Wireapp vulnerabilities
29 CVEs and advisories name Wireapp as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-35049wire-ios has Persistent Remote DoS via Integer Underflow
- CVE-2025-49846wire-ios accidentally logs message contents
- CVE-2025-48066wire-webapp has no database deletion on client logout
- CVE-2025-48061wire-webapp Has Insufficient Session Invalidation after User Logout
- CVE-2023-48221wire-avs remote format string vulnerability
- CVE-2023-22737wire-server vulnerable to unauthorized removal of Bots from Conversations
- CVE-2022-39380wire-webapp contains Improper Handling of Exceptional Conditions leading to a DoS via Markdown Rendering
- CVE-2022-31122Wire-server vulnerable to Token Recipient Confusion resulting in account impersonation, deletion or malicious account creation
- CVE-2022-29168Cross Site Scripting in Wire Messages
- CVE-2022-31009DoS vulnerability: Invalid Accent Colors
- CVE-2022-24799Cross Site Scripting in Wire Webapp
- CVE-2021-41119DoS vulnerabiliity in wire-server json parser
- CVE-2022-23610Improper Verification of Cryptographic Signature in wire-server
- CVE-2022-23625DoS vulnerability: Malformed Resource Identifiers
- CVE-2021-41193Use of Externally-Controlled Format String in wire-avs
- CVE-2022-23605Expired Ephemeral Messages not reliably removed in wire-webapp
- CVE-2021-41100Account takeover when having only access to a user's short lived token in wire-server
- CVE-2021-41094Mandatory encryption at rest can be bypassed (UI) in Wire app
- CVE-2021-41093Account takeover when having only access to a user's short lived token
- CVE-2021-41101CORS `Access-Control-Allow-Origin` settings are too lenient
- CVE-2021-32755Certificate pinning is not enforced on the web socket connection
- CVE-2021-32683XSS through createObjectURL
- CVE-2021-21382Unsafe loopback forwarding interface in Restund
- CVE-2021-32666Asset DoS vulnerability
- CVE-2021-32665Verified groups not reliable
- CVE-2021-21400Entering code in App Lock modal sends input to conversation
- CVE-2021-21396Bulk list client endpoint exposes too much metadata about a client
- CVE-2021-21301Video feed was captured while user has disabled video
- CVE-2020-15258Insecure use of shell.openExternal in Wire