CVE-2026-61737Critical· 9.8▾ Midnightng-antd-admin is an Angular and NestJS administration system template. Prior to 22.0, a hardcoded default `JWT` secret permits token forgery when a deployment has not replaced the default secret, without a startup warning. An attacker ca…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 53.9 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.5%
ng-antd-admin is an Angular and NestJS administration system template. Prior to 22.0, a hardcoded default JWT secret permits token forgery when a deployment has not replaced the default secret, without a startup warning. An attacker can bypass authentication and authorization, impersonate any user including administrators, and access protected API endpoints, leading to account takeover, data leakage and unauthorized operations. Version 22.0 rejects the shipped secret in production but permits it with a warning in non-production environments.
ng-antd-admin < 22.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-91912High· 7.3Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Use of Hard-coded Cryptographic Key vulnerability
CVE-2026-119597Critical· 9.8OpenDeepWiki through 2.0.6 Hard-coded JWT Signing Key Admin Token Forgery
CVE-2025-62839High· 8.7Hard-coded Cryptographic Key #1
CVE-2025-62841High· 8.7Hard-coded Cryptographic Key #2
CVE-2026-86384Critical· 9.8Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, conta…
CVE-2026-102812Medium· 6.9Hardcoded AES-128 Key and Fixed IV in Configuration Backup Encryption in TP-Link RE305 and Archer C7