Log in Start free

Bitwarden

Products

ProductCVEsExploitedLatest
server9–Oct 30, 2026
Bitwarden CLI1–May 1, 2026
bitwarden server1–Sep 29, 2026

Exploited and recent CVEs

  • CVE-2026-119414 Medium 4.3 Bitwarden Server before 2026.10.1 Authorization Bypass via POST /api/ciphers/create 0.4%
  • CVE-2026-101878 High 7.5 Bitwarden Server 2025.6.0 < 2025.6.0 Authentication Bypass via SSO Identifier Truncation 0.3%
  • CVE-2026-71959 Medium 5.8 Bitwarden Server < 2026.7.2 Audit Log Injection via POST /collect 0.5%
  • CVE-2026-60104 High 8.7 Bitwarden Server < 2026.6.0 Authorization Bypass via Admin Auth Request 0.4%
  • CVE-2026-57522 Low 3.5 Bitwarden Server < 2026.5.0 JSON Injection via Webhook Templates 0.5%
  • CVE-2026-57521 Medium 4.3 Bitwarden Server < 2026.5.0 Broken Access Control via PreviewInvoiceController 0.4%
  • CVE-2026-57520 High 7.1 Bitwarden Server < 2026.5.0 Privilege Escalation via Bulk User Remove Endpoint 0.6%
  • CVE-2026-43640 High 8.1 Bitwarden Server < 2026.4.1 Authentication Bypass via SCIM API Key 0.5%
  • CVE-2026-43639 High 8.0 Bitwarden Server < 2026.4.0 Missing Authorization via Provider Clients 0.6%
  • CVE-2026-43638 Medium 5.4 Bitwarden Server < 2026.4.1 Missing Authorization via Organization Cipher Import 0.2%
  • CVE-2026-42994 High 8.8 Bitwarden CLI 2026.4.0 from 2026-04-22T21:57Z to 2026-04-22T23:30Z, when obtained from npm, had embedded malicious code. This is related to a Checkmarx supply chain incident. 0.3%