ellite

Records32All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical2CVSS 9.0–10.0

CVSS high17CVSS 7.0–8.9

Exploited now

ellite records in CISA KEV

No ellite vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Wallos 16 records HIGH

Records

32 records

TI-2026-53972 CVE-2026-77348

Server-side request forgery in ellite Wallos

HIGH 75

Wallos is an open-source, self-hostable personal subscription tracker.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00428 Published 2026-08-31 Fixed in 5.0.0 CWE-1188

TI-2026-39433 CVE-2026-54600

Wallos: Unauthenticated database replacement via import endpoint on fresh install

HIGH 75

Wallos is an open-source, self-hostable personal subscription tracker.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00583 Published 2026-08-31 Fixed in 4.9.4 CWE-287

TI-2026-25804 CVE-2026-33407

Wallos: SSRF via HTTP Proxy Environment Variable

HIGH 75

Wallos is an open-source, self-hostable personal subscription tracker.

CVSS 4.0HIGH 8.3 Network No auth No interaction EPSS 0.00383 Published 2026-03-24 Fixed in 4.7.0 CWE-918

TI-2026-23669 CVE-2026-30840

Wallos: Server-Side Request Forgery (SSRF) in Notification Testers

HIGH 73

Wallos is an open-source, self-hostable personal subscription tracker.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.00516 Published 2026-03-07 Fixed in 4.6.2 CWE-295

TI-2026-39431 CVE-2026-54598

Missing Authentication for Critical Function in wallos

HIGH 72

Wallos is an open-source, self-hostable personal subscription tracker.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00458 Published 2026-08-31 Fixed in 4.9.4 CWE-306

TI-2026-39432 CVE-2026-54599

Wallos: OIDC state parameter never validated — login CSRF / account takeover

HIGH 68

Wallos is an open-source, self-hostable personal subscription tracker.

CVSS 4.0HIGH 7.5 Network No auth User interaction EPSS 0.00223 Published 2026-08-31 Fixed in 4.9.4 CWE-352

TI-2024-19429 CVE-2024-29320 · GHSA-r74q-h5x3-cq55

Wallos before 1.15.3 is vulnerable to SQL Injection via the category and payment parameters to /subscriptions/get.php.

HIGH 68

Wallos before 1.15.3 is vulnerable to SQL Injection via the category and payment parameters to /subscriptions/get.php.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00673 Published 2024-04-30 No fix listed CWE-89

TI-2026-30205 CVE-2026-41688

Incomplete fix for CVE-2026-33399: SSRF in Wallos

HIGH 67

Wallos is an open-source, self-hostable personal subscription tracker.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00227 Published 2026-05-07 No fix listed CWE-918

TI-2026-25796 CVE-2026-33399

Wallos: SSRF Bypass - Incomplete Fix for CVE-2026-30839/30840

HIGH 67

Wallos is an open-source, self-hostable personal subscription tracker.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00293 Published 2026-03-24 Fixed in 4.7.0 CWE-918

TI-2026-21886 CVE-2026-27479

Wallos: SSRF via Redirect Bypass in Logo/Icon URL Fetch

HIGH 67

Wallos is an open-source, self-hostable personal subscription tracker.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.0035 Published 2026-02-21 Fixed in 4.6.1 CWE-918

TI-2026-25814 CVE-2026-33417

Wallos: Password Reset Tokens Never Expire

MEDIUM 64

Wallos is an open-source, self-hostable personal subscription tracker.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00274 Published 2026-03-24 Fixed in 4.7.2 CWE-613

TI-2026-25798 CVE-2026-33401

Wallos: Incomplete fix for CVE-2026-30840 - SSRF in AI and notification endpoints bypass ssrf_helper.php

MEDIUM 64

Wallos is an open-source, self-hostable personal subscription tracker.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00294 Published 2026-03-24 Fixed in 4.7.0 CWE-918

TI-2026-23670 CVE-2026-30841

Wallos: Reflected XSS via unescaped token and email parameters in passwordreset.php

MEDIUM 64

Wallos is an open-source, self-hostable personal subscription tracker.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.0032 Published 2026-03-07 Fixed in 4.6.2 CWE-79

TI-2026-30206 CVE-2026-41689

Wallos: Shared local webhook allowlist lets low-privilege users send arbitrary requests to allowlisted internal services

MEDIUM 60

Wallos is an open-source, self-hostable personal subscription tracker.

