Priority HIGH 81
Vaultwarden is a Bitwarden-compatible server written in Rust.
dani-garcia
Records26All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical3CVSS 9.0–10.0
CVSS high12CVSS 7.0–8.9
Exploited now
dani-garcia records in CISA KEVNo dani-garcia vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
26 records
TI-2026-31975 CVE-2026-43912
Vaultwarden: Cross-Org Group Binding Enables Unauthorized Read And Write Access Into Another Organization
Priority HIGH 73
Vaultwarden is a Bitwarden-compatible server written in Rust.
Priority HIGH 70
Vaultwarden is a Bitwarden-compatible server written in Rust.
Priority HIGH 70
Vaultwarden is a Bitwarden-compatible server written in Rust.
TI-2025-18108 CVE-2025-24365
vaultwarden allows escalation of privilege via variable confusion in OrgHeaders trait
Priority HIGH 70
vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs.
TI-2025-18107 CVE-2025-24364
vaultwarden allows RCE in the admin panel
Priority HIGH 67
vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs.
Priority HIGH 65
Vaultwarden is a Bitwarden-compatible server written in Rust.
TI-2026-22155 CVE-2026-27801 · GHSA-v6pg-v89r-w8wr
Vaultwarden: 2FA Bypass on Protected Actions due to Faulty Rate Limit Enforcement
Priority MEDIUM 60
Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs.
TI-2026-34750 CVE-2026-47160
Vaultwarden: Server-side request forgery (SSRF) via Icon Endpoint Decimal/Hex/Octal IP Bypass
Priority MEDIUM 59
Vaultwarden is a Bitwarden-compatible server written in Rust.
TI-2026-24388 CVE-2026-31835
Vaultwarden WebAuthn credential metadata tampered before signature verification
Priority MEDIUM 57
Vaultwarden is a Bitwarden-compatible server written in Rust.
TI-2024-26817 CVE-2024-39924 · GHSA-974p-hhmc-6h46
An issue was discovered in Vaultwarden (formerly Bitwarden_RS) 1.30.3.
Priority MEDIUM 53
An issue was discovered in Vaultwarden (formerly Bitwarden_RS) 1.30.3.
TI-2024-36803 CVE-2024-55225 · GHSA-x7m9-mv49-fv73
An issue in the component src/api/identity.rs of Vaultwarden prior to v1.32.5 allows…
Priority MEDIUM 50
An issue in the component src/api/identity.rs of Vaultwarden prior to v1.32.5 allows attackers to impersonate users, including Administrators, via a crafted authorization request.
TI-2024-36802 CVE-2024-55224 · GHSA-g5x8-v2ch-gj2g
An HTML injection vulnerability in Vaultwarden prior to v1.32.5 allows attackers to…
Priority MEDIUM 44
An HTML injection vulnerability in Vaultwarden prior to v1.32.5 allows attackers to execute arbitrary code via injecting a crafted payload into the username field of an e-mail message.
TI-2026-63694 CVE-2026-95814 · GHSA-hm7r-36jx-j25q
Vaultwarden through 1.37.3 Authorization Bypass via Missing Status Check
Priority MEDIUM 40
Vaultwarden through 1.37.3 omits organization membership status validation from three cipher access-restriction queries, allowing revoked and not-yet-confirmed members to retain read, write, delete, and attachment access…
TI-2026-22157 CVE-2026-27803 · GHSA-h4hq-rgvh-wh27
Vaultwarden: Collection Management Operations Allowed Without `manage` Verification for Manager Role
Priority LOW 38
Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs.
TI-2026-22156 CVE-2026-27802 · GHSA-r32r-j5jq-3w4m
Vaultwarden: Privilege Escalation via Bulk Permission Update to Unauthorized Collections by Manager
Priority LOW 38
Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs.
TI-2026-34754 CVE-2026-47164
Vaultwarden: SSO Email Auto-Link Can Bind an Existing Local Account to an Attacker-Controlled IdP Identity
Priority LOW 36
Vaultwarden is a Bitwarden-compatible server written in Rust.
TI-2026-34748 CVE-2026-47158
Vaultwarden: CSRF in SSO Authorization Flow
Priority LOW 36
Vaultwarden is a Bitwarden-compatible server written in Rust.
TI-2024-26818 CVE-2024-39925 · GHSA-r89w-9fr4-c7c9
An issue was discovered in Vaultwarden (formerly Bitwarden_RS) 1.30.3.
Priority LOW 36
An issue was discovered in Vaultwarden (formerly Bitwarden_RS) 1.30.3.
Priority LOW 35
Vaultwarden is a Bitwarden-compatible server written in Rust.
TI-2024-37296 CVE-2024-56335
Privilege escalation allows organization groups to be updated/deleted if their UUID is known in vaultwarden
Priority LOW 33
vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs.
TI-2024-26819 CVE-2024-39926 · GHSA-vfwm-h968-g65h
An issue was discovered in Vaultwarden (formerly Bitwarden_RS) 1.30.3.
Priority LOW 31
An issue was discovered in Vaultwarden (formerly Bitwarden_RS) 1.30.3.
TI-2026-21026 CVE-2026-26012
vaultwarden has Full Cipher Enumeration Ignoring Organization Collection Permissions
Priority LOW 29
vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs.
TI-2024-36804 CVE-2024-55226 · GHSA-vprm-27pv-jp3w
Vaultwarden v1.32.5 was discovered to contain an authenticated reflected cross-site…
Priority LOW 25
Vaultwarden v1.32.5 was discovered to contain an authenticated reflected cross-site scripting (XSS) vulnerability via the component /api/core/mod.rs.
TI-2026-22242 CVE-2026-27898 · GHSA-w9f8-m526-h7fh
Vaultwarden: Unauthorized Access via Partial Update API on Another User’s Cipher
Priority LOW 24
Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs.