CVE and update status of the FreeBSD ports tree3,295 unaddressed CVEs in 670 portsAll times are CET
Port details

security/vaultwarden 1.37.4_1

Fixed in main, not merged to 2026Q4: Vaultwarden -- Multiple vulnerabilities

Bitwarden compatible backend server

0
unaddressed
0
VuXML only
10
fixed
1
open problem reports

Port info

Maintainer
mr@FreeBSD.org
Packages
latest: 1.37.4_1
Upstream
up to date
Last update
to 1.37.4_1 · 9c878207a1
Quarterly
2026Q4: 1.37.2_1 1 VuXML
Formerly
security/bitwarden_rs until 2021-05-16
WWW
https://github.com/dani-garcia/vaultwarden
Links
cgit · VuXML

Install

Package
# pkg install vaultwarden
installs 1.37.4_1 from latest; from quarterly (2026Q4) 1.37.2_1
Port
# cd /usr/ports/security/vaultwarden && make install clean
# make -C /usr/ports/security/vaultwarden config  # change options first
Size
8.6 MiB download · 38 MiB installed
Depends on
archivers/zstd 1.5.7_2, databases/mysql84-client 8.4.11_1, databases/postgresql18-client 18.6, devel/capnproto 1.5.0, math/gmp 6.3.0, security/nettle 3.10.2, www/vaultwarden-web_vault 2026.7.0
License
GPLv3
Creates
user www, group www
Options
4 of 5 on in the package: MYSQL PGSQL SQLITE WEBVAULT
Show the 1 options that are off
S3

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 161.37.4_11.37.4–
FreeBSD 151.37.4_11.37.4_1–
FreeBSD 141.37.4_11.37.4✗

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 151.37.2_11.37.2_1–
FreeBSD 141.37.2_11.37.2_1✗

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed and VuXML only (0)

No unaddressed CVE and nothing reported by pkg audit for the packaged version 1.37.4_1.

Fixed (10)

Show 10 fixed
VuXML entries whose affected range the packaged version has left, plus CVEs from the last 90 days that this version is already past (fixed by update).
CVECVSSPublishedDescription
CVE-2026-958148.62026-09-22Vaultwarden through 1.37.3 omits organization membership status validation from three cipher access-restriction queries, allowing revoked and not-yet-confirmed members t…

Problem reports (1) · open in Bugzilla, most recently changed first

PRSummaryStatusChanged
298265maintainer-feedback? security/vaultwarden: empty dirs in etcNew2026-09-07

Commits (139)

Mikael Urankar (mikael) · 1.37.4_1
lang/rust: Bump revisions after 1.99.0

PR:		299016
9c878207a1
Michael Reifenberger (mr) · 1.37.4 MFH 2026Q4 requested
security/vaultwarden: Security update to 1.37.4

PR:		299172
Reported by:	brnrd
MFH:		2026Q4
Security:	3a72cd47-c157-11f1-a6ea-8447094a420f
f37c5847f4
Michael Reifenberger (mr) · 1.37.3
security/vaultwarden: Update to 1.37.3

PR:		298901
Reported by:	foudfou
3d3fa33257
Mikael Urankar (mikael) · 1.37.2_1
lang/rust: Bump revisions after 1.98.1

PR:		298139
7316461925
Michael Reifenberger (mr) · 1.37.2
security/vaultwarden: Update to 1.37.2

PR:		297754
Reported by:	Bernard Spil
acbd6cc1e9
Michael Reifenberger (mr) · 1.37.1
security/vaultwarden: Update to 1.37.1

PR:		297146
Reported by:	Bernard Spil
2b97438518
Michael Reifenberger (mr) · 1.37.0
security/vaultwarden: Update to 1.37.0

PR:		297045
Reported by:	Bernard Spil
091b5eb0f5
Mikael Urankar (mikael) · 1.36.0_2
lang/rust: Bump revisions after 1.97.1

