Name: Vietnam CyStack Joint Stock Company
Address: Tan Hong Ha Complex, 317 Truong Chinh Street, Hanoi, Vietnam, 100000, VN
Telephone: (+84) 247 109 9656
Price range: Negotiable

Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

VulnScan

Vault Security Vulnerabilities | CyStack CVE Database

Vulnerability	Exploitation status	Fix	Published	Severity

`CVE-2026-5006`Vault Vulnerable to Privilege Escalation via Slash Injection in Templated Policy Paths	Exploitation statusNot known exploited	FixYes	Published08/24/2026	SeverityMedium
`CVE-2026-12624`Vault vulnerable to LIST authorization bypass via trailing-slash strip	Exploitation statusNot known exploited	FixYes	Published08/10/2026	SeverityMedium
`CVE-2026-5051`Audit Log Plugin Directory Guard Bypass via Legacy path Option	Exploitation statusNot known exploited	FixYes	Published07/01/2026	SeverityMedium
`CVE-2026-5807`Vault Vulnerable to Denial-of-Service via Unauthenticated Root Token Generation/Rekey Operations	Exploitation statusNot known exploited	FixYes	Published04/17/2026	SeverityHigh
`CVE-2026-4525`Vault Token Leaked to Backends via Authorization: Bearer Passthrough Header	Exploitation statusNot known exploited	FixYes	Published04/17/2026	SeverityHigh
`CVE-2026-5052`Vault Vulnerable to Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNS	Exploitation statusNot known exploited	FixYes	Published04/17/2026	SeverityMedium
`CVE-2026-3605`Vault KVv2 Metadata and Secret Deletion Policy Bypass Denial-of-Service	Exploitation statusNot known exploited	FixYes	Published04/17/2026	SeverityHigh
`CVE-2025-12044`Vault Vulnerable to Denial of Service Due to Rate Limit Regression	Exploitation statusNot known exploited	FixYes	Published10/23/2025	SeverityHigh
`CVE-2025-11621`Vault AWS auth method bypass due to AWS client cache	Exploitation statusNot known exploited	FixYes	Published10/23/2025	SeverityHigh
`CVE-2025-6203`Vault unauthenticated denial of service through complex json payload	Exploitation statusNot known exploited	FixYes	Published08/28/2025	SeverityHigh
`CVE-2025-6013`Vault LDAP MFA Enforcement Bypass When Using Username As Alias	Exploitation statusNot known exploited	FixYes	Published08/06/2025	SeverityMedium
`CVE-2025-6015`Vault Login MFA Bypass of Rate Limiting and TOTP Code Reuse	Exploitation statusNot known exploited	FixYes	Published08/01/2025	SeverityMedium
`CVE-2025-6011`Timing Side-Channel in Vault’s Userpass Auth Method	Exploitation statusNot known exploited	FixYes	Published08/01/2025	SeverityLow
`CVE-2025-6004`Vault Userpass and LDAP User Lockout Bypass	Exploitation statusNot known exploited	FixYes	Published08/01/2025	SeverityMedium
`CVE-2025-6037`Vault Certificate Auth Method Did Not Validate Common Name For Non-CA Certificates	Exploitation statusNot known exploited	FixYes	Published08/01/2025	SeverityMedium
`CVE-2025-6014`Vault TOTP Secrets Engine Code Reuse	Exploitation statusNot known exploited	FixYes	Published08/01/2025	SeverityMedium
`CVE-2025-6000`Arbitrary Remote Code Execution via Plugin Catalog Abuse	Exploitation statusNot known exploited	FixYes	Published08/01/2025	SeverityCritical
`CVE-2025-5999`Vault Root Namespace Operator May Elevate Token Privileges	Exploitation statusNot known exploited	FixYes	Published08/01/2025	SeverityHigh
`CVE-2025-4656`Vault Vulnerable to Recovery Key Cancellation Denial of Service	Exploitation statusNot known exploited	FixYes	Published06/25/2025	SeverityLow
`CVE-2025-3879`Vault’s Azure Authentication Method bound_location Restriction Could be Bypassed on Login	Exploitation statusNot known exploited	FixYes	Published05/02/2025	SeverityMedium
