Vault and Vault Enterprise did not consistently verify that stored plugin catalog entries reference binaries within the configured plugin directory

Vault and Vault Enterprise did not consistently evaluate ACL policies against the canonical form of resource and policy names

Vault's ACL policy cache allowed namespace traversal when policy names contained path traversal constructs

Vault's PKI secrets engine ACME server did not restrict certificate identities that ACME challenges do not validate when issuing certificates under the default directory policy

A malicious user may submit a specially-crafted complex payload that otherwise meets the default request size limit which results in excessive memory and CPU consumption of Vault

Nagios XI < 2024R1.3.2 contains a remote code execution vulnerability by chaining two flaws: an arbitrary file upload and a path traversal in the Core Config Snapshots interface

The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling that may allow a crafted archive to cause extracted files to be created with elevated permission bit…