VA
Product
vaultwarden
26
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 3High 12Medium 11Low 0
Watch
Add vaultwarden to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-47159 | 6.9 | Jul 15 | Vaultwarden: Authentication Flow Information Disclosure in SSO Discovery Allows Organization Enumeration and Pre-Validation Token Exposure Affected: < 1.36.0 |
| CVE-2026-26012 | 6.5 | Feb 11 | vaultwarden has Full Cipher Enumeration Ignoring Organization Collection Permissions Affected: < 1.35.3 |
| CVE-2024-39925 | 6.5 | Sep 13 | An issue was discovered in Vaultwarden (formerly Bitwarden_RS) 1.30.3 Affected: 1.30.3 |
| CVE-2026-27801 | 5.9 | Mar 4 | Vaultwarden: 2FA Bypass on Protected Actions due to Faulty Rate Limit Enforcement Affected: < 1.35.0 |
| CVE-2026-116678 New | 5.8 | Oct 27 | Vaultwarden: Icon endpoint SSRF fix bypass via second-stage favicon IP literal URLs Affected: < 1.37.0 |
| CVE-2026-47160 | 5.8 | Jul 15 | Vaultwarden: Server-side request forgery (SSRF) via Icon Endpoint Decimal/Hex/Octal IP Bypass Affected: < 1.36.0 |
| CVE-2026-31835 | 5.4 | May 5 | Vaultwarden WebAuthn credential metadata tampered before signature verification Affected: < 1.35.5 |
| CVE-2026-27898 | 5.4 | Mar 4 | Vaultwarden: Unauthorized Access via Partial Update API on Another User’s Cipher Affected: < 1.35.4 |
| CVE-2024-55226 | 5.4 | Jan 9 | Vaultwarden v1.32.5 was discovered to contain an authenticated reflected cross-site scripting (XSS) vulnerability via the component /api/core/mod.rs Affected: 1.32.5 |
| CVE-2024-39926 | 5.4 | Sep 13 | An issue was discovered in Vaultwarden (formerly Bitwarden_RS) 1.30.3 Affected: 1.30.3 |
| CVE-2026-33420 | 5.3 | May 5 | Vaultwarden missing authorization check allows Manager-role users to enumerate all collections Affected: < 1.35.5 |
Showing 11