https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-43914.htmlhttps://patchthecve.com/cve/CVE-2026-43914.htmlMon, 26 Oct 2026 18:10:00 +0000HIGH 7.3: Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.4, there is a security vulnerability in Vaultwarden that allows bypassing the login brute-force protection if email 2fa is enabled. If email 2fa is enabled, the unprotected 2fa-function send_email_login (email.rs, api endpoihttps://patchthecve.com/cve/CVE-2026-43913.htmlhttps://patchthecve.com/cve/CVE-2026-43913.htmlMon, 26 Oct 2026 18:10:00 +0000HIGH 8.1: Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.5, Vaultwarden allows an unconfirmed organization owner to purge the entire organization vault. The organization invite flow uses a two-step process: accepting an invite transitions membership from Invited to Accepted, and ahttps://patchthecve.com/cve/CVE-2026-43912.htmlhttps://patchthecve.com/cve/CVE-2026-43912.htmlMon, 26 Oct 2026 18:10:00 +0000HIGH 8.7: Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.5, Vaultwarden does not enforce that a groups_users.users_organizations_uuid entry belongs to the same organization as groups.groups_uuid, or a collections_groups.collections_uuid entry belongs to the same organization as cohttps://patchthecve.com/cve/CVE-2026-43911.htmlhttps://patchthecve.com/cve/CVE-2026-43911.htmlMon, 26 Oct 2026 18:10:00 +0000MEDIUM 6.8: Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.5, refresh tokens are not invalidated when the user's security_stamp is rotated by some security-sensitive operations (password change, KDF change, key rotation, email change, org admin password reset, emergency access takeo