Skip to content
OpenAdvisories

Weakness (CWE)

CWE-1188: Initialization of a Resource with an Insecure Default

Base Incomplete

The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.

Source: MITRE CWE-1188

All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-122006 Public exploit

    The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server…

    rubyonrails Active Storage rails rails Debian Ubuntu
  • Critical 10.0
    CVE-2026-103956 Public exploit Scanner template

    Missing authentication for critical function in Loom for AWS

    Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain super-admin authority over the agent control plane, including registering tool servers, reading stored integration crede…

    AWS loom
  • Critical 9.1
    CVE-2026-52824 Public exploit Scanner template

    Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover

    Kimai is an open-source time tracking application. Prior to 2.58.0, the official Docker image sets APP_SECRET to the public value change_this_to_something_unique in Dockerfile, and .docker/entrypoint.sh neither replaces nor rejects that value before Symfony u…

    Kimai Project kimai kimai/kimai Packagist
  • Critical 9.5
    CVE-2026-66066 Public exploit EPSS 33%

    Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing

    Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an oper…

    rails rails rails rails Debian Ubuntu RubyGems
  • Critical 10.0
    CVE-2026-47668 Public exploit Scanner template

    DbGate: Unauthenticated Remote Code Execution via JSON Script Runner

    DbGate is cross-platform database manager. In versions 7.1.8 and prior, DbGate's JSON script runner (`POST /runners/start`) allows remote code execution via code injection in the `functionName` parameter of JSON script `assign` commands. The `functionName` va…

    dbgate dbgate dbgate-serve npm
  • Critical 10.0
    CVE-2026-41679 Exploited Public exploit Scanner template EPSS 32%

    Paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass

    Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Prior to version 2026.416.0, an unauthenticated attacker can achieve full remote code execution on any network-accessible Paperclip instance running in `authen…

    paperclipai @paperclipai/server paperclip @paperclipai/server npm
  • Critical 9.8
    CVE-2026-26190 Public exploit Scanner template EPSS 39%

    Milvus Allows Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise

    Milvus is an open-source vector database built for generative AI applications. Prior to 2.5.27 and 2.6.10, Milvus exposes TCP port 9091 by default, which enables authentication bypasses. The /expr debug endpoint uses a weak, predictable default authentication…

    milvus-io milvus github.com/milvus-io/milvus Go
  • Critical 9.8
    CVE-2022-24706 Exploited Public exploit Scanner template EPSS 93%

    Remote Code Execution Vulnerability in Packaging

    In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including re…

    Apache Software Foundation Apache CouchDB
    KEV Aug 25, 2022
  • Critical 9.8
    CVE-2020-13927 Exploited Public exploit Scanner template EPSS 100%

    Authentication bypass in Apache Airflow

    The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and …

    apache-airflow PyPI
    KEV Jan 18, 2022