No software is immune from code vulnerabilities. Both open source and commercial password managers have had vulnerabilities, and just like any other software, after they come to light, there is a flurry of activity to fix them and to inform users and the rest of the industry about what happened. Just because you may have used one of the password managers mentioned below does not necessarily mean that your passwords could have been stolen - some of these vulnerabilities were identified and fixed before they were known to be exploited, and some would have affected only users who were lured into falling for phishing attacks, or who had other malware installed already. Some past vulnerabilities that have affected 1Password, LastPass, and KeePass are described here. And a recent one that affected Kaspersky is described here. You should ensure that your password manager (as well as your other software) is configured to frequently check for and apply security updates.