PR:		296645
9c892d2601
Mikael Urankar (mikael) · 1.36.0_1
lang/rust: Bump revisions after 1.96.0

PR:		295694
e29b5eeec3
Bernhard Froehlich (decke) · 1.36.0
security/vaultwarden: Pet portlint and fix typo

PR:		295006
Approved by:	maintainer timeout
2393eae565
Rene Ladan (rene) · 1.36.0
all: drop support for FreeBSD 13, mips and risc64sf

Reviewed by:            many (*)
Differential Revision:  https://reviews.freebsd.org/D55624
Differential Revision:  https://reviews.freebsd.org/D55642 (merged in from bofh)

many (*)
  acm arrowd brooks cmt dch decke dinoex eduardo fluffy fuz gahr garga
  jbeich joerg jrm kai kenrap martymac matthew mfechner michaelo mizhka
  nobutaka pkubaj se tagattie thj

  Anton Saietskii
  GenericRikka
  Gert Doering
  Jan Bramkamp
  Oleh Hushchenkov
  Oleksandr Kryvulia
  Ralf van der Enden
  Yamagi

  desktop kde python tcltk office
2a7c056120
Michael Reifenberger (mr) · 1.36.0
security/vaultwarden: Update to 1.36.0
b89a6ce200
Mikael Urankar (mikael) · 1.35.6_1
lang/rust: Bump revisions after 1.95.0

PR:		294615
17bf498fd2
Michael Reifenberger (mr) · 1.35.6
security/vaultwarden: Security update to 1.35.6

PR:		294465
Reported by:	Bernard Spil, Jordan Ostreff
bd4762bf20
Mikael Urankar (mikael) · 1.35.4_1
lang/rust: Bump revisions after 1.94.0

PR:		293615
43f5b4a72f
Michael Reifenberger (mr) · 1.35.4
security/vaultwarden: Security update to 1.35.4

While there add BROKEN_FreeBSD_13 since vaultwarden needs newer openssl.

PR:		293400
Reported by:	Bernard Spil
83e8c9c14f
Michael Reifenberger (mr) · 1.35.3
security/vaultwarden: Update to 1.35.3
d09d534df2
Mikael Urankar (mikael) · 1.35.2_1
lang/rust: Bump revisions after 1.93.0

PR:		292360
3d631100e8
Michael Reifenberger (mr) · 1.35.2
security/vaultwarden: Update to 1.35.2
e726d36864
Michael Reifenberger (mr) · 1.35.1
security/vaultwarden: Update to 1.35.1

Bugfix to 1.35.0

PR:		292043
Reported by:	Bernard Spil
0b4ed99b00
Mathieu Arnold (mat) · 1.35.0
crates: cleanup
0730582096
Michael Reifenberger (mr) · 1.35.0
security/vaultwarden: Add dependency

Missing dep on libzstd.so

PR:		291993
Reported by:	Bernard Spil
fe96063984
Michael Reifenberger (mr) · 1.35.0
security/vaultwarden: Update to 1.35.0
22631e9c28
Mikael Urankar (mikael) · 1.34.3_4
lang/rust: Bump revisions after 1.92.0

PR:		291582
5e496c7707
Mikael Urankar (mikael) · 1.34.3_3
lang/rust: Bump revisions after 1.91.1

PR:		290816
d6b6027df6
Mikael Urankar (mikael) · 1.34.3_2
lang/rust: Bump revisions after 1.90.0

PR:		289709
97b5de4ffc
Mikael Urankar (mikael) · 1.34.3_1
lang/rust: Bump revisions after 1.89.0

PR:		288923
b21956d7db
Michael Reifenberger (mr) · 1.34.3
security/vaultwarden: Update to 1.34.3

S3 port option added too.

