DA
Vendor
dani-garcia
26
CVEs
0
On KEV
1
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-116678 New | VA vaultwarden dani-garcia | 5.8 | Oct 27 | Vaultwarden: Icon endpoint SSRF fix bypass via second-stage favicon IP literal URLs |
| CVE-2026-95814 | VA vaultwarden dani-garcia | 8.1 | Sep 22 | Vaultwarden through 1.37.3 Authorization Bypass via Missing Status Check |
| CVE-2026-47160 | VA vaultwarden dani-garcia | 5.8 | Jul 15 | Vaultwarden: Server-side request forgery (SSRF) via Icon Endpoint Decimal/Hex/Octal IP Bypass |
| CVE-2026-47164 | VA vaultwarden dani-garcia | 7.7 | Jul 15 | Vaultwarden: SSO Email Auto-Link Can Bind an Existing Local Account to an Attacker-Controlled IdP Identity |
| CVE-2026-47159 | VA vaultwarden dani-garcia | 6.9 | Jul 15 | Vaultwarden: Authentication Flow Information Disclosure in SSO Discovery Allows Organization Enumeration and Pre-Validation Token Exposure |
| CVE-2026-47158 | VA vaultwarden dani-garcia | 8.3 | Jul 15 | Vaultwarden: CSRF in SSO Authorization Flow |
| CVE-2026-43914 | VA vaultwarden dani-garcia | 9.8 | May 11 | Vaultwarden: Brute-force protection bypass vulnerability |
| CVE-2026-43913 | VA vaultwarden dani-garcia | 8.1 | May 11 | Vaultwarden: Unconfirmed Owner Can Purge Entire Organization Vault |
| CVE-2026-43912 | VA vaultwarden dani-garcia | 8.7 | May 11 | Vaultwarden: Cross-Org Group Binding Enables Unauthorized Read And Write Access Into Another Organization |
| CVE-2026-43911 | VA vaultwarden dani-garcia | 8.1 | May 11 | Vaultwarden: Refresh tokens not invalidated on security stamp rotation |
| CVE-2026-33420 | VA vaultwarden dani-garcia | 5.3 | May 5 | Vaultwarden missing authorization check allows Manager-role users to enumerate all collections |
| CVE-2026-31835 | VA vaultwarden dani-garcia | 5.4 | May 5 | Vaultwarden WebAuthn credential metadata tampered before signature verification |
| CVE-2026-27898 | VA vaultwarden dani-garcia | 5.4 | Mar 4 | Vaultwarden: Unauthorized Access via Partial Update API on Another User’s Cipher |
| CVE-2026-27803 | VA vaultwarden dani-garcia | 8.3 | Mar 4 | Vaultwarden: Collection Management Operations Allowed Without `manage` Verification for Manager Role |
| CVE-2026-27802 | VA vaultwarden dani-garcia | 8.3 | Mar 4 | Vaultwarden: Privilege Escalation via Bulk Permission Update to Unauthorized Collections by Manager |
| CVE-2026-27801 | VA vaultwarden dani-garcia | 5.9 | Mar 4 | Vaultwarden: 2FA Bypass on Protected Actions due to Faulty Rate Limit Enforcement |
| CVE-2026-26012 | VA vaultwarden dani-garcia | 6.5 | Feb 11 | vaultwarden has Full Cipher Enumeration Ignoring Organization Collection Permissions |
| CVE-2025-24365 | VA Vaultwarden Dani-garcia | 7.5 | Jan 27 | vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs |
| CVE-2025-24364 | VA Vaultwarden Dani-garcia | 7.2 | Jan 27 | vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs |
| CVE-2024-55225 | VA Vaultwarden Dani-garcia | 9.8 | Jan 9 | An issue in the component src/api/identity.rs of Vaultwarden prior to v1.32.5 allows attackers to impersonate users, including Administrators, via a crafted authorization request |
| CVE-2024-55226 | VA Vaultwarden Dani-garcia | 5.4 | Jan 9 | Vaultwarden v1.32.5 was discovered to contain an authenticated reflected cross-site scripting (XSS) vulnerability via the component /api/core/mod.rs |
| CVE-2024-55224 | VA Vaultwarden Dani-garcia | 9.6 | Jan 9 | An HTML injection vulnerability in Vaultwarden prior to v1.32.5 allows attackers to execute arbitrary code via injecting a crafted payload into the username field of an e-mail… |
| CVE-2024-56335 | VA vaultwarden dani-garcia | 7.5 | Dec 20 | Privilege escalation allows organization groups to be updated/deleted if their UUID is known in vaultwarden |
| CVE-2024-39926 | VA Vaultwarden Dani-garcia | 5.4 | Sep 13 | An issue was discovered in Vaultwarden (formerly Bitwarden_RS) 1.30.3 |
| CVE-2024-39925 | VA Vaultwarden Dani-garcia | 6.5 | Sep 13 | An issue was discovered in Vaultwarden (formerly Bitwarden_RS) 1.30.3 |
| CVE-2024-39924 | VA Vaultwarden Dani-garcia | 8.8 | Sep 13 | An issue was discovered in Vaultwarden (formerly Bitwarden_RS) 1.30.3 |