CWE-1188 · weakness in Misconfiguration and Insecure Design
Initialization of a Resource with an Insecure Default
286 CVEs · 4 exploited
Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.
- exploited in the wild
- 4
- check available
- 7
- likely to be exploited
- 9
Every one of the 286 is a mark on the map. Named now: 1 to 26, most at risk first.
- Apache Superset - Authentication Bypass
- CouchDB Erlang Distribution - Remote Command Execution
- The TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap dump endpoint at a /heapdump URI, as exploited in the wild in May 2025.
- Unitronics VisiLogic uses a default administrative password
- Tieline IP Audio Gateway <=2.6.4.8 - Unauthorized Remote Admin Panel Access
- Redash Setup Configuration - Default Secrets Disclosure
- Apache ActiveMQ 6.x < 6.1.2 - Broken Access Control
- MotionEye Config Info Disclosure
- Fastify Swagger-UI - Information Disclosure
- Kimai <= 2.57.0 - Default APP_SECRET Authentication Bypass
- Mage AI - Insecure Default Authentication Setup
- Zoho ManageEngine DataSecurity Plus prior to 6.0.1 uses default admin credentials to communicate with a DataEngine Xnode server. This allows an attacker to bypass authentication f…
- CVE-2024-2758
- Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing
- Lansweeper 6.0.x through 7.2.x has a default installation in which the admin password is configured for the admin account, unless "Built-in admin" is manually unchecked. This allo…
- The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCred…
- Raspberry Pi OS through 5.10 has the raspberry default password for the pi account. If not changed, attackers can gain administrator privileges.
- An issue was discovered in Pivotal Spring Web Flow through 2.4.4. Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding property which is disable…
- An issue was discovered in Schneider Electric Tableau Server/Desktop Versions 7.0 to 10.1.3 in Wonderware Intelligence Versions 2014R3 and prior. These versions contain a system a…
- GitHub Electron 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6, in certain scenarios involving IFRAME elements and "nativeWindowOpen: true" or "sandbox: true" options, is affected by a We…
- A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
- An issue was discovered on Siemens SICAM RTUs SM-2556 COM Modules with the firmware variants ENOS00, ERAC00, ETA2, ETLS00, MODi00, and DNPi00. The integrated web server (port 80/t…
- Linear eMerge E3-Series devices have Default Credentials.
- Router Default Credentials in Kraftway 24F2XG Router firmware version 3.5.30.1118 allow remote attackers to get privileged access to the router.
- The BluStar component in Mitel InAttend before 2.5 SP3 and CMG before 8.4 SP3 Suite Servers has a default password, which could allow remote attackers to gain unauthorized access…
- Xamarin.Forms Spoofing Vulnerability
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.