VA
Product
Vault
78
CVEs
0
On KEV
9.8
Max CVSS
3
New 30D
Severity mix
Critical 7High 31Medium 37Low 3
Watch
Add Vault to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-2048 | 9.8 | Mar 4 | Vault Cert Auth Method Did Not Correctly Validate Non-CA Certificates Affected: 1.15.5 before 1.16.0 |
| CVE-2020-35192 | 9.8 | Dec 17 | The official vault docker images before 0.11.6 contain a blank password for a root user Affected: 0.6.0 before 0.11.6 |
| CVE-2020-12757 | 9.8 | Jun 10 | HashiCorp Vault and Vault Enterprise 1.4.0 and 1.4.1, when configured with the GCP Secrets Engine, may incorrectly generate GCP Credentials with the default time-to-live lease… Affected: 1.4.0 before 1.4.2; 1.4.0 before 1.4.2 |
| CVE-2025-6000 | 9.1 | Aug 1 | Arbitrary Remote Code Execution via Plugin Catalog Abuse Affected: 0.8.0 before 1.20.1 |
| CVE-2022-40186 | 9.1 | Sep 22 | An issue was discovered in HashiCorp Vault and Vault Enterprise before 1.11.3 Affected: 1.8.0 before 1.9.9; 1.8.0 before 1.9.9; 1.10.0 before 1.10.6; 1.10.0 before 1.10.6; 1.11.0 before 1.11.3; 1.11.0 before 1.11.3 |
| CVE-2022-36129 | 9.1 | Jul 26 | HashiCorp Vault Enterprise 1.7.0 through 1.9.7, 1.10.4, and 1.11.0 clusters using Integrated Storage expose an unauthenticated API endpoint that could be abused to override the… Affected: 1.7.0 through 1.9.7; 1.10.0 through 1.10.4; 1.11.0; 1.11.0 |
| CVE-2020-10661 | 9.1 | Mar 23 | HashiCorp Vault and Vault Enterprise versions 0.11.0 through 1.3.3 may, under certain circumstances, have existing nested-path policies grant access to Namespaces created… Affected: 0.11.0 through 1.3.3; 0.11.0 through 1.3.3 |
Showing 7