Advisories · Technology

aliasvault.

Every CVE that names aliasvault among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-94621 CVE record

CVSS 6.3 Medium

AliasVault: Server-Side Request Forgery via DNS rebinding in Favicon Extraction
- aliasvault
- ghcr.io/aliasvault/aliasvault
- Race condition
- Server-side request forgery (SSRF)
Not analysed yet 15 Oct 2026
CVE-2026-55587 CVE record

CVSS 8.1 High

AliasVault: Browser extension WebAuthn bridge accepts forged origin/RP ID
- aliasvault
- CWE-346
Not analysed yet 15 Oct 2026
CVE-2026-26266 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

AliasVault affected by Cross-Site Scripting (XSS) via Email HTML Rendering
- aliasvault
- Cross-site scripting (XSS)
Not analysed yet 3 Mar 2026
CVE-2026-22694 CVE record

CVSS 6.1 Medium

AliasVault is Missing Origin Validation in Android Passkey Credential Provider
- aliasvault
- CWE-346
Not analysed yet 14 Jan 2026
CVE-2025-59344 CVE record

CVSS 7.7 High

AliasVault Vulnerable to Server-Side Request Forgery via Favicon Extraction
- aliasvault
- Server-side request forgery (SSRF)
Not analysed yet 19 Sept 2025