aliasvault ghcr.io/aliasvault/api vulnerabilities

Latest aliasvault ghcr.io/aliasvault/api CVEs

Newest publication first

1. CVE-2026-94621 AliasVault: Server-Side Request Forgery via DNS rebinding in Favicon Extraction

   Published 2026-10-15

   Medium·CVSS 6.3 EPSS 0.19%

   AliasVault is a privacy-first password manager with built-in email aliasing. Prior to 0.30.3, the AliasVault server API favicon extractor validates a user-supplied hostname with a first DNS lookup but allows the HTTP client to perform a second DNS lookup when connecting. An authe...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.