Dani-garcia vulnerabilities

Products

• Vaultwarden 26

Newest

• dani-garcia vaultwarden Vaultwarden: Icon endpoint SSRF fix bypass via second-stage favicon IP literal URLs CVE-2026-116678 5.8 MediumOctober 27, 2026
• dani-garcia vaultwarden Vaultwarden through 1.37.3 Authorization Bypass via Missing Status Check CVE-2026-95814 8.6 HighSeptember 22, 2026
• dani-garcia vaultwarden Vaultwarden: Server-side request forgery (SSRF) via Icon Endpoint Decimal/Hex/Octal IP Bypass CVE-2026-47160 5.8 MediumJuly 15, 2026
• dani-garcia vaultwarden Vaultwarden: SSO Email Auto-Link Can Bind an Existing Local Account to an Attacker-Controlled IdP Identity CVE-2026-47164 7.7 HighJuly 15, 2026
• dani-garcia vaultwarden Vaultwarden: Authentication Flow Information Disclosure in SSO Discovery Allows Organization Enumeration and Pre-Validation Token Exposure CVE-2026-47159 6.9 MediumJuly 15, 2026
• dani-garcia vaultwarden Vaultwarden: CSRF in SSO Authorization Flow CVE-2026-47158 8.3 HighJuly 15, 2026
• dani-garcia vaultwarden Vaultwarden: Brute-force protection bypass vulnerability CVE-2026-43914 Public exploit 7.3 HighMay 11, 2026
• dani-garcia vaultwarden Vaultwarden: Unconfirmed Owner Can Purge Entire Organization Vault CVE-2026-43913 8.1 HighMay 11, 2026
• dani-garcia vaultwarden Vaultwarden: Cross-Org Group Binding Enables Unauthorized Read And Write Access Into Another Organization CVE-2026-43912 8.7 HighMay 11, 2026
• dani-garcia vaultwarden Vaultwarden: Refresh tokens not invalidated on security stamp rotation CVE-2026-43911 6.8 MediumMay 11, 2026
• dani-garcia vaultwarden Vaultwarden missing authorization check allows Manager-role users to enumerate all collections CVE-2026-33420 5.3 MediumMay 5, 2026
• dani-garcia vaultwarden Vaultwarden WebAuthn credential metadata tampered before signature verification CVE-2026-31835 5.3 MediumMay 5, 2026
• dani-garcia vaultwarden Vaultwarden: Unauthorized Access via Partial Update API on Another User’s Cipher CVE-2026-27898 Fix available 5.4 MediumMarch 4, 2026
• dani-garcia vaultwarden Vaultwarden: Collection Management Operations Allowed Without `manage` Verification for Manager Role CVE-2026-27803 Fix available 8.3 HighMarch 4, 2026
• dani-garcia vaultwarden Vaultwarden: Privilege Escalation via Bulk Permission Update to Unauthorized Collections by Manager CVE-2026-27802 Fix available 8.3 HighMarch 4, 2026
• dani-garcia vaultwarden Vaultwarden: 2FA Bypass on Protected Actions due to Faulty Rate Limit Enforcement CVE-2026-27801 Fix available 6.0 MediumMarch 4, 2026
• dani-garcia vaultwarden vaultwarden has Full Cipher Enumeration Ignoring Organization Collection Permissions CVE-2026-26012 Public exploit 6.5 MediumFebruary 11, 2026
• dani-garcia vaultwarden vaultwarden allows escalation of privilege via variable confusion in OrgHeaders trait CVE-2025-24365 8.1 HighJanuary 27, 2025
• dani-garcia vaultwarden vaultwarden allows RCE in the admin panel CVE-2025-24364 7.2 HighJanuary 27, 2025
• dani-garcia vaultwarden Vaultwarden authenticated reflected cross-site scripting (XSS) vulnerability CVE-2024-55226 Fix available 5.4 MediumJanuary 9, 2025
• dani-garcia vaultwarden Vaultwarden vulnerable to user impersonation CVE-2024-55225 Fix available 9.8 CriticalJanuary 9, 2025
• dani-garcia vaultwarden Vaultwarden HTML injection vulnerability CVE-2024-55224 Fix available 9.6 CriticalJanuary 9, 2025
• dani-garcia vaultwarden Privilege escalation allows organization groups to be updated/deleted if their UUID is known in vaultwarden CVE-2024-56335 7.6 HighDecember 20, 2024
• dani-garcia vaultwarden An issue was discovered in Vaultwarden (formerly Bitwarden_RS) 1.30.3. A stored cross-site... CVE-2024-39926 Fix available 5.4 MediumSeptember 13, 2024
• dani-garcia vaultwarden An issue was discovered in Vaultwarden (formerly Bitwarden_RS) 1.30.3. It lacks an offboarding... CVE-2024-39925 Fix available 6.5 MediumSeptember 13, 2024
• dani-garcia vaultwarden An issue was discovered in Vaultwarden (formerly Bitwarden_RS) 1.30.3. A vulnerability has been... CVE-2024-39924 Public exploitFix available EPSS 13.3% 8.8 HighSeptember 13, 2024