Skip to content
OpenAdvisories

Weakness (CWE)

CWE-1188: Initialization of a Resource with an Insecure Default

Base Incomplete

The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.

Source: MITRE CWE-1188

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 8.2
    CVE-2026-116244 Public exploit

    pgAdmin 4: libpq uses the pgAdmin service account's Kerberos credentials

    When a pgAdmin 4 connection was not meant to use a Kerberos user's delegated credentials, pgAdmin removed KRB5CCNAME from its environment, so the Kerberos library fell back to the default credential cache, or a client keytab, of the operating-system account r…

    pgadmin.org pgAdmin 4
  • High 8.1
    CVE-2026-44825 Public exploit

    Apache Solr: Enabling BasicAuth using bin/solr CLI configures additional insecure users

    Hardcoded credentials in the Basic Authentication setup tool (bin/solr auth enable) in Apache Solr versions 9.4.0 through 9.10.1 and 10.0.0 allows a remote attacker to gain full administrative access to the cluster via publicly known default credentials insta…

    Apache Software Foundation Apache Solr org.apache.solr:solr-core Maven
  • High 7.3
    CVE-2026-44338 Public exploit EPSS 33%

    PraisonAI ships and generates a legacy API server with authentication disabled by default, allowing unauthenticated workflow execution

    PraisonAI is a multi-agent teams system. From version 2.5.6 to before version 4.6.34, PraisonAI ships a legacy Flask API server with authentication disabled by default. When that server is used, any caller that can reach it can access /agents and trigger the …

    MervinPraison PraisonAI praisonai PyPI
  • High 8.8
    CVE-2026-6043 Public exploit

    Insecure Default Configuration in P4 Server

    P4 Server versions prior to 2026.1 are configured with insecure default settings that, when exposed to untrusted networks, allow unauthenticated attackers to create arbitrary user accounts, enumerate existing users, authenticate to accounts with no password s…

    Perforce Helix Core Server (P4D)
  • High 8.5
    CVE-2024-32114 Public exploit

    Apache ActiveMQ: Jolokia and REST API were not secured with default configuration

    In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web context (where the Jolokia JMX REST API and the Message REST API are located). It means that anyone can use these layers without any required authentication. Potentially, anyone can …

    Apache Software Foundation Apache ActiveMQ org.apache.activemq:apache-activemq Maven
  • High 8.9
    CVE-2023-27524 Exploited Public exploit EPSS 98%

    Apache Superset: Session validation vulnerability when using provided default SECRET_KEY

    Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resour…

    Apache Software Foundation Apache Superset apache-superset PyPI
    KEV Jan 8, 2024
  • High 8.1
    CVE-2018-15685 Public exploit EPSS 10%

    Electron webPreferences vulnerability can be used to perform remote code execution

    GitHub Electron 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6, in certain scenarios involving IFRAME elements and "nativeWindowOpen: true" or "sandbox: true" options, is affected by a WebPreferences vulnerability that can be leveraged to perform remote code executio…

    electron npm