https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T09:27:08.008078+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-317243 EUVD-2026-317243 2026-10-06T09:27:08.045938+00:00 EUVD-2026-317243 https://cve.radiocsirt.org/vuln/fkie_cve-2026-43914 fkie_cve-2026-43914 2026-10-06T09:27:08.045974+00:00

Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.4, there is a security vulnerability in Vaultwarden that allows bypassing the login brute-force protection if email 2fa is enabled. If email 2fa is enabled, the unprotected 2fa-function send_email_login (email.rs, api endpoint /api/two-factor/send-email-login) also acts as an oracle determining whether a username-password combination is correct. An attacker can abuse that endpoint to brute-force passwords without rate-limiting. This works even for users who don't have email 2fa configured. This vulnerability is fixed in 1.35.4.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1285 WID-SEC-W-2026-1285 — Vaultwarden: Mehrere Schwachstellen 2026-10-06T09:27:08.046009+00:00

Ein Angreifer kann mehrere Schwachstellen in Vaultwarden ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service Angriff durchzuführen, und um Informationen offenzulegen.