CVE-2025-41402: Client-Side Enforcement of Server-Side Security

Client-Side Enforcement of Server-Side Security CWE-602 in the Command Centre Server allows a privileged operator to enter invalid competency data, bypassing expiry checks. This issue affects Command Centre Server: 9.30 prior to vEL9.30.2482 MR2, 9.20 prior to vEL9.20.2819 MR4, 9.10 prior to...

PT-2025-43422

Name of the Vulnerable Software and Affected Versions Command Centre Server versions 9.00 and prior Command Centre Server versions 9.10 through 9.10.3672 Command Centre Server versions 9.20 through 9.20.2819 Command Centre Server versions 9.30 through 9.30.2482 Description A flaw exists in the...

EUVD-2024-3134

Malicious code in bioql PyPI...

SUSE CVE-2025-5999

A privileged Vault operator with write permissions to the root namespace's identity endpoint could escalate their own or another user's token privileges to Vault's root policy. Fixed in Vault Community Edition 1.20.0 and Vault Enterprise 1.20.0, 1.19.6, 1.18.11 and 1.16.22...

GO-2025-3858 Privileged OpenBao Operator May Execute Code on the Underlying Host in github.com/openbao/openbao

Privileged OpenBao Operator May Execute Code on the Underlying Host in github.com/openbao/openbao. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via the audit subsystem when manipulating log prefixes. An attacker can execute unauthorized code and gain network access by bypassing intended restrictions on privileged API operators. Note: This is exploitable...

GHSA-MR4H-QF9J-F665 Hashicorp Vault has Code Execution Vulnerability via Plugin Configuration

A privileged Vault operator within the root namespace with write permission to sys/audit may obtain code execution on the underlying host if a plugin directory is set in Vault’s configuration. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23...

Hashicorp Vault has Code Execution Vulnerability via Plugin Configuration

A privileged Vault operator within the root namespace with write permission to sys/audit may obtain code execution on the underlying host if a plugin directory is set in Vault’s configuration. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23...

CVE-2025-6000 Arbitrary Remote Code Execution via Plugin Catalog Abuse

A privileged Vault operator within the root namespace with write permission to sys/audit may obtain code execution on the underlying host if a plugin directory is set in Vault’s configuration. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23...

Vault Root Namespace Operator May Elevate Token Privileges

Summary A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or another user’s token privileges to Vault’s root policy. This vulnerability, identified as CVE-2025-5999, is fixed in Vault Community Edition 1.20.0 and Vault Enterprise...

CVE-2025-6000: Improper Control of Generation of Code

A privileged Vault operator within the root namespace with write permission to sys/audit may obtain code execution on the underlying host if a plugin directory is set in Vault’s configuration. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23...

Vault Operators in Root Namespace May Elevate Their Privileges

Summary A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or another user’s privileges to Vault’s root policy. This vulnerability, identified as CVE-2024-9180, is fixed in Vault Community Edition 1.18.0 and Vault Enterprise 1.18....

HashiCorp Vault Community Edition and Vault Enterprise have security vulnerabilities

HashiCorp Vault Enterprise and HashiCorp Vault Community Edition are both products of HashiCorp, Inc. of the U.S.A. HashiCorp Vault Enterprise is an enterprise information archiving platform.HashiCorp Vault HashiCorp Vault Enterprise is an enterprise information archiving platform, and HashiCorp...

PT-2024-7690

Name of the Vulnerable Software and Affected Versions HashiCorp Vault versions prior to 1.18.0 HashiCorp Vault Enterprise versions prior to 1.18.0, 1.17.7, 1.16.11, and 1.15.16 Description A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate...

Gallagher Command Centre Server Incorrect Privilege Authentication Vulnerability

Gallagher Command Centre Server is a management system used by Gallagher New Zealand to monitor and manage infrastructure in buildings. a security vulnerability exists in the COM interface of Gallagher Command Center Server, which could be exploited by an attacker to retrieve sensitive informatio...

Manageengine Opmanager v8.8 - SQL Injection Vulnerability

Document Title: =============== Manageengine Opmanager v8.8 - SQL Injection Vulnerability Release Date: ============= 2011-07-19 Vulnerability Laboratory ID VL-ID: ==================================== 200 Product & Service Introduction: =============================== Network performance...