Server
Bitwarden · 10 CVEs
Bitwarden Server < 2026.7.2 Audit Log Injection via POST /collect
Aug 10, 2026
Bitwarden Server < 2026.6.0 Authorization Bypass via Admin Auth Request
Jul 8, 2026
Bitwarden Server < 2026.5.0 JSON Injection via Webhook Templates
Jun 25, 2026
Bitwarden Server < 2026.5.0 Broken Access Control via PreviewInvoiceController
Jun 25, 2026
Bitwarden Server < 2026.5.0 Privilege Escalation via Bulk User Remove Endpoint
Jun 25, 2026
Bitwarden Server < 2026.4.1 Authentication Bypass via SCIM API Key
May 11, 2026
Bitwarden Server < 2026.4.0 Missing Authorization via Provider Clients
May 11, 2026
Bitwarden Server < 2026.4.1 Missing Authorization via Organization Cipher Import
May 11, 2026
Bitwarden Server 1.35.1 allows SSRF because it does not consider certain IPv6 addresses (ones beginning with fc, fd, fe…
Jul 21, 2020
The Bitwarden server through 1.32.0 has a potentially unwanted KDF.
Dec 12, 2019
| CVE ID | Description | Severity | EPSS | Published |
|---|---|---|---|---|
| CVE-2026-71959 | Bitwarden Server < 2026.7.2 Audit Log Injection via POST /collect | MEDIUM | 0.39% | Aug 10, 2026 |
| CVE-2026-60104 | Bitwarden Server < 2026.6.0 Authorization Bypass via Admin Auth Request | CRITICAL | 0.37% | Jul 8, 2026 |
| CVE-2026-57522 | Bitwarden Server < 2026.5.0 JSON Injection via Webhook Templates | LOW | 0.46% | Jun 25, 2026 |
| CVE-2026-57521 | Bitwarden Server < 2026.5.0 Broken Access Control via PreviewInvoiceController | MEDIUM | 0.43% | Jun 25, 2026 |
| CVE-2026-57520 | Bitwarden Server < 2026.5.0 Privilege Escalation via Bulk User Remove Endpoint | HIGH | 0.64% | Jun 25, 2026 |
| CVE-2026-43640 | Bitwarden Server < 2026.4.1 Authentication Bypass via SCIM API Key | HIGH | 0.71% | May 11, 2026 |
| CVE-2026-43639 | Bitwarden Server < 2026.4.0 Missing Authorization via Provider Clients | HIGH | 0.84% | May 11, 2026 |
| CVE-2026-43638 | Bitwarden Server < 2026.4.1 Missing Authorization via Organization Cipher Import | MEDIUM | 0.33% | May 11, 2026 |
| CVE-2020-15879 | Bitwarden Server 1.35.1 allows SSRF because it does not consider certain IPv6 addresses (ones beginning with fc, fd, fe, or ff, and the :: address) and certain… | HIGH | 2.70% | Jul 21, 2020 |
| CVE-2019-19766 | The Bitwarden server through 1.32.0 has a potentially unwanted KDF. | HIGH | 1.35% | Dec 12, 2019 |
Showing 1 to 10 of 10 CVEs