# cve.now: Wireapp

The newest entries naming Wireapp as an affected vendor (up to 200), of 29 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-35049](https://cve.now/CVE-2026-35049.md): wire-ios has Persistent Remote DoS via Integer Underflow (CVSS 6.5)
- [CVE-2025-49846](https://cve.now/CVE-2025-49846.md): wire-ios accidentally logs message contents (CVSS 4.1)
- [CVE-2025-48066](https://cve.now/CVE-2025-48066.md): wire-webapp has no database deletion on client logout (CVSS 6.0)
- [CVE-2025-48061](https://cve.now/CVE-2025-48061.md): wire-webapp Has Insufficient Session Invalidation after User Logout (CVSS 5.6)
- [CVE-2023-48221](https://cve.now/CVE-2023-48221.md): wire-avs remote format string vulnerability (CVSS 7.3)
- [CVE-2023-22737](https://cve.now/CVE-2023-22737.md): wire-server vulnerable to unauthorized removal of Bots from Conversations (CVSS 6.5)
- [CVE-2022-39380](https://cve.now/CVE-2022-39380.md): wire-webapp contains Improper Handling of Exceptional Conditions leading to a DoS via Markdown Rendering (CVSS 5.3)
- [CVE-2022-31122](https://cve.now/CVE-2022-31122.md): Wire-server vulnerable to Token Recipient Confusion resulting in account impersonation, deletion or malicious account creation (CVSS 9.8)
- [CVE-2022-29168](https://cve.now/CVE-2022-29168.md): Cross Site Scripting in Wire Messages (CVSS 9.6)
- [CVE-2022-31009](https://cve.now/CVE-2022-31009.md): DoS vulnerability: Invalid Accent Colors (CVSS 5.7)
- [CVE-2022-24799](https://cve.now/CVE-2022-24799.md): Cross Site Scripting in Wire Webapp (CVSS 9.6)
- [CVE-2021-41119](https://cve.now/CVE-2021-41119.md): DoS vulnerabiliity in wire-server json parser (CVSS 5.3)
- [CVE-2022-23610](https://cve.now/CVE-2022-23610.md): Improper Verification of Cryptographic Signature in wire-server (CVSS 9.1)
- [CVE-2022-23625](https://cve.now/CVE-2022-23625.md): DoS vulnerability: Malformed Resource Identifiers (CVSS 6.5)
- [CVE-2021-41193](https://cve.now/CVE-2021-41193.md): Use of Externally-Controlled Format String in wire-avs (CVSS 9.8)
- [CVE-2022-23605](https://cve.now/CVE-2022-23605.md): Expired Ephemeral Messages not reliably removed in wire-webapp (CVSS 4.4)
- [CVE-2021-41100](https://cve.now/CVE-2021-41100.md): Account takeover when having only access to a user's short lived token in wire-server (CVSS 7.4)
- [CVE-2021-41094](https://cve.now/CVE-2021-41094.md): Mandatory encryption at rest can be bypassed (UI) in Wire app (CVSS 4.2)
- [CVE-2021-41093](https://cve.now/CVE-2021-41093.md): Account takeover when having only access to a user's short lived token (CVSS 7.4)
- [CVE-2021-41101](https://cve.now/CVE-2021-41101.md): CORS \`Access-Control-Allow-Origin\` settings are too lenient (CVSS 5.7)
- [CVE-2021-32755](https://cve.now/CVE-2021-32755.md): Certificate pinning is not enforced on the web socket connection (CVSS 5.4)
- [CVE-2021-32683](https://cve.now/CVE-2021-32683.md): XSS through createObjectURL (CVSS 8.8)
- [CVE-2021-21382](https://cve.now/CVE-2021-21382.md): Unsafe loopback forwarding interface in Restund (CVSS 8.6)
- [CVE-2021-32666](https://cve.now/CVE-2021-32666.md): Asset DoS vulnerability (CVSS 6.5)
- [CVE-2021-32665](https://cve.now/CVE-2021-32665.md): Verified groups not reliable (CVSS 8.8)
- [CVE-2021-21400](https://cve.now/CVE-2021-21400.md): Entering code in App Lock modal sends input to conversation (CVSS 7.1)
- [CVE-2021-21396](https://cve.now/CVE-2021-21396.md): Bulk list client endpoint exposes too much metadata about a client (CVSS 6.5)
- [CVE-2021-21301](https://cve.now/CVE-2021-21301.md): Video feed was captured while user has disabled video (CVSS 2.6)
- [CVE-2020-15258](https://cve.now/CVE-2020-15258.md): Insecure use of shell.openExternal in Wire (CVSS 8.0)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/wireapp
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.