Skip to content
Noroxi

bitwarden records

14 published records for vendor bitwarden.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
1
With a fix record
50%
Median publish → KEV
No record has entered KEV

Records by year

  1. 19
  2. 20
  3. 23
  4. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

Bug bounty scope

The product’s vendor appears in a public program. Matched by name; verify the scope text in the program.

All records

14 records
  • CVE-2026-60104
    37Monitor

    Bitwarden Server < 2026.6.0 Authorization Bypass via Admin Auth Request

    CriticalCVSS 9.3No exploitEPSS 0%

    bitwarden · serverJul 8, 2026

  • CVE-2026-43639
    35Monitor

    Bitwarden Server < 2026.4.0 Missing Authorization via Provider Clients

    HighCVSS 8.9No exploitEPSS 1%

    bitwarden · serverMay 11, 2026

  • CVE-2026-42994
    35Monitor

    Bitwarden CLI 2026.4.0 from 2026-04-22T21:57Z to 2026-04-22T23:30Z, when obtained from npm, had embedded malicious code.

    HighCVSS 8.8No exploitEPSS 1%

    bitwarden · cliMay 1, 2026

  • CVE-2026-43640
    34Monitor

    Bitwarden Server < 2026.4.1 Authentication Bypass via SCIM API Key

    HighCVSS 8.6No exploitEPSS 1%

    bitwarden · serverMay 11, 2026

  • CVE-2020-15879
    31Monitor

    Bitwarden Server 1.35.1 allows SSRF because it does not consider certain IPv6 addresses (ones beginning with fc, fd, fe, or ff, and the :: a

    HighCVSS 7.5No exploitEPSS 3%

    bitwarden · serverJul 21, 2020

  • CVE-2019-19766
    30Monitor

    The Bitwarden server through 1.32.0 has a potentially unwanted KDF.

    HighCVSS 7.5No exploitEPSS 1%

    bitwarden · serverDec 12, 2019

  • CVE-2018-25081
    30Monitor

    Bitwarden through 2023.2.1 offers password auto-fill within a cross-domain IFRAME element.

    HighCVSS 7.5No exploitEPSS 1%

    bitwarden · bitwardenMar 8, 2023

  • CVE-2023-27974
    30Monitor

    Bitwarden through 2023.2.1 offers password auto-fill when the second-level domain matches, e.g., a password stored for an example.com hostin

    HighCVSS 7.5No exploitEPSS 1%

    bitwarden · bitwardenMar 8, 2023

  • CVE-2026-57520
    28Monitor

    Bitwarden Server < 2026.5.0 Privilege Escalation via Bulk User Remove Endpoint

    HighCVSS 7.1No exploitEPSS 1%

    bitwarden · serverJun 25, 2026

  • CVE-2023-27706
    28Monitor

    Bitwarden Windows desktop application versions prior to v2023.4.0 store biometric keys in Windows Credential Manager, accessible to other lo

    HighCVSS 7.1No exploitEPSS 1%

    bitwarden · bitwardenJun 9, 2023

  • CVE-2023-38840
    22Monitor

    Bitwarden Desktop 2023.7.0 and below allows an attacker with local access to obtain sensitive information via the Bitwarden.exe process.

    MediumCVSS 5.5Proof of conceptEPSS 1%

    bitwarden · bitwardenAug 15, 2023

  • CVE-2026-57521
    21Monitor

    Bitwarden Server < 2026.5.0 Broken Access Control via PreviewInvoiceController

    MediumCVSS 5.3No exploitEPSS 0%

    bitwarden · serverJun 25, 2026

  • CVE-2026-43638
    21Monitor

    Bitwarden Server < 2026.4.1 Missing Authorization via Organization Cipher Import

    MediumCVSS 5.3No exploitEPSS 0%

    bitwarden · serverMay 11, 2026

  • CVE-2026-57522
    9Monitor

    Bitwarden Server < 2026.5.0 JSON Injection via Webhook Templates

    LowCVSS 2.3No exploitEPSS 0%

    bitwarden · serverJun 25, 2026