Product by Dani-garcia

    Vaultwarden

    26 known vulnerabilities in Vaultwarden (Dani-garcia), 0 of them actively exploited (CISA KEV).

    Key figures

    26

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    3

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Vaultwarden (Dani-garcia)
    HighCVE-2024-39924

    Dani-garcia Vaultwarden: security vulnerability

    		8.8
    CriticalCVE-2024-55224

    Dani-garcia Vaultwarden: Code Execution

    		9.6
    HighCVE-2026-95814

    Vaultwarden through 1.37.3 Authorization Bypass via Missing Status Check

    		8.1
    CriticalCVE-2024-55225

    Dani-garcia Vaultwarden: security vulnerability

    		9.8
    HighCVE-2025-24364

    vaultwarden allows RCE in the admin panel

    		7.2
    HighCVE-2026-47164

    Dani-garcia Vaultwarden: Improper Access Control

    also in 1 other product

    		7.7
    HighCVE-2025-24365

    vaultwarden allows escalation of privilege via variable confusion in OrgHeaders trait

    		8.1
    CriticalCVE-2026-43914

    Vaultwarden: Brute-force protection bypass vulnerability

    		9.8
    MediumCVE-2026-47159

    Dani-garcia Vaultwarden: Improper Authentication

    also in 1 other product

    		—
    MediumCVE-2026-116678

    Vaultwarden: Icon endpoint SSRF fix bypass via second-stage favicon IP literal URLs

    also in 1 other product

    		5.8
    HighCVE-2026-43912

    Dani-garcia Vaultwarden: Improper Authorization

    		8.7
    HighCVE-2026-47158

    Vaultwarden: CSRF in SSO Authorization Flow

    also in 1 other product

    		8.3
    HighCVE-2026-27803

    Vaultwarden: Collection Management Operations Allowed Without `manage` Verification for Manager Role

    		8.3
    HighCVE-2026-27802

    Vaultwarden: Privilege Escalation via Bulk Permission Update to Unauthorized Collections by Manager

    		8.3
    HighCVE-2026-43913

    Vaultwarden: Unconfirmed Owner Can Purge Entire Organization Vault

    		8.1
    MediumCVE-2026-26012

    vaultwarden has Full Cipher Enumeration Ignoring Organization Collection Permissions

    		6.5
    HighCVE-2026-43911

    Vaultwarden: Refresh tokens not invalidated on security stamp rotation

    		8.1
    MediumCVE-2024-39925

    Dani-garcia Vaultwarden: security vulnerability

    		6.5
    MediumCVE-2026-47160

    Vaultwarden: Server-side request forgery (SSRF) via Icon Endpoint Decimal/Hex/Octal IP Bypass

    also in 1 other product

    		5.8
    HighCVE-2024-56335

    Dani-garcia Vaultwarden: Improper Privilege Management

    		7.6
    MediumCVE-2026-27801

    Vaultwarden: 2FA Bypass on Protected Actions due to Faulty Rate Limit Enforcement

    		5.9
    MediumCVE-2024-39926

    Dani-garcia Vaultwarden: Cross-Site Scripting (XSS)

    		5.4
    MediumCVE-2026-31835

    Vaultwarden WebAuthn credential metadata tampered before signature verification

    		5.4
    MediumCVE-2026-33420

    Vaultwarden missing authorization check allows Manager-role users to enumerate all collections

    		5.3
    MediumCVE-2024-55226

    Dani-garcia Vaultwarden: Cross-Site Scripting (XSS)

    		5.4

    All vulnerabilities in search

    All products by Dani-garcia