CWE-1188: Initialization of a Resource with an Insecure Default
The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.
A kind of CWE-1419 Incorrect Initialization of Resource.
From the CWE List. © The MITRE Corporation.
Newest
- messagepack, messagepack-csharp +1 moreMessagePack-CSharp: ASP.NET Core MessagePackInputFormatter defaults to TrustedData for HTTP request bodies6.3 Medium
kozounpm,@kozou/apinpm,@kozou/corenpm +1 more +3 moreKozou: Unauthenticated MCP HTTP server and bundled dev-stack hardening (DNS-rebinding, request-body limits, read-only reads, default network exposure)8.4 High- microsoft github copilot chatMicrosoft Visual Studio Code CoPilot Chat Security Feature Bypass Vulnerability6.5 Medium
- mervinpraison praisonai, praisonai-platform +1 morepraisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgery9.8 Critical
- mervinpraison praisonai, praisonai-platform +1 morepraisonai-platform 0.1.4 still boots on the hardcoded JWT secret dev-secret-change-me (default-open production guard)9.8 Critical
- mervinpraison praisonaiPraisonAI MCPServer exposes unauthenticated HTTP tools/call9.8 Critical
- mervinpraison praisonaipraisonai: recipe serve auth middleware silently disables itself when no secret is set9.8 Critical
- splunk ai toolkitInsecure Default Domain Allowlist in Splunk AI Toolkit4.3 Medium
- canon eos network setting tool, canon inc. eos network setting tool for macos, eos network setting tool for windows +2 moreUse of a non-secure protocol as the default FTP configuration in Canon EOS Network Setting Tool...7.1 High
- mispMISP automation endpoints may be exposed to CSRF when Sec-Fetch-Site protection is disabled by default7.1 High
- broadcom spring web services, spring web services +1 moreWss4jSecurityInterceptor disables WS-I BSP validation by default8.2 High
- nettyNetty has a Vulnerable Default Configuration Which Leads to Denial of Service via Unbounded HTTP/3 Header Size7.5 High
- dbgateDbGate: Unauthenticated Remote Code Execution via JSON Script Runner10.0 Critical
- No product listedMercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 contains hardcoded WiFi driver...5.9 Medium
- No product listedMercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 enables WPS 2.0 by default with a weak...6.4 Medium
- apache solrApache Solr: Enabling BasicAuth using bin/solr CLI configures additional insecure users8.1 High
- google androidIn PostWipeData of recovery_ui.cpp, there is a possible data persistence issue after a factory...4.0 Medium
- mervinpraison praisonaiPraisonAI `deploy --type api` emits a Flask server with authentication disabled by default9.8 Critical
- xcharge c6Initialization of a resource with an insecure default in XCharge C68.6 High
- nvidia geforce, gpu display driver, rtx, quadro, nvs +2 more +4 moreNVIDIA Display Driver for Linux contains a vulnerability in the Multi-Instance GPU (MIG)...6.5 Medium
- internlm lmdeployLMDeploy: Hardcoded trust_remote_code=True is an implicit unsafe remote-code load path with no user opt-out7.8 High
- thorsten phpmyfaqphpMyFAQ - Authentication Bypass via Empty API Token8.7 High
- xyproto algernonAlgernon: Auto-refresh SSE event server binds to all interfaces by default on Linux/macOS4.3 Medium
github.com/xyproto/algernonGoAlgernon: Auto-refresh SSE event server binds to all interfaces with Access-Control-Allow-Origin: * and no authentication5.3 Medium- xyproto algernonAlgernon: Single-file mode unconditionally enables debug mode7.5 High
- grafana, grafana oss +1 moreAuth Proxy IPv6 whitelist bypass7.4 High
- antswordproject antswordAntSword: Incomplete noxss() sanitization leads to 1-click RCE via jquery.terminal format code injection8.8 High
- artica pandora fms, pandora fms fms +1 moreInsecure Default Initialization in API Authentication leads to Authentication Bypass9.1 Critical
- schneider electric ecostruxure™ panel server, schneider-electric ecostruxure panel server pas400 firmware, ecostruxure panel server pas600 firmware +3 more +5 moreInitialization of a Resource with an Insecure Default vulnerability on EcoStruxure™ Panel Server8.2 High
- siemens simatic hmi mtp1000 unified comfort panel, simatic hmi mtp1000 unified comfort panel hygienic, simatic hmi mtp1000 unified comfort panel hygienic neutral design +47 more +49 moreAffected devices do not properly restrict access to the web browser via the Control Panel when no...7.0 High
- siyuan-note siyuanSiYuan: URL-encoded title bypasses `escapeAriaLabel`, decoded by `decodeURIComponent` into a tooltip-XSS9.4 Critical
- siyuan-note siyuanSiYuan: Stored XSS via Attribute View name to Electron renderer RCE in SiYuan9.4 Critical
- mervinpraison praisonaiPraisonAI ships and generates a legacy API server with authentication disabled by default, allowing unauthenticated workflow execution7.3 High
- givanz vvvebVvveb < 1.0.8.2 Information Disclosure via Debug Exception Handler6.9 Medium
- hcl software bigfix service management (sm), hcltech bigfix service management +1 moreHCL BigFix Service Management (SM) is susceptible to a Root File System Not Mounted as Read-Only3.9 Low
- bridgehead software filestoreBridgeHead FileStore < 24A Apache Axis2 Default Credentials RCE9.3 Critical
- newapi new api, quantumnous new-api +1 moreNew API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud7.1 High
- perforce helix core server (p4d)Insecure Default Configuration in P4 Server8.8 High
code.gitea.io/giteaGoGitea has insecure default SSH settings6.3 Mediumengramxnpmengram: HTTP server CORS wildcard + auth-off-by-default enables CSRF graph exfiltration and persistent indirect prompt injection8.6 High- silex technology, inc. amc manager, sd-330ac, silextechnology sd-330ac firmware +2 moreInitialization of a resource with an insecure default vulnerability exists in SD-330AC and AMC...8.7 High
- openclawOpenClaw < 2026.4.15 - Authentication Bypass in Feishu Webhook and Card-Action Validation9.2 Critical
- openclawOpenClaw < 2026.4.10 - Chrome DevTools Protocol Exposure via Overly Broad CDP Relay Binding9.0 Critical
- openclawOpenClaw < 2026.4.14 - Server-Side Request Forgery via Private Network Navigation6.3 Medium
- paperclipai paperclip, paperclip paperclipai, paperclipai\/server +1 more +3 morePaperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass10.0 Critical
- openplc v3 v3, openplcproject openplc v3 firmware +1 moreInitialization of a resource with an insecure default in OpenPLC_V39.2 Critical
- budibaseBudibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist9.6 Critical
- electron, red hat build of podman desktop, build of podman desktop - tech preview +2 moreElectron: Context Isolation bypass via contextBridge VideoFrame transfer8.4 High
- lfprojects mcp go sdk, modelcontextprotocol go-sdk, red hat migration toolkit for virtualization +4 more +6 moreModel Context Protocol Go SDK: DNS Rebinding Protection Disabled by Default for Servers Running on Localhost7.6 High
- nvidia jetson xavier series and jetson orin series, jetson linux +1 moreNVIDIA Jetson for JetPack contains a vulnerability in the system initialization logic, where an...8.3 High
- Show moreLoading…