CVE-2026-19900High· 8.1▾ MidnightPoC availableA vulnerability was identified in LB-LINK X-PRO 1.0.22-20231206. The impacted element is an unknown function of the file /etc/shadow. The manipulation leads to hard-coded credentials. It is possible to initiate the attack remotely. A hig…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 44.6 · likelihood 0.6 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 2 sources. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Aug 16.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.5%
1 GitHub repo · Nuclei ×1
0.5% → 2.9%
A vulnerability was identified in LB-LINK X-PRO 1.0.22-20231206. The impacted element is an unknown function of the file /etc/shadow. The manipulation leads to hard-coded credentials. It is possible to initiate the attack remotely. A high degree of complexity is needed for the attack. The exploitability is regarded as difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-112146High· 7.4D-Link E15/M32/R15/R32 MQTT Broker passwd hard-coded credentials
CVE-2026-108584Medium· 5.3A security flaw has been discovered in FunnyWolf Viper up to 3.1.11
CVE-2026-105147High· 7.3A vulnerability was determined in SciPhi-AI R2R up to 3.6.6
CVE-2026-101052High· 7.3A security vulnerability has been detected in refly-ai refly up to 1.1.0
CVE-2026-96548Medium· 5.6A flaw has been found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8
CVE-2026-90509High· 7.3A weakness has been identified in dromara orion-visor up to 2.5.7