CVE-2026-35462

Papra is a minimalistic document management and archiving platform. Prior to 26.4.0, API keys with an expiresAt date are never validated against the current time during authentication. Any API key — regardless of its expiration date — is accepted indefinitely, allowing a user whose key has expire...

Vault Enterprise CompareHashAndPassword Timing Discrepancy

The vulnerability of the CompareHashAndPassword function in the Vault Enterprise and Vault Community Edition archiving platform for corporate information involves information disclosure due to timing mismatches. Exploiting this vulnerability could allow an unauthorized actor to gain unauthorized...

Azure Auth Component Auth Bypass

The vulnerability of Azure Auth component in the Vault Enterprise archiving platform relates to improper authorization. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected information...