`CVE-2025-4166`Vault May Include Sensitive Data in Error Logs When Using the KV v2 Plugin	Exploitation statusNot known exploited	FixYes	Published05/02/2025	SeverityMedium
`CVE-2024-8185`Vault Vulnerable to Denial of Service When Processing Raft Join Requests	Exploitation statusNot known exploited	FixYes	Published10/31/2024	SeverityHigh
`CVE-2024-9180`Vault Operators in Root Namespace May Elevate Their Privileges	Exploitation statusNot known exploited	FixYes	Published10/10/2024	SeverityHigh
`CVE-2024-7594`Vault SSH Secrets Engine Configuration Did Not Restrict Valid Principals By Default	Exploitation statusNot known exploited	FixYes	Published09/26/2024	SeverityHigh
`CVE-2024-8365`Vault Leaks AppRole Client Tokens And Accessor in Audit Log	Exploitation statusNot known exploited	FixYes	Published09/02/2024	SeverityMedium
`CVE-2024-6468`Vault Vulnerable to Denial of Service When Setting a Proxy Protocol Behavior	Exploitation statusNot known exploited	FixYes	Published07/11/2024	SeverityHigh
`CVE-2024-5798`Vault Incorrectly Validated JSON Web Tokens (JWT) Audience Claims	Exploitation statusNot known exploited	FixYes	Published06/12/2024	SeverityLow
`CVE-2024-2877`Vault Enterprise Leaks Sensitive HTTP Request Headers in the Audit Log When Deployed With a Performance Standby Node	Exploitation statusNot known exploited	FixYes	Published04/30/2024	SeverityMedium
`CVE-2024-2660`Vault TLS Cert Auth Method Did Not Correctly Validate OCSP Responses	Exploitation statusNot known exploited	FixYes	Published04/04/2024	SeverityMedium
`CVE-2024-2048`Vault Cert Auth Method Did Not Correctly Validate Non-CA Certificates	Exploitation statusPublic exploit	FixYes	Published03/04/2024	SeverityHigh
`CVE-2024-0831`Vault May Expose Sensitive Information When Configuring An Audit Log Device	Exploitation statusNot known exploited	FixYes	Published02/01/2024	SeverityMedium
`CVE-2023-6337`Vault May be Vulnerable to a Denial of Service Through Memory Exhaustion When Handling Large HTTP Requests	Exploitation statusNot confirmed	FixYes	Published12/08/2023	SeverityHigh
`CVE-2023-5954`Vault Requests Triggering Policy Checks May Lead To Unbounded Memory Consumption	Exploitation statusNot confirmed	FixYes	Published11/09/2023	SeverityMedium
`CVE-2023-5077`Vault's Google Cloud Secrets Engine Removed Existing IAM Conditions When Creating / Updating Rolesets	Exploitation statusNot known exploited	FixYes	Published09/28/2023	SeverityHigh
`CVE-2023-3775`Vault Enterprise's Sentinel RGP Policies Allowed For Cross-Namespace Denial of Service	Exploitation statusNot known exploited	FixYes	Published09/28/2023	SeverityMedium
`CVE-2023-4680`Vault's Transit Secrets Engine Allowed Nonce Specified without Convergent Encryption	Exploitation statusNot known exploited	FixYes	Published09/14/2023	SeverityMedium
`CVE-2023-3462`Vault's LDAP Auth Method Allows for User Enumeration	Exploitation statusNot known exploited	FixYes	Published07/31/2023	SeverityMedium
`CVE-2023-3774`Vault Enterprise Namespace Creation May Lead to Denial of Service	Exploitation statusNot known exploited	FixYes	Published07/28/2023	SeverityMedium
`CVE-2023-2121`Vault’s KV Diff Viewer Allowed for HTML Injection	Exploitation statusNot known exploited	FixYes	Published06/09/2023	SeverityMedium
`CVE-2023-2197`Vault Enterprise Vulnerable to Padding Oracle Attacks When Using a CBC-based Encryption Mechanism with a HSM	Exploitation statusNot known exploited	FixYes	Published05/01/2023	SeverityLow
`CVE-2023-0620`Vault Vulnerable to SQL Injection When Configuring the Microsoft SQL Database Storage Backend	Exploitation statusNot known exploited	FixYes	Published03/30/2023	SeverityMedium
`CVE-2023-0665`Vault PKI Issuer Endpoint Did Not Correctly Authorize Access to Issuer Metadata	Exploitation statusNot known exploited	FixYes	Published03/30/2023	SeverityMedium
