Login Request a demo
SE
Product
server
by bitwarden · last CVE Aug 10, 2026
10
CVEs
0
On KEV
9.1
Max CVSS
0
New 30D
Vulnerabilities10In the news2Timeline
Severity mix
Critical 1High 5Medium 4Low 0
Severity
All severities10Critical1High5Medium4Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add server to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-43639
9.1
1%
May 11
Bitwarden Server < 2026.4.0 Missing Authorization via Provider Clients
Affected: before 2026.4.0
CVE-2026-43640
8.1
1%
May 11
Bitwarden Server < 2026.4.1 Authentication Bypass via SCIM API Key
Affected: before 2026.4.1
CVE-2026-60104
8.0
0%
Jul 8
Bitwarden Server < 2026.6.0 Authorization Bypass via Admin Auth Request
Affected: before 2026.6.0
CVE-2020-15879
7.5
3%
Jul 21
Bitwarden Server 1.35.1 allows SSRF because it does not consider certain IPv6 addresses (ones beginning with fc, fd, fe, or ff, and the :: address) and certain IPv4 addresses…
Affected: 1.35.1
CVE-2019-19766
7.5
1%
Dec 12
The Bitwarden server through 1.32.0 has a potentially unwanted KDF
Affected: through 1.32.0
CVE-2026-57520
7.1
1%
Jun 25
Bitwarden Server < 2026.5.0 Privilege Escalation via Bulk User Remove Endpoint
Affected: before 2026.5.0
CVE-2026-71959
5.8
0%
Aug 10
Bitwarden Server < 2026.7.2 Audit Log Injection via POST /collect
Affected: before 2026.7.2
CVE-2026-43638
5.4
0%
May 11
Bitwarden Server < 2026.4.1 Missing Authorization via Organization Cipher Import
Affected: before 2026.4.1
CVE-2026-57522
5.0
0%
Jun 25
Bitwarden Server < 2026.5.0 JSON Injection via Webhook Templates
Affected: before 2026.5.0
CVE-2026-57521
4.3
0%
Jun 25
Bitwarden Server < 2026.5.0 Broken Access Control via PreviewInvoiceController
Affected: before 2026.5.0
Showing 10