Bypass via Insecure Default Secret Key5.3 Medium
- frangoteam fuxaFUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default Configuration9.5 Critical
- frangoteam fuxaFUXA contains an insecure default configuration vulnerability9.3 Critical
- bpg terraform-provider-proxmox, terraform provider +1 moreterraform-provider-proxmox has insecure sudo recommendation in the documentation8.7 High
- dormakaba access manager 92xx-k5, access manager 92xx-k7 +1 moreUnauthenticated SOAP API in dormakaba access manager9.3 Critical
- dormakaba kaba exos 9300Unauthenticated SOAP API in dormakaba Kaba exos 93009.3 Critical
- suse harvesterHarvest may expose OS default ssh login password via SUSE Virtualization Interactive Installer9.8 Critical
- kentico xperienceStored Cross-site Scripting (XSS) in Kentico Xperience 137.7 High
- pangolinAuthentication Bypass in fosrl/pangolin v1.6.2 and before allows attackers to access Pangolin...9.1 Critical
- alasca yaookInitialization of a Resource with an Insecure Default in YAOOK6.5 Medium
- misskeyMisskey has a login rate limit bypass via spoofed X-Forwarded-For header6.9 Medium
- groupsession, japan total system co.,ltd. groupsession bycloud, groupsession free edition +1 more +3 moreIn GroupSession Free edition prior to ver5.7.1, GroupSession byCloud prior to ver5.7.1, and...5.1 Medium
- hcl software bigfix saas remediateHCL BigFix SaaS Remediate is affected by a security vulnerability5.4 Medium
- lfprojects mcp python sdk, modelcontextprotocol python-sdk +1 moreDNS Rebinding Protection Disabled by Default in Model Context Protocol Python SDK for Servers Running on Localhost7.6 High
- lfprojects mcp typescript sdk, modelcontextprotocol typescript-sdk +1 moreDNS Rebinding Protection Disabled by Default in Model Context Protocol TypeScript SDK for Servers Running on Localhost7.6 High
- google androidIn findAvailRecognizer of VoiceInteractionManagerService.java, there is a possible way to become...7.8 High
- google androidIn DefaultTransitionHandler.java, there is a possible way to enable a tapjacking attack due to a...7.3 High
- hashicorp terraform provider, tooling +1 moreVault Terraform Provider Applied Incorrect Defaults for LDAP Auth Method7.4 High
- abilis cpx, antek abilis cpx firmware +1 moreAbilis CPX Fallback Shell Connection Relay6.5 Medium
- jenkins eggplant runner, jenkins project eggplant runner plugin +1 moreJenkins Eggplant Runner Plugin protection mechanism disabled5.9 Medium
- dnnsoftware dotnetnuke, dnn.platform +1 moreDNN CKEditor Provider allows unauthenticated upload out-of-the-box4.3 Medium
- No product listedAn issue in MikroTik RouterOS v.7.14.2 and SwitchOS v.2.18 allows a remote attacker to execute...10.0 Critical
- vmware aria operations, cloud foundation, telco cloud infrastructure +1 more +3 moreVMSA-2025-0015: VMware Aria Operations and VMware Tools updates address multiple vulnerabilities (CVE-2025-41244,CVE-2025-41245, CVE-2025-41246)4.9 Medium
- h3c magic nx15 firmwareH3C devices running firmware version NX15V100R015 are vulnerable to unauthorized access due to...8.0 High
- liferay dxp, portal, digital experience platform +2 moreLiferay has Insecure Default Initialization of Resource issue5.3 Medium
- wago cc100 0751-9301, cc100 0751-9301 hw rev. <082100, cc100 0751-9301/k000-0005 +45 more +47 moreWAGO: Vulnerability in hardware switch circuit6.5 Medium
- ibm fusion, fusion hci, fusion hci for watsonx +3 more +5 moreIBM Fusion insecure default configuration8.7 High
- himmelblau-idm himmelblauHimmelblau vulnerable to GID collision via group name-derived mapping (privilege escalation)4.4 Medium
- google androidIn generateRandomPassword of LocalBluetoothLeBroadcast.java, there is a possible way to intercept...5.7 Medium
- linux, linux kernel +1 morecifs: Fix the smbd_response slab to allow usercopy7.5 High
- rockwell automation 1756-en2f/c, 1756-en2t/d, 1756-en2tp/a +2 more +4 moreRockwell Automation ControlLogix® Ethernet Remote Code Execution Vulnerability9.3 Critical
- psu haxcms-nodejs, haxtheweb issues +1 moreHAXcms's Insecure Default Configuration Leads to Unauthenticated Access9.3 Critical
- trendnet tew-wlc100p firmwareIn TRENDnet TEW-WLC100P 2.03b03, the i_dont_care_about_security_and_use_aggressive_mode_psk...7.3 High
- phoenix contact charx sec-3000, charx sec-3050, charx sec-3100 +5 more +7 moreOCPP Backend Configuration via Insecure Defaults8.8 High
- wago device sphereWAGO: Vulnerability in WAGO Device Sphere10.0 Critical
- open zipkin zipkinZipkin Server vulnerable to Insecure Resource Initialization through its /heapdump endpoint5.3 Medium
- Show moreLoading…