PR:		288573
Reported by:	foudfou oss@foudil.fr
89efcc7bc5
Mikael Urankar (mikael) · 1.34.1_2
lang/rust: Bump revisions after 1.88.0

PR:		287766
f3f7e555b0
Mikael Urankar (mikael) · 1.34.1_1
lang/rust: Bump revisions after 1.87.0

PR:		286829
3ed29b8185
Michael Reifenberger (mr) · 1.34.1
security/vaultwarden: update to 1.34.1

PR:		287169
Reported by:	foudfou
579da07687
Mikael Urankar (mikael) · 1.33.2_2
lang/rust: Bump revisions after 1.86.0

PR:		285840
2a5976aebe
Mikael Urankar (mikael) · 1.33.2_1
lang/rust: Bump revisions after 1.85.0

PR:		284884
cf7c4b037d
Michael Reifenberger (mr) · 1.33.2
security/vaultwarden: update to 1.33.2

PR:		284747
Reported by:	 foudfou
535e82ae58
Michael Reifenberger (mr) · 1.33.1
security/vaultwarden: update to 1.33.1

PR:		284604
Reported by:	 foudfou
fec110ed55
Michael Reifenberger (mr) · 1.33.0
security/vaultwarden: Security update to 1.33.0

Also added CVE IDs to security/vuxml vaulwarden entry.

PR:		 284399
Reported by:	 foudfou
75bb613dd6
Baptiste Daroussin (bapt) · 1.32.7_1
security/vaultwarden: fix bad patch

When a patch live in the files/ in the form of patch-<name> it is
automatically applied with -p0. a patch in the git form requires a -p1
fix the patch to be applicable with -p0

PR:		284239
Reported by:	freebsd@rail.eu.org
186e9c3eda
Mikael Urankar (mikael) · 1.32.7_1
lang/rust: Bump revisions after 1.84.0

PR:		283962
fccaa1b326
Mikael Urankar (mikael) · 1.32.7
security/vaultwarden: Fix build with rust 1.84.0

Import upstream patch [1]

[1] https://github.com/dani-garcia/vaultwarden/commit/10d12676cf11566ea33f49bbdc207bc417be7225

PR:		283962
51c1d2b650
Michael Reifenberger (mr) · 1.32.7
security/vaultwarden: Security update to 1.32.7

PR:		283435
Reported by:	foudfou
00aac6cd57
Michael Reifenberger (mr) · 1.32.6
security/vaultwarden: update to 1.32.6

PR:		283369
Reported by:	foudfou
5d95854ac0
Mikael Urankar (mikael) · 1.32.5_1
lang/rust: Bump revisions after 1.83.0

PR:		283000
1d1fd15a3e
Michael Reifenberger (mr) · 1.32.5
security/vaultwarden: Security update to 1.32.5

This release further fixed some CVE Reports reported
by a third party security auditor and we recommend everybody to update
to the latest version as soon as possible.
The contents of these reports will be disclosed publicly in the future.

PR:		282795
Reported by:	Bernard Spil
63974c070f
Michael Reifenberger (mr) · 1.32.4
security/vaultwarden: Security update to 1.32.4

PR:		282795
Reported by:	Bernard Spil
252a072ff0
Mikael Urankar (mikael) · 1.32.3_1
lang/rust: Bump revisions after 1.82.0

PR:		282516
ca048c2884
Michael Reifenberger (mr) · 1.32.3
security/vaultwarden: Update to 1.32.3
13152910cc
Bernard Spil (brnrd) · 1.32.2
security/vaultwarden: Update to 1.32.2

PR:		281838
Approved by:	maintainter timeout
Reported by:	feld
db4808a832
Mikael Urankar (mikael) · 1.32.0_2
lang/rust: Bump revisions after 1.81.0

PR:		281300
89ab81d0e2
Mikael Urankar (mikael) · 1.32.0_1
*/*: remove STRIP_CMD calls in rust based ports

This is not needed after bc4fedc1fec0d359365c04d43be9e32bf101a50e

PR:		246993
Differential Revision:	https://reviews.freebsd.org/D46503
c0d07f1127
Mikael Urankar (mikael) · 1.32.0_1
security/vaultwarden: garbage collect patch
e36f67a662
page 1 of 3older →oldest »