Skip to content
BackEsc
Sign in

CWE-321 · weakness in Cryptography

Use of Hard-coded Cryptographic Key

436 CVEs · 2 exploited

Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.

exploited in the wild
2
check available
4
likely to be exploited
3

Every one of the 436 is a mark on the map. Named now: 1 to 26, most at risk first.

  1. Gladinet CentreStack < 16.4.10315.56368 Use of Hard-coded Key Leads to Unauthenticated RCECVE-2025-30406Gladinet · CVSS 9 · 95% likely

    Gladinet

  2. Apache Shiro 1.2.4 Cookie RememberME - Deserial Remote Code Execution VulnerabilityCVE-2016-4437Apache · CVSS 9.8 · 93% likely

    Apache

  3. Dragonfly2 < 2.1.0-beta.1 - Hardcoded JWT SecretCVE-2023-27584dragonflyoss · CVSS 9.8 · 34% likely

    Dragonflyoss

  4. Netmaker - Hardcoded DNS Secret KeyCVE-2023-32077gravitl · CVSS 7.5 · 3.5% likely

    Gravitl

  5. Issabel Framework - Hard-Coded PBX API JWT KeyCVE-2026-89026Issabel Foundation · CVSS 9.8 · 2.7% likelycovered by CyberSIXT

    1 article

  6. Kener - Authentication BypassCVE-2026-116747rajnandan1 · CVSS 8.1 · 2.1% likely
  7. D-Link D-View Use of Hard-coded Cryptographic Key Authentication Bypass VulnerabilityCVE-2023-32169D-Link · CVSS 9.8 · 56% likely

    D-Link

  8. This vulnerability allows network-adjacent attackers execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. Authentication is n…CVE-2020-10884TP-Link · CVSS 8.1 · 39% likely

    TP-Link

  9. Hard-coded TLS CertificateCVE-2021-4228Lanner Inc · CVSS 5.8 · 10% likely

    Lanner Inc

  10. Moxa EDR 810, all versions 5.1 and prior, allows an unauthenticated attacker to be able to retrieve some log files from the device, which may allow sensitive information disclosur…CVE-2019-10963Moxa EDR 810 · 6.5% likely
  11. Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versions, RSLogix 500 Software v12.001 and prio…CVE-2020-6990Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Ser… · CVSS 9.8 · 5.9% likely
  12. SonicWall SMA1000 series firmware 12.4.0, 12.4.1-02965 and earlier versions uses a shared and hard-coded encryption key to store data.CVE-2022-1701SonicWall · 4.8% likely

    SonicWall

  13. A hard-coded cryptographic key vulnerability in the default configuration file was found in Kiali, all versions prior to 1.15.1. A remote attacker could abuse this flaw by creatin…CVE-2020-1764Red Hat · CVSS 8.6 · 3.5% likely

    Red Hat

  14. Zbtlink MQWrt infosrvd Command InjectionCVE-2026-74233Zbtlink · CVSS 9.8 · 3.4% likelycovered by CyberSIXT

    1 article

  15. Calero VeraSMART < 2022 R1 Static IIS Machine Keys Enable ViewState RCECVE-2026-26335Calero · CVSS 9.3 · 3.0% likely
  16. Hard-coded encryption keys in Twonky ServerCVE-2025-13316Lynxtechnology · CVSS 8.2 · 2.8% likely
  17. Sensitive data exposureCVE-2026-86708Zohocorp · CVSS 10 · 2.7% likelycovered by CyberSIXT

    Zoho (ManageEngine)1 article

  18. Cisco Policy Suite Static SSH Keys VulnerabilityCVE-2021-40119Cisco · CVSS 9.8 · 2.5% likely

    Cisco

  19. GE Multilink Use of Hard-coded Cryptographic KeyCVE-2014-5419GE · CVSS 10 · 2.4% likely

    GE

  20. The usage of hard-coded cryptographic keys within the ServiceAgent binary allows for the decryption of captured traffic across the network from or to the Moxa AWK-3131A firmware v…CVE-2019-5137Moxa · CVSS 7.5 · 2.3% likely
  21. An issue was discovered in Siklu Communications Etherhaul 8010TX and 1200FX devices, Firmware 7.4.0 through 10.7.3 and possibly other previous versions. The rfpiped service listen…CVE-2025-57174CVSS 9.8 · 2.2% likely
  22. A Use of Hard-Coded Cryptographic Key issue was discovered in Hyundai Motor America Blue Link 3.9.5 and 3.9.4. The application uses a hard-coded decryption password to protect sen…CVE-2017-6054Hyundai Motor America Blue Link · 2.1% likely
  23. A Use of Hard-coded Cryptographic Key issue was discovered in Korenix JetNet JetNet5018G version 1.4, JetNet5310G version 1.4a, JetNet5428G-2G-2FX version 1.4, JetNet5628G-R versi…CVE-2017-14021Korenix JetNet · 1.9% likely
  24. Use of Hard-coded Cryptographic Key in gravitl/netmakerCVE-2022-0664gravitl · CVSS 8.8 · 1.7% likely

    Gravitl

  25. Hospira MedNet Use of Hard-coded Cryptographic KeyCVE-2014-5403Hospira · CVSS 6.8 · 1.7% likely

    Hospira

  26. Databasir 1.01 has Use of Hard-coded Cryptographic Key vulnerability.CVE-2022-24860vran-dev · CVSS 7.4 · 1.7% likely

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in