Skip to content
OpenAdvisories

Weakness (CWE)

CWE-1188: Initialization of a Resource with an Insecure Default

Base Incomplete

The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.

Source: MITRE CWE-1188

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Critical 10.0
    CVE-2026-41679 Exploited Public exploit EPSS 32%

    Paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass

    Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Prior to version 2026.416.0, an unauthenticated attacker can achieve full remote code execution on any network-accessible Paperclip instance running in `authen…

    paperclipai @paperclipai/server paperclip @paperclipai/server npm
  • Medium 5.3
    CVE-2025-48927 Exploited EPSS 12%

    The TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap dump endpoint at a /hea…

    TeleMessage service
    KEV Jul 1, 2025
  • Critical 9.8
    CVE-2023-6448 Exploited

    Unitronics VisiLogic uses a default administrative password

    Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with network access can take administrative control of a vulnerable system.

    Unitronics VisiLogic
    KEV Dec 11, 2023
  • High 8.9
    CVE-2023-27524 Exploited Public exploit EPSS 98%

    Apache Superset: Session validation vulnerability when using provided default SECRET_KEY

    Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resour…

    Apache Software Foundation Apache Superset apache-superset PyPI
    KEV Jan 8, 2024
  • Critical 9.8
    CVE-2022-24706 Exploited Public exploit EPSS 93%

    Remote Code Execution Vulnerability in Packaging

    In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including re…

    Apache Software Foundation Apache CouchDB
    KEV Aug 25, 2022
  • Critical 9.8
    CVE-2020-13927 Exploited Public exploit EPSS 100%

    Authentication bypass in Apache Airflow

    The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and …

    apache-airflow PyPI
    KEV Jan 18, 2022