`CVE-2023-25000`Vault Vulnerable to Cache-Timing Attacks During Seal and Unseal Operations	Exploitation statusNot known exploited	FixYes	Published03/30/2023	SeverityMedium
`CVE-2023-24999`Vault Fails to Verify if the AppRole SecretID Belongs to Role During a Destroy Operation	Exploitation statusNot known exploited	FixYes	Published03/10/2023	SeverityMedium
`CVE-2022-41316`	Exploitation statusNot known exploited	FixYes	Published10/12/2022	SeverityMedium
`CVE-2022-40186`	Exploitation statusNot known exploited	FixNot confirmed	Published09/22/2022	SeverityCritical
`CVE-2022-36129`	Exploitation statusNot confirmed	FixYes	Published07/26/2022	SeverityUnknown
`CVE-2022-30689`	Exploitation statusNot confirmed	FixYes	Published05/17/2022	SeverityUnknown
`CVE-2022-25243`	Exploitation statusNot confirmed	FixYes	Published03/07/2022	SeverityUnknown
`CVE-2022-25244`	Exploitation statusNot confirmed	FixYes	Published03/07/2022	SeverityUnknown
`CVE-2021-45042`	Exploitation statusNot confirmed	FixNot confirmed	Published12/17/2021	SeverityUnknown
`CVE-2021-43998`	Exploitation statusNot confirmed	FixYes	Published11/30/2021	SeverityUnknown
`CVE-2021-42135`	Exploitation statusNot confirmed	FixNot confirmed	Published10/11/2021	SeverityUnknown
`CVE-2021-41802`	Exploitation statusNot confirmed	FixYes	Published10/08/2021	SeverityLow
`CVE-2021-27668`	Exploitation statusNot confirmed	FixYes	Published08/31/2021	SeverityUnknown
`CVE-2021-38553`	Exploitation statusNot confirmed	FixYes	Published08/13/2021	SeverityUnknown
`CVE-2021-38554`	Exploitation statusNot confirmed	FixYes	Published08/13/2021	SeverityUnknown
`CVE-2021-32923`	Exploitation statusNot confirmed	FixYes	Published06/03/2021	SeverityUnknown
`CVE-2021-27400`	Exploitation statusNot confirmed	FixYes	Published04/22/2021	SeverityUnknown
`CVE-2021-29653`	Exploitation statusNot confirmed	FixYes	Published04/22/2021	SeverityUnknown
`CVE-2021-3024`	Exploitation statusNot confirmed	FixYes	Published02/01/2021	SeverityUnknown
`CVE-2020-25594`	Exploitation statusNot confirmed	FixYes	Published02/01/2021	SeverityUnknown
`CVE-2021-3282`	Exploitation statusNot confirmed	FixYes	Published02/01/2021	SeverityUnknown
`CVE-2020-35453`	Exploitation statusNot confirmed	FixYes	Published12/17/2020	SeverityUnknown
`CVE-2020-35177`	Exploitation statusNot confirmed	FixYes	Published12/17/2020	SeverityUnknown
`CVE-2020-35192`	Exploitation statusNot confirmed	FixNot confirmed	Published12/17/2020	SeverityUnknown
`CVE-2020-25816`	Exploitation statusNot confirmed	FixYes	Published09/30/2020	SeverityUnknown
`CVE-2020-16251`	Exploitation statusNot confirmed	FixYes	Published08/26/2020	SeverityUnknown
`CVE-2020-16250`	Exploitation statusNot confirmed	FixYes	Published08/26/2020	SeverityUnknown
`CVE-2020-12757`	Exploitation statusNot confirmed	FixYes	Published06/10/2020	SeverityUnknown
`CVE-2020-13223`	Exploitation statusNot confirmed	FixYes	Published06/10/2020	SeverityUnknown
`CVE-2020-10661`	Exploitation statusNot confirmed	FixYes	Published03/23/2020	SeverityUnknown
`CVE-2020-10660`	Exploitation statusNot confirmed	FixYes	Published03/23/2020	SeverityUnknown
`CVE-2020-7220`	Exploitation statusNot confirmed	FixYes	Published01/23/2020	SeverityUnknown
`CVE-2018-19786`	Exploitation statusNot confirmed	FixNot confirmed	Published12/05/2018	SeverityUnknown

75 / 75 Results

All vulnerabilities loaded

Security vulnerabilities in Vault

Vault

How many security vulnerabilities does Vault currently have?

Does the latest version of Vault have any known vulnerabilities?

Filters

Run an in-depth assessment with complete web risk management