Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.6Vault’s PKI engine’s ACME validation did not reject local targets when issuing http-01 and tls-alpn-01 challenges.Check if you run itEPSS 0.34%Apr 17, 2026
- High8.8If a Vault auth mount is configured to pass through the "Authorization" header, and the "Authorization" header is used to authenticate to Vault, Vault forwarded the Va…Check if you run itEPSS 0.41%Apr 17, 2026
- High8.1An authenticated user with access to a kvv2 path through a policy containing a glob may be able to delete secrets they were not authorized to read or write, resulting…Check if you run itEPSS 0.38%Apr 17, 2026
- High7.5HCSEC-2026-08 - Vault Vulnerable to Denial-of-Service via Unauthenticated Root Token Generation/Rekey OperationsCheck if you run itEPSS 0.72%Apr 17, 2026
- Medium4.3Jenkins HashiCorp Vault Plugin 371.v884a_4dd60fb_6 and earlier does not set the appropriate context for Vault credentials lookup, allowing attackers with Item/Configure permissionCheck if you run itEPSS 0.23%Dec 10, 2025
- High7.5Vault and Vault Enterprise (“Vault”) are vulnerable to an unauthenticated denial of service when processing JSON payloads.Check if you run itEPSS 0.53%Oct 23, 2025
- High8.1Vault and Vault Enterprise’s (“Vault”) AWS Auth method may be susceptible to authentication bypass if the role of the configured bound_principal_iam is the same across AWS accountsCheck if you run itEPSS 0.49%Oct 23, 2025
- Medium6.5Vault and Vault Enterprise’s (“Vault”) ldap auth method may not have correctly enforced MFA if username_as_alias was set to true and a user had multiple CNs that are equal but withCheck if you run itEPSS 0.57%Aug 6, 2025
- Medium5.7Vault and Vault Enterprise’s (“Vault”) login MFA rate limits could be bypassed and TOTP tokens could be reused.Check if you run itEPSS 0.38%Aug 1, 2025
- Low3.7A timing side channel in Vault and Vault Enterprise’s (“Vault”) userpass auth method allowed an attacker to distinguish between existing and non-existing users, and potentially enuCheck if you run itEPSS 0.38%Aug 1, 2025
- Medium5.3Vault and Vault Enterprise’s (“Vault”) user lockout feature could be bypassed for Userpass and LDAP authentication methods.Check if you run itEPSS 0.46%Aug 1, 2025
- Medium6.5Vault and Vault Enterprise’s (“Vault”) TOTP Secrets Engine code validation endpoint is susceptible to code reuse within its validity period.Check if you run itEPSS 0.45%Aug 1, 2025
- Critical9.1A privileged Vault operator within the root namespace with write permission to {{sys/audit}} may obtain code execution on the underlying host if a plugin directory is set in Vault’Check if you run itEPSS 0.96%Aug 1, 2025
- High7.2A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or another user’s token privileges to Vault’s root policy.Check if you run itEPSS 0.53%Aug 1, 2025
- Low3.1Vault Community and Vault Enterprise rekey and recovery key operations can lead to a denial of service due to uncontrolled cancellation by a Vault operator.Check if you run itEPSS 0.27%Jun 25, 2025
- Medium4.5Vault Community and Vault Enterprise Key/Value (kv) Version 2 plugin may unintentionally expose sensitive information in server and audit logs when users submit malformed payloadsCheck if you run itEPSS 0.46%May 2, 2025
Sort
16 records