Product · aliasvault

ghcr.io/aliasvault/api

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

Medium 6.3

CVE-2026-94621

AliasVault: Server-Side Request Forgery via DNS rebinding in Favicon Extraction

AliasVault is a privacy-first password manager with built-in email aliasing. Prior to 0.30.3, the AliasVault server API favicon extractor validates a user-supplied hostname with a first DNS lookup but allows the HTTP client to perform a second DNS lookup when…

aliasvault aliasvault ghcr.io/aliasvault/aliasvault ghcr.io/lanedirt/aliasvault-api

Oct 15, 2026