BI
Vendor
bitwarden
17
CVEs
0
On KEV
0
New 30D
Products
SE9.1
server
bitwarden
10 CVEs0 on KEV0 new
BI7.5
Bitwarden
Bitwarden
4 CVEs0 on KEV0 new
BC9.8
Bitwarden CLI
Bitwarden
1 CVEs0 on KEV0 new
BS7.5
bitwarden server
bitwarden
1 CVEs0 on KEV0 new
CL9.8
Cli
Bitwarden
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-101878 | BS bitwarden server bitwarden | 7.5 | Sep 29 | Bitwarden Server 2025.6.0 < 2025.6.0 Authentication Bypass via SSO Identifier Truncation |
| CVE-2026-71959 | SE server bitwarden | 5.8 | Aug 10 | Bitwarden Server < 2026.7.2 Audit Log Injection via POST /collect |
| CVE-2026-60104 | SE server bitwarden | 8.0 | Jul 8 | Bitwarden Server < 2026.6.0 Authorization Bypass via Admin Auth Request |
| CVE-2026-57522 | SE server bitwarden | 5.0 | Jun 25 | Bitwarden Server < 2026.5.0 JSON Injection via Webhook Templates |
| CVE-2026-57521 | SE server bitwarden | 4.3 | Jun 25 | Bitwarden Server < 2026.5.0 Broken Access Control via PreviewInvoiceController |
| CVE-2026-57520 | SE server bitwarden | 7.1 | Jun 25 | Bitwarden Server < 2026.5.0 Privilege Escalation via Bulk User Remove Endpoint |
| CVE-2026-43640 | SE server bitwarden | 8.1 | May 11 | Bitwarden Server < 2026.4.1 Authentication Bypass via SCIM API Key |
| CVE-2026-43639 | SE server bitwarden | 9.1 | May 11 | Bitwarden Server < 2026.4.0 Missing Authorization via Provider Clients |
| CVE-2026-43638 | SE server bitwarden | 5.4 | May 11 | Bitwarden Server < 2026.4.1 Missing Authorization via Organization Cipher Import |
| CVE-2026-42994 | BC Bitwarden CLI Bitwarden | 9.8 | May 1 | Bitwarden CLI 2026.4.0 from 2026-04-22T21:57Z to 2026-04-22T23:30Z, when obtained from npm, had embedded malicious code |
| CVE-2023-38840 | BI Bitwarden Bitwarden | 5.5 | Aug 15 | Bitwarden Desktop 2023.7.0 and below allows an attacker with local access to obtain sensitive information via the Bitwarden.exe process |
| CVE-2023-27706 | BI Bitwarden Bitwarden | 7.1 | Jun 9 | Bitwarden Windows desktop application versions prior to v2023.4.0 store biometric keys in Windows Credential Manager, accessible to other local unprivileged processes |
| CVE-2023-27974 | BI Bitwarden Bitwarden | 7.5 | Mar 9 | Bitwarden through 2023.2.1 offers password auto-fill when the second-level domain matches, e.g., a password stored for an example.com hosting provider when… |
| CVE-2018-25081 | BI Bitwarden Bitwarden | 7.5 | Mar 9 | Bitwarden through 2023.2.1 offers password auto-fill within a cross-domain IFRAME element |
| CVE-2020-15879 | SE Server Bitwarden | 7.5 | Jul 21 | Bitwarden Server 1.35.1 allows SSRF because it does not consider certain IPv6 addresses (ones beginning with fc, fd, fe, or ff, and the :: address) and certain IPv4 addresses… |
| CVE-2019-19766 | SE Server Bitwarden | 7.5 | Dec 12 | The Bitwarden server through 1.32.0 has a potentially unwanted KDF |