CWE-1188: Initialization of a Resource with an Insecure Default
The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.
A kind of CWE-1419 Incorrect Initialization of Resource.
From the CWE List. © The MITRE Corporation.
Newest
- signozSigNoz before 0.143.0 Authentication Bypass via Empty JWT Secret9.2 Critical
- apache tomcat nativeApache Tomcat Native: Insecure OpenSSL options enabled9.1 Critical
- temporal technologies, inc. serverTemporal Server worker deployment compute provider executes a caller-supplied command on the Worker Service host8.7 High
- obot-platform obotObot before v0.23.0 Server-Side Request Forgery via MCP8.3 High
- grandstream networks gwn7660elrGrandstream GWN7660ELR < 1.0.27.6 Information Disclosure via SNMP Default Community String6.9 Medium
- fuomag9 caddy-proxy-managerCaddy Proxy Manager: Registrations enabled by default allows creating users with "user" permission5.3 Medium
- nuxt-modules og-imageNuxt OG Image has unauthenticated SSRF via `fonts[].path` URL parameter6.9 Medium
- patriksimek vm2vm2 before 3.11.7 Sandbox Escape via CLI require9.3 Critical
- nl-portal nl.nl-portal:appnl.nl-portal:app has GraphiQL UI and GraphQL schema introspection enabled by default5.3 Medium
- No product listedAn insecure default configuration in the embedded Happytime RTSP server within the Sofia IPC...7.5 High
- kguard firmwareKGUARD DVR unauthenticated remote command execution vulnerability10.0 Critical
- eclipse foundation aeriosIn the current development version of Eclipse aeriOS, for which no official release has yet been...9.9 Critical
- ellite wallosWallos incomplete fix for CVE-2026-33407: unauthenticated httpoxy SSRF still reachable via `endpoints/payments/search.php`8.2 High
- oasdiff oasdiff-actionoasdiff actions resolve external $refs by default, enabling SSRF and disclosure of structured files on pull-request runs8.3 High
- google langfunEval Injection in google/langfun via default lf.query protocol9.2 Critical
- sonirico mcp-shellmcp-shell: Secure Mode Allowlist Bypass via Default `/bin/bash` Executable8.4 High
- rconfigrConfig Core 8.0.0 < 8.2.10 Unauthorized Admin Registration via web.php9.3 Critical
- nltkNLTK before 3.10.0 Insecure Default Configuration in pathsec.py8.7 High
- gohugo hugoHugo 0.162.0 to 0.164.x - Node Permission Model Bypass via Default TailwindCSS Child-Process Grant9.3 Critical
- openidentityplatform openamOpenAM Insecure SSO Cookie Initialization7.4 High
- No product listedCPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 contains a default TPM PCR policy that...9.8 Critical
- nozomi networks arcNpcap driver installed without administrator-only access restriction on Windows in Arc before v2.7.04.8 Medium
- sharp corporation network scanner tool lite, network scanner tool (bundled software for sharpdesk) +1 moreNetwork Scanner Tool and Network Scanner Tool Lite provided by Sharp Corporation, with the...6.9 Medium
- sharp corporation mfps, toshiba tec corporation tec mfps +1 moreSharp and Toshiba Tec MFPs (multifunction printers) for a certain market have been shipped with...6.9 Medium
- vps.org zulip templateVPS.org one-click Zulip template deployment instance contains multiple vulnerabilities9.8 Critical
- vps.org supabase templateVPS.org one-click Supabase template deployment instance contains multiple vulnerabilities9.1 Critical
- somta juggleJuggle 1.6.0 Unauthenticated RCE via Exposed H2 Console9.3 Critical
- railsAction Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing9.5 Critical
- joomdle.com joomdle component for joomlaJoomla Extension - joomdle.com - Insecure default configuration allows read/write user account access in Joomdle < 3.1.17.5 High
- alibaba cloud rds openapi mcp serverMCP Server Exposure via Insecure Default Binding on alibabacloud-rds-openapi-mcp-server5.8 Medium
- nlnet labs unboundPrivacy/configuration issue when adding local data in views through 'unbound-control'3.1 Low
- joomdonation.com membership pro extension for joomlaJoomla Extension - joomdonation.com - Insecure default configuration Membership Pro < 4.6.29.1 Critical
- joomdonation.com events booking extension for joomlaJoomla Extension - joomdonation.com - Insecure default configuration Events Booking < 5.8.09.8 Critical
- zephyrproject zephyrUser thread can re-initialize an in-use `k_pipe`, corrupting kernel wait queues (`CONFIG_USERSPACE`)7.1 High
- kimaiKimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover9.1 Critical
- red hat openshift gitops, argoproj argo-helm, red hat openshift data foundation 4 +1 more +3 moreArgo-cd: argo cd unauthenticated remote code execution in repo-server via generatemanifest grpc endpoint8.9 High
- argoproj argo-helmArgo CD Helm Chart < 10.0.0 Missing Network Policy RCE8.6 High
- mervinpraison praisonaiPraisonAI before 4.6.78 Prompt Injection Defense Bypass8.7 High
- siemens cpci85 central processing/communication, sicore base system +1 moreA vulnerability has been identified in CPCI85 Central Processing/Communication (All versions <...6.3 Medium
- better-authbetter-auth before 1.6.11 Insecure Cryptographic Defaults via oidcProvider9.4 Critical
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 6 +24 more +26 moreSssd: sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation8.8 High
- zedeus nitterNitter - Server-Side Request Forgery in /video Media Proxy Endpoint7.7 High
nono-pyPyPInono-py vulnerable to authorization bypass / policy confusion5.2 Medium- opf openprojectOpenProject: Pre-authentication RCE in openproject/openproject Docker image via default `SECRET_KEY_BASE=OVERWRITE_ME` and `cookies_serializer = :marshal`9.9 Critical
- openidentityplatform openamOpenAM Authentication Bypass via MSISDN LDAP Injection9.3 Critical
- appsmithAppsmith: Caddy admin API exposed without authentication9.9 Critical
- siyuan-note siyuanSiYuan: Stored XSS to RCE via attribute-view cell rendering in genAVValueHTML()9.9 Critical
- siyuan-note siyuanSiYuan: Stored XSS to RCE via CSS-snippet <style> breakout in renderSnippet()9.9 Critical
- siyuan-note siyuanSiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode arbitrary file─read)7.5 High
- messagepack, messagepack-csharp +1 moreMessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflows8.2 High
- Show moreLoading…