Question 1

How many vulnerabilities does HashiCorp Vault have?

Accepted Answer

26 advisories in this record are tied by a register to a product of HashiCorp Vault. That is not the same as the number of vulnerabilities the products contain, and no public source knows that number. It is the count of what has been found, disclosed and published, which depends on how much the products are examined and how openly the vendor discloses.

Question 2

Are any HashiCorp Vault vulnerabilities being actively exploited?

Accepted Answer

None of the 26 records here appears in the CISA catalogue of known exploited vulnerabilities. That catalogue is not exhaustive: it lists what CISA has confirmed as exploited, so absence from it is not proof that nothing has been exploited.

Question 3

Why does this page show fewer CVEs for HashiCorp Vault than other sites?

Accepted Answer

Because a keyword search for a company name returns advisories about other companies' products that mention it in passing, and this page excludes those. 28 register entries name HashiCorp Vault without naming one of its products as affected. A mirror that lists them produces a longer page and a wrong number.

Question 4

Where do the HashiCorp Vault advisories on this page come from?

Accepted Answer

From European Vulnerability Database (ENISA, European Union); CERT-Bund security advisories (BSI, Federal Republic of Germany). Every entry links back to the register that published it, and carries the date that register states. Where the same vulnerability is held by several registers it is shown once with a link to each, rather than counted twice.

Question 5

Does a long advisory list mean HashiCorp Vault is insecure?

Accepted Answer

No. A register records what researchers found and what the vendor disclosed, so a widely deployed product with a working disclosure process accumulates more entries than one nobody examines. A short list can equally mean a small install base or a vendor that publishes little. This page reports the record and does not rate the vendor, because whether this is acceptable depends on your risk appetite, your compliance scope and the alternatives you are weighing.

HashiCorp Vault advisories: every record the registers tie to its products

Why this list is shorter than a CVE mirror

The full list, most recently exploited and most recent first

Which registers contributed

Questions this page answers

How many vulnerabilities does HashiCorp Vault have?

Are any HashiCorp Vault vulnerabilities being actively exploited?

Why does this page show fewer CVEs for HashiCorp Vault than other sites?

Where do the HashiCorp Vault advisories on this page come from?

Does a long advisory list mean HashiCorp Vault is insecure?

A list of advisories is not a risk assessment

Register	Operated by	Entries	Latest
European Vulnerability Database	ENISA, European Union	28	Jul 06, 2026
CERT-Bund security advisories	BSI, Federal Republic of Germany	26	Jul 02, 2026