https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T02:27:20.768114+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2024-08718 bdu:2024-08718 2026-10-03T02:27:20.772420+00:00 bdu:2024-08718 https://cve.radiocsirt.org/vuln/bit-vault-2023-4680 BIT-vault-2023-4680 — Vault's Transit Secrets Engine Allowed Nonce Specified without Convergent Encryption 2026-10-03T02:27:20.772451+00:00

Affected: Bitnami: vault

HashiCorp Vault and Vault Enterprise transit secrets engine allowed authorized users to specify arbitrary nonces, even with convergent encryption disabled. The encrypt endpoint, in combination with an offline attack, could be used to decrypt arbitrary ciphertext and potentially derive the authentication subkey when using transit secrets engine without convergent encryption. Introduced in 1.6.0 and fixed in 1.14.3, 1.13.7, and 1.12.11.

 https://cve.radiocsirt.org/vuln/euvd-2026-188934 EUVD-2026-188934 2026-10-03T02:27:20.772484+00:00 EUVD-2026-188934 https://cve.radiocsirt.org/vuln/fkie_cve-2023-4680 fkie_cve-2023-4680 2026-10-03T02:27:20.772497+00:00

HashiCorp Vault and Vault Enterprise transit secrets engine allowed authorized users to specify arbitrary nonces, even with convergent encryption disabled. The encrypt endpoint, in combination with an offline attack, could be used to decrypt arbitrary ciphertext and potentially derive the authentication subkey when using transit secrets engine without convergent encryption. Introduced in 1.6.0 and fixed in 1.14.3, 1.13.7, and 1.12.11.

 https://cve.radiocsirt.org/vuln/ghsa-v84f-6r39-cpfc GHSA-v84f-6r39-cpfc — HashiCorp Vault Improper Input Validation vulnerability 2026-10-03T02:27:20.772519+00:00

Affected: Go: github.com/hashicorp/vault

HashiCorp Vault and Vault Enterprise transit secrets engine allowed authorized users to specify arbitrary nonces, even with convergent encryption disabled. The encrypt endpoint, in combination with an offline attack, could be used to decrypt arbitrary ciphertext and potentially derive the authentication subkey when using transit secrets engine without convergent encryption. Introduced in 1.6.0 and fixed in 1.14.3, 1.13.7, and 1.12.11.

 https://cve.radiocsirt.org/vuln/gsd-2023-4680 gsd-2023-4680 2026-10-03T02:27:20.772541+00:00 gsd-2023-4680 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-2361 WID-SEC-W-2023-2361 — Hashicorp Vault: Schwachstelle ermöglicht Umgehung von Sicherheitsmaßnahmen oder Offenlegung vertraulicher Informationen 2026-10-03T02:27:20.772552+00:00

Ein entfernter authentifizierter Angreifer kann eine Schwachstelle in Hashicorp Vault ausnutzen, um Sicherheitsmaßnahmen zu umgehen oder vertrauliche Informationen offenzulegen.