CVE-2026-71959 | Medium | 5.8 | 2026-08-10 | Bitwarden Server before 2026.7.2 does not verify that the caller is a member of the organization identified in a POST /collect request body, allowing any authe… |
CVE-2026-60104 | High | 8.7 | 2026-07-08 | Bitwarden Server before 2026.6.0 does not verify that the email in a POST /auth-requests/admin-request body belongs to the authenticated caller, allowing a low… |
CVE-2026-57522 | Low | 3.5 | 2026-06-25 | Bitwarden Server before 2026.5.0 contains a JSON injection vulnerability in IntegrationTemplateProcessor.ReplaceTokens(), which substitutes user-controlled val… |
CVE-2026-57521 | Medium | 4.3 | 2026-06-25 | Bitwarden Server before 2026.5.0 contains a broken access control vulnerability that allows any authenticated user to access arbitrary organization billing dat… |
CVE-2026-57520 | High | 7.1 | 2026-06-25 | Bitwarden Server before 2026.5.0 contains a privilege escalation vulnerability that allows authenticated Custom users with ManageUsers permission to remove Adm… |
CVE-2026-43640 | High | 8.1 | 2026-05-11 | Bitwarden Server prior to v2026.4.1 does not require master-password re-authentication when retrieving or rotating an organization's SCIM API key, allowing an… |
CVE-2026-43639 | High | 8.0 | 2026-05-11 | Bitwarden Server prior to v2026.4.0 contains a missing authorization vulnerability that allows a provider service user to add an arbitrary organization to thei… |
CVE-2026-43638 | Medium | 5.4 | 2026-05-11 | Bitwarden Server prior to v2026.4.1 contains a missing authorization vulnerability that allows any authenticated user to write ciphers into an arbitrary organi… |
CVE-2026-42994 | Critical | 9.8 | 2026-05-01 | Bitwarden CLI 2026.4.0 from 2026-04-22T21:57Z to 2026-04-22T23:30Z, when obtained from npm, had embedded malicious code. This is related to a Checkmarx supply… |
CVE-2023-38840 | Medium | 5.5 | 2023-08-15 | Bitwarden Desktop 2023.7.0 and below allows an attacker with local access to obtain sensitive information via the Bitwarden.exe process. |
CVE-2023-27706 | High | 7.1 | 2023-06-09 | Bitwarden Windows desktop application versions prior to v2023.4.0 store biometric keys in Windows Credential Manager, accessible to other local unprivileged pr… |
CVE-2023-27974 | High | 7.5 | 2023-03-09 | Bitwarden through 2023.2.1 offers password auto-fill when the second-level domain matches, e.g., a password stored for an example.com hosting provider when cus… |
CVE-2018-25081 | High | 7.5 | 2023-03-09 | Bitwarden through 2023.2.1 offers password auto-fill within a cross-domain IFRAME element. NOTE: the vendor's position is that there have been important legiti… |
CVE-2020-15879 | High | 7.5 | 2020-07-21 | Bitwarden Server 1.35.1 allows SSRF because it does not consider certain IPv6 addresses (ones beginning with fc, fd, fe, or ff, and the :: address) and certain… |
CVE-2019-19766 | High | 7.5 | 2019-12-12 | The Bitwarden server through 1.32.0 has a potentially unwanted KDF. |