dani-garcia vaultwarden

• CVE-2026-116678 Medium 5.8 Vaultwarden: Icon endpoint SSRF fix bypass via second-stage favicon IP literal URLs 0.3%
• CVE-2026-95814 High 8.1 Vaultwarden through 1.37.3 Authorization Bypass via Missing Status Check 0.4%
• CVE-2026-47160 Medium 5.8 Vaultwarden: Server-side request forgery (SSRF) via Icon Endpoint Decimal/Hex/Octal IP Bypass 0.3%
• CVE-2026-47164 High 7.7 Vaultwarden: SSO Email Auto-Link Can Bind an Existing Local Account to an Attacker-Controlled IdP Identity 0.4%
• CVE-2026-47159 Medium 6.9 Vaultwarden: Authentication Flow Information Disclosure in SSO Discovery Allows Organization Enumeration and Pre-Validation Token Exposure 0.5%
• CVE-2026-47158 High 8.3 Vaultwarden: CSRF in SSO Authorization Flow 0.3%
• CVE-2026-43914 High 7.3 Vaultwarden: Brute-force protection bypass vulnerability 0.3%
• CVE-2026-43913 High 8.1 Vaultwarden: Unconfirmed Owner Can Purge Entire Organization Vault 0.3%
• CVE-2026-43912 High 8.7 Vaultwarden: Cross-Org Group Binding Enables Unauthorized Read And Write Access Into Another Organization 0.3%
• CVE-2026-43911 Medium 6.8 Vaultwarden: Refresh tokens not invalidated on security stamp rotation 0.2%
• CVE-2026-33420 Medium 5.3 Vaultwarden missing authorization check allows Manager-role users to enumerate all collections 0.2%
• CVE-2026-31835 Medium 5.3 Vaultwarden WebAuthn credential metadata tampered before signature verification 0.2%
• CVE-2026-27898 Medium 5.4 Vaultwarden: Unauthorized Access via Partial Update API on Another User’s Cipher 0.2%
• CVE-2026-27803 High 8.3 Vaultwarden: Collection Management Operations Allowed Without `manage` Verification for Manager Role 0.3%
• CVE-2026-27802 High 8.3 Vaultwarden: Privilege Escalation via Bulk Permission Update to Unauthorized Collections by Manager 0.3%
• CVE-2026-27801 Medium 6.0 Vaultwarden: 2FA Bypass on Protected Actions due to Faulty Rate Limit Enforcement 0.3%
• CVE-2026-26012 Medium 6.5 vaultwarden has Full Cipher Enumeration Ignoring Organization Collection Permissions 0.5%
• CVE-2025-24365 High 8.1 vaultwarden allows escalation of privilege via variable confusion in OrgHeaders trait 0.7%
• CVE-2025-24364 High 7.2 vaultwarden allows RCE in the admin panel 1.0%
• CVE-2024-56335 High 7.6 Privilege escalation allows organization groups to be updated/deleted if their UUID is known in vaultwarden 0.3%