Read the docs

wallabag

Records13All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9

Exploited now

wallabag records in CISA KEV

No wallabag vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Wallabag 10 records MEDIUM

Records

13 records

TI-2023-00696 CVE-2023-0734 · GHSA-8ccw-f83g-v7g3

Improper Authorization in wallabag/wallabag

Priority MEDIUM 63

Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.4.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00498 Published 2023-03-05 Fixed in 2.5.4 CWE-285
TI-2023-04113 CVE-2023-4455 · GHSA-gjvc-55fw-v6vq

Cross-Site Request Forgery (CSRF) in wallabag/wallabag

Priority MEDIUM 62

Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.6.3.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00321 Published 2023-08-21 Fixed in 2.6.3 CWE-352
TI-2023-00699 CVE-2023-0737 · GHSA-99w8-c5f6-96pp

CSRF in wallabag/wallabag

Priority MEDIUM 62

wallabag version 2.5.2 contains a Cross-Site Request Forgery (CSRF) vulnerability that allows attackers to arbitrarily delete user accounts via the /account/delete endpoint.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00325 Published 2024-11-15 Fixed in 2.5.4 CWE-352
TI-2023-04112 CVE-2023-4454 · GHSA-p8gp-899c-jvq9

Cross-Site Request Forgery (CSRF) in wallabag/wallabag

Priority MEDIUM 59

Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.6.3.

CVSS 3.1MEDIUM 5.7 Network Low privileges User interaction EPSS 0.00268 Published 2023-08-21 Fixed in 2.6.3 CWE-352
TI-2023-00698 CVE-2023-0736 · GHSA-3x2c-87cq-qx49

Cross-site Scripting (XSS) - Stored in wallabag/wallabag

Priority MEDIUM 58

Cross-site Scripting (XSS) - Stored in GitHub repository wallabag/wallabag prior to 2.5.4.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00443 Published 2023-02-07 Fixed in 2.5.4 CWE-79
TI-2026-73444 CVE-2026-110228 · GHSA-rqqm-gvvm-8vpc

Stored cross-site scripting in wallabag via failed HTML import upload

Priority MEDIUM 56

wallabag 2.6.13 through 2.6.14 contains a stored cross-site scripting vulnerability that allows authenticated users to host arbitrary HTML by triggering a failed Pocket HTML, Pocket CSV or Shaarli import.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00274 Published 2026-10-13 No fix listed CWE-79
TI-2023-00577 CVE-2023-0610 · GHSA-mrqx-mjc4-vfh3

Improper Authorization in wallabag/wallabag

Priority MEDIUM 53

Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00444 Published 2023-02-01 Fixed in 2.5.3 CWE-285
TI-2023-00576 CVE-2023-0609 · GHSA-qwx8-mxxx-mg96

Improper Authorization in wallabag/wallabag

Priority MEDIUM 53

Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00637 Published 2023-02-01 Fixed in 2.5.3 CWE-285
TI-2026-56646 CVE-2026-82089 · GHSA-c6wm-f83x-r49p

Cross-site scripting in wallabag android-app

Priority MEDIUM 41

The wallabag (aka fr.gaulupeau.apps.InThePoche) application through 2.6.0 for Android allows XSS because /api/entries data is loaded into a WebView.

CVSS 4.0HIGH 8.8 Network Low privileges User interaction EPSS 0.00525 Published 2026-08-28 No fix listed CWE-79
Open these records in search →