Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the AllowOperation path-matching logic in vault/policy/acl.go. An attacker can perform an unauthorized LIST request on a more specific trailing-wildcard path by sending a request that matches a broader...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the AllowOperation path-matching logic in vault/policy/acl.go. An attacker can perform an unauthorized LIST request on a more specific trailing-wildcard path by sending a request that matches a broader...

BIT-VAULT-2026-12624 Vault vulnerable to LIST authorization bypass via trailing-slash strip

Vault’s ACL policy engine did not consistently enforce a wildcard glob deny rule against LIST requests made with a trailing slash on the denied path. This may allow a token holding a broader allow rule alongside a narrower wildcard deny rule to enumerate the names of entries beneath a path it was...

Security Bulletin: Vault vulnerable to LIST authorization bypass via trailing-slash strip

Summary Vault’s ACL policy engine did not consistently enforce a wildcard glob deny rule against LIST requests made with a trailing slash on the denied path. This may allow a token holding a broader allow rule alongside a narrower wildcard deny rule to enumerate the names of entries beneath a pat...

CVE-2026-12624

Vault’s ACL policy engine did not consistently enforce a wildcard glob deny rule against LIST requests made with a trailing slash on the denied path. This may allow a token holding a broader allow rule alongside a narrower wildcard deny rule to enumerate the names of entries beneath a path it was...

CVE-2026-12624

Vault’s ACL policy engine did not consistently enforce a wildcard glob deny rule against LIST requests made with a trailing slash on the denied path. This may allow a token holding a broader allow rule alongside a narrower wildcard deny rule to enumerate the names of entries beneath a path it was...

EUVD-2026-55677

Vault’s ACL policy engine did not consistently enforce a wildcard glob deny rule against LIST requests made with a trailing slash on the denied path. This may allow a token holding a broader allow rule alongside a narrower wildcard deny rule to enumerate the names of entries beneath a path it was...

CVE-2026-12624 Vault vulnerable to LIST authorization bypass via trailing-slash strip

Vault’s ACL policy engine did not consistently enforce a wildcard glob deny rule against LIST requests made with a trailing slash on the denied path. This may allow a token holding a broader allow rule alongside a narrower wildcard deny rule to enumerate the names of entries beneath a path it was...

Vault vulnerable to LIST authorization bypass via trailing-slash strip

Summary Vault’s ACL policy engine did not consistently enforce a wildcard glob deny rule against LIST requests made with a trailing slash on the denied path. This may allow a token holding a broader allow rule alongside a narrower wildcard deny rule to enumerate the names of entries beneath a pat...

PT-2026-69874

Name of the Vulnerable Software and Affected Versions Vault Community Edition versions prior to 2.0.3 Vault Enterprise versions prior to 2.0.3 Vault Enterprise versions prior to 1.21.8 Vault Enterprise versions prior to 1.20.13 Vault Enterprise versions prior to 1.19.19 Description The ACL policy...

CVE-2026-32743

PX4 is an open-source autopilot stack for drones and unmanned vehicles. Versions 1.17.0-rc2 and below are vulnerable to Stack-based Buffer Overflow through the MavlinkLogHandler, and are triggered via MAVLink log request. The LogEntry.filepath buffer is 60 bytes, but the sscanf function parses...

PT-2025-15398

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A soft lockup issue has been resolved in the Linux kernel. The problem occurs when the driver allocates a large buffer, such as a Memory Region MR over 100GB, which requires a...

PT-2024-20903 · Unknown · Libiec61850

Name of the Vulnerable Software and Affected Versions: libiec61850 versions 1.4.0 Description: The issue allows a remote attacker to cause a denial of service via the mmsServer handleGetNameListRequest function to the mms getnamelist service component. Recommendations: For version 1.4.0, consider...

VulnCheck KEV: CVE-2021-24285

The requestlistrequest AJAX call of the Car Seller - Auto Classifieds Script WordPress plugin through 2.1.0, available to both authenticated and unauthenticated users, does not sanitise, validate or escape the orderid POST parameter before using it in a SQL statement, leading to a SQL Injection...

CVE-2021-21950

An out-of-bounds write vulnerability exists in the CMDDEVICEGETSERVERLISTREQUEST functionality of the homesecurity binary of Anker Eufy Homebase 2 2.1.6.9h in function recvserverdeviceresponsemsgprocess. A specially-crafted network packet can lead to code execution...

CVE-2021-21951

An out-of-bounds write vulnerability exists in the CMDDEVICEGETSERVERLISTREQUEST functionality of the homesecurity binary of Anker Eufy Homebase 2 2.1.6.9h in function readudppushconfigfile. A specially-crafted network packet can lead to code execution...

CVE-2021-21950

An out-of-bounds write vulnerability exists in the CMDDEVICEGETSERVERLISTREQUEST functionality of the homesecurity binary of Anker Eufy Homebase 2 2.1.6.9h in function recvserverdeviceresponsemsgprocess. A specially-crafted network packet can lead to code execution...

CVE-2021-21951

An out-of-bounds write vulnerability exists in the CMDDEVICEGETSERVERLISTREQUEST functionality of the homesecurity binary of Anker Eufy Homebase 2 2.1.6.9h in function readudppushconfigfile. A specially-crafted network packet can lead to code execution...

PT-2021-5412 · Anker · Anker Eufy Homebase 2

Name of the Vulnerable Software and Affected Versions: Anker Eufy Homebase 2 version 2.1.6.9h Description: An out-of-bounds write issue exists in the CMD DEVICE GET SERVER LIST REQUEST functionality of the home security binary, specifically in the recv server device response msg process function...

CVE-2021-24285

The requestlistrequest AJAX call of the Car Seller - Auto Classifieds Script WordPress plugin through 2.1.0, available to both authenticated and unauthenticated users, does not sanitise, validate or escape the orderid POST parameter before using it in a SQL statement, leading to a SQL Injection...