MAL-2025-16693 Malicious code in cdd-vault (npm)

The package cdd-vault was found to contain malicious code...

MAL-2025-22082 Malicious code in h1-cli-ext-storage-vault (npm)

The package h1-cli-ext-storage-vault was found to contain malicious code...

Malicious code in cdd-vault (npm)

The package cdd-vault was found to contain malicious code...

Malicious code in h1-cli-ext-storage-vault (npm)

The package h1-cli-ext-storage-vault was found to contain malicious code...

SUSE CVE-2025-5999

A privileged Vault operator with write permissions to the root namespace's identity endpoint could escalate their own or another user's token privileges to Vault's root policy. Fixed in Vault Community Edition 1.20.0 and Vault Enterprise 1.20.0, 1.19.6, 1.18.11 and 1.16.22...

GO-2025-3841 Hashicorp Vault's TOTP Secrets Engine Susceptible to Code Reuse in github.com/hashicorp/vault

Hashicorp Vault's TOTP Secrets Engine Susceptible to Code Reuse in github.com/hashicorp/vault...

GO-2025-3837 Hashicorp Vault has Privilege Escalation Vulnerability in github.com/hashicorp/vault

Hashicorp Vault has Privilege Escalation Vulnerability in github.com/hashicorp/vault...

GO-2025-3848 HashiCorp Vault ldap auth method may not have correctly enforced MFA in github.com/hashicorp/vault

HashiCorp Vault ldap auth method may not have correctly enforced MFA in github.com/hashicorp/vault...

GO-2025-3842 Hashicorp Vault has Login MFA Rate Limit Bypass Vulnerability in github.com/hashicorp/vault

Hashicorp Vault has Login MFA Rate Limit Bypass Vulnerability in github.com/hashicorp/vault...

GO-2025-3838 Hashicorp Vault has Code Execution Vulnerability via Plugin Configuration in github.com/hashicorp/vault

Hashicorp Vault has Code Execution Vulnerability via Plugin Configuration in github.com/hashicorp/vault...

GO-2025-3836 Hashicorp Vault has Incorrect Validation for Non-CA Certificates in github.com/hashicorp/vault

Hashicorp Vault has Incorrect Validation for Non-CA Certificates in github.com/hashicorp/vault...

GO-2025-3840 Hashicorp Vault has Lockout Feature Authentication Bypass in github.com/hashicorp/vault

Hashicorp Vault has Lockout Feature Authentication Bypass in github.com/hashicorp/vault...

GO-2025-3839 Hashicorp Vault has an Observable Discrepancy on Existing and Non-Existing Users in github.com/hashicorp/vault

Hashicorp Vault has an Observable Discrepancy on Existing and Non-Existing Users in github.com/hashicorp/vault...

The vulnerability of the LDAP protocol implementation in HashiCorp’s Vault and Vault Enterprise archiving platforms allows attackers to circumvent security restrictions and gain unauthorized access to protected information.

The vulnerability of the LDAP protocol implementation in HashiCorp Vault and Vault Enterprise, a platform for archiving corporate information, is related to the improper handling of gaps when processing the usernameasalias parameter. Exploiting this vulnerability can allow an attacker to bypass...

GHSA-J5PM-7495-QMR3 vulnerabilities

Vulnerabilities for packages: fluent-bit-plugin-loki, etcd, skaffold-fips, cluster-proportional-autoscaler, rke2-cloud-provider-fips, k9s-fips, aws-nuke, dex, hugo-extended, falco-exporter-fips, k9s, nemo, kubernetes-release, ksops, knative-operator, nri-mysql, kyverno-policy-reporter, gosu-fips,...

CyberArk and HashiCorp Flaws Enable Remote Vault Takeover Without Credentials

Cybersecurity researchers have discovered over a dozen vulnerabilities in enterprise secure vaults from CyberArk and HashiCorp that, if successfully exploited, can allow remote attackers to crack open corporate identity systems and extract enterprise secrets and tokens from them. The 14...

Brute Force

Overview Affected versions of this package are vulnerable to Brute Force due to validating the provided TOTP code during login MFA. An attacker can gain unauthorized access to sensitive data by bypassing internal rate limiting and reusing existing TOTP codes by including whitespace in the TOTP...

Improper Neutralization

Overview Affected versions of this package are vulnerable to Improper Neutralization via the usernameasalias parameter in the LDAP authentication process. An attacker can gain unauthorized access to resources protected by multi-factor authentication by supplying a crafted username that bypasses...

Improper Privilege Management

Overview Affected versions of this package are vulnerable to Improper Privilege Management due to managing identity entity systems in root namespaces. An attacker can gain unauthorized access to the root policy by escalating privileges through the addition of arbitrary policies containing...

Dell ControlVault3 cv_upgrade_sensor_firmware out-of-bounds write vulnerability

Talos Vulnerability Report TALOS-2025-2137 Dell ControlVault3 cvupgradesensorfirmware out-of-bounds write vulnerability August 9, 2025 CVE Number CVE-2025-25050 SUMMARY An out-of-bounds write vulnerability exists in the cvupgradesensorfirmware functionality of Dell ControlVault3 5.14.3.0. A...