CVE-2026-77933Critical· 9.8▾ MidnightDB-GPT through 0.8.2 contains a hardcoded credentials vulnerability in its default docker-compose.yml that sets a static MYSQL_ROOT_PASSWORD and publishes port 3306 on all interfaces. Attackers reaching port 3306 or the shared dbgptnet n…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 53.9 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
DB-GPT through 0.8.2 contains a hardcoded credentials vulnerability in its default docker-compose.yml that sets a static MYSQL_ROOT_PASSWORD and publishes port 3306 on all interfaces. Attackers reaching port 3306 or the shared dbgptnet network can authenticate as root@% to gain full database access including FILE and SUPER privileges.
DB-GPT <= 0.8.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-77932Critical· 9.8DB-GPT through 0.8.2 Unauthenticated RCE via /api/v1/chat/react-agent
CVE-2026-112296Critical· 9.8FlyCms through commit edfdf724 Default Super Administrator Credentials
CVE-2026-111998Critical· 9.8Vanus 0.8.0 through 0.9.0 Default Admin Credentials via Gateway
CVE-2026-111693Critical· 9.8DataBuff ai-apm-web through 0.1.10 Hard-Coded Default Admin Credentials
CVE-2026-111329Critical· 9.8JuggleIM im-server through 1.8.16 Default Admin Credentials in Admin Console
CVE-2026-108783High· 7.3A security vulnerability has been detected in PRVTPRO Amnezia-Web-Panel up to 1.6.2/1.7.2