CWE-1394

CWE-1394 · 9 records · 6 with a public proof-of-concept

Records the NVD classes under CWE-1394, highest CVSS first.

  1. CRITICAL 9.8CVE-2026-85295public PoC2026-11-06

    Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, four authentication helpers accepted session tokens signed with CB_SECRET, including known, weak, or shipped-default …

    AI risk analysis on Exploit-DB.ai →

  2. CRITICAL 9.8CVE-2026-120442public PoC2026-11-02

    ape-volo-admin before 3.6.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key in appsettings.json. Attackers can sign tokens offline with the jti claim set to t…

    AI risk analysis on Exploit-DB.ai →

  3. CRITICAL 9.8CVE-2026-119660public PoC2026-10-30

    MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin sessions by using the hard-coded default session_key 'muse_bot_session_key'. Attackers can sign a MuseBot-session cookie carrying a user_i…

    AI risk analysis on Exploit-DB.ai →

  4. HIGH 8.1CVE-2020-37281public PoC2026-10-14

    Gravitee API Management through 4.12.22 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to impersonate any user by forging JWTs signed with the shipped default jwt.secret. Attackers knowing an existing user ID can s…

    AI risk analysis on Exploit-DB.ai →

  5. HIGH 7.8CVE-2026-1218182026-11-04

    Herowatch Mini developed by About Time Technologies has a system signing vulnerability. Authenticated local attackers can exploit a publicly available test key to sign malicious programs, allowing them to elevate privileges and execute arbitrary code.

    AI risk analysis on Exploit-DB.ai →

  6. HIGH 7.7CVE-2026-728952026-10-13

    A vulnerability has been identified in SIMATIC IPC BX-21A (All versions < V31.01.13), SIMATIC IPC RW-543A (All versions < V1.1.4), SIMATIC IPC227G / IPC277G / IPC277G PRO / IPC327G / IPC377G (All versions < V28.01.15). A BIOS vendor test key is present in the …

    AI risk analysis on Exploit-DB.ai →

  7. MEDIUM 6.5CVE-2026-111367public PoC2026-10-15

    BillionMail through 4.9 contains a hard-coded cryptographic key vulnerability that allows unauthenticated attackers to forge unsubscribe and subscribe-confirm JWTs by computing the key from shipped configuration constants. Attackers can submit forged tokens to…

    AI risk analysis on Exploit-DB.ai →

  8. MEDIUM 6.4CVE-2026-927772026-10-16

    A potential vulnerability was reported in some Lenovo Tablets that could allow a user with physical access to an unlocked tablet to bypass device protections and execute arbitrary code.

    AI risk analysis on Exploit-DB.ai →

  9. MEDIUM 5.9CVE-2026-107177public PoC2026-10-07

    Express Gateway through 1.16.11 contains a hardcoded cryptographic key vulnerability that allows attackers with datastore access to decrypt stored OAuth 2.0 token secrets via the default crypto.cipherKey 'sensitiveKey'. Attackers who can read Redis can decrypt…

    AI risk analysis on Exploit-DB.ai →