CVSS 3.1MEDIUM 6.0 Network Low privileges No interaction EPSS 0.00176 Published 2026-05-07 No fix listed CWE-863

TI-2024-37875 CVE-2024-57386 · GHSA-8x2p-6xj8-59hx

Cross Site Scripting vulnerability in Wallos v.2.41.0 allows a remote attacker to execute…

MEDIUM 60

Cross Site Scripting vulnerability in Wallos v.2.41.0 allows a remote attacker to execute arbitrary code via the profile picture function.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00464 Published 2025-01-23 No fix listed CWE-79

TI-2026-25797 CVE-2026-33400

Wallos: Stored cross-site scripting (XSS) vulnerability in the payment method rename endpoint

MEDIUM 58

Wallos is an open-source, self-hostable personal subscription tracker.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.002 Published 2026-03-24 Fixed in 4.7.0 CWE-79

TI-2024-15131 CVE-2024-22776 · GHSA-xq2h-vm9v-fgph

Wallos 0.9 is vulnerable to Cross Site Scripting (XSS) in all text-based input fields…

MEDIUM 55

Wallos 0.9 is vulnerable to Cross Site Scripting (XSS) in all text-based input fields without proper validation, excluding those requiring specific formats like date fields.

CVSS 3.1MEDIUM 4.7 Network No auth User interaction EPSS 0.00474 Published 2024-02-23 No fix listed CWE-79

TI-2026-53975 CVE-2026-77353

Wallos: iCalendar Injection via CRLF in Subscription Name/Notes Export

MEDIUM 54

Wallos is an open-source, self-hostable personal subscription tracker.

CVSS 3.1MEDIUM 4.6 Network Low privileges User interaction EPSS 0.00289 Published 2026-08-31 Fixed in 5.0.0 CWE-116

TI-2026-36958 CVE-2026-50199

Wallos: Cross-user Fixer/API Layer credential consumption in exchange-rate refresh

MEDIUM 53

Wallos is an open-source, self-hostable personal subscription tracker.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00264 Published 2026-08-31 Fixed in 4.9.1 CWE-863

TI-2026-36957 CVE-2026-50198

Wallos: Cross-user subscription cost inference via replacement_subscription_id

MEDIUM 53

Wallos is an open-source, self-hostable personal subscription tracker.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00294 Published 2026-08-31 Fixed in 4.9.1 CWE-639

TI-2026-30204 CVE-2026-41687

Wallos: SSRF CGNAT Bypass in subscription/payments Logo URL — is_cgnat_ip() Not Used in Inline Checks

MEDIUM 53

Wallos is an open-source, self-hostable personal subscription tracker.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00204 Published 2026-05-07 Fixed in 4.8.1 CWE-918

TI-2026-23671 CVE-2026-30842

Wallos: Authenticated Missing Authorization Allows Deletion of Other Users’ Uploaded Avatars

MEDIUM 53

Wallos is an open-source, self-hostable personal subscription tracker.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00328 Published 2026-03-07 Fixed in 4.6.2 CWE-862

TI-2026-53973 CVE-2026-77351

Wallos: SSRF via Unvalidated User-Level SMTP Host in Email Notification Settings

MEDIUM 50

Wallos is an open-source, self-hostable personal subscription tracker.

CVSS 3.1LOW 3.5 Network Low privileges No interaction EPSS 0.0029 Published 2026-08-31 Fixed in 5.0.0 CWE-918

TI-2024-36821 CVE-2024-55372 · GHSA-fqxf-49hh-94mj

Wallos <=2.38.2 has a file upload vulnerability in the restore database function, which…

MEDIUM 50

Wallos <=2.38.2 has a file upload vulnerability in the restore database function, which allows unauthenticated users to restore database by uploading a ZIP file.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00647 Published 2025-04-16 No fix listed CWE-73

TI-2024-36820 CVE-2024-55371 · GHSA-mp2g-3625-m5pp

Wallos <= 2.38.2 has a file upload vulnerability in the restore backup function, which…

MEDIUM 50

Wallos <= 2.38.2 has a file upload vulnerability in the restore backup function, which allows authenticated users to restore backups by uploading a ZIP file.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00629 Published 2025-04-16 No fix listed CWE-73

Open these records in search →

Critical	2
High	17
Medium	12
Low	1
No CVSS	0