Vulnerabilities

TI-2026-53975 CVE-2026-77353

Wallos: iCalendar Injection via CRLF in Subscription Name/Notes Export

MEDIUM 54

Wallos is an open-source, self-hostable personal subscription tracker.

CVSS 3.1MEDIUM 4.6 Network Low privileges User interaction EPSS 0.00289 Published 2026-08-31 Fixed in 5.0.0 CWE-116

TI-2026-53974 CVE-2026-77352

Wallos: Authenticated SSRF via per-user SMTP notification host (low-privilege user)

LOW 20

Wallos is an open-source, self-hostable personal subscription tracker.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00331 Published 2026-08-31 Fixed in 5.0.0 CWE-918

TI-2026-53972 CVE-2026-77348

Server-side request forgery in ellite Wallos

HIGH 75

Wallos is an open-source, self-hostable personal subscription tracker.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00428 Published 2026-08-31 Fixed in 5.0.0 CWE-1188

TI-2026-53973 CVE-2026-77351

Wallos: SSRF via Unvalidated User-Level SMTP Host in Email Notification Settings

MEDIUM 50

Wallos is an open-source, self-hostable personal subscription tracker.

CVSS 3.1LOW 3.5 Network Low privileges No interaction EPSS 0.0029 Published 2026-08-31 Fixed in 5.0.0 CWE-918

TI-2026-44146 CVE-2026-61641

Wallos: OIDC account takeover via email-based account linking without `email_verified` check

LOW 38

Wallos is an open-source, self-hostable personal subscription tracker.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00525 Published 2026-08-31 Fixed in 4.9.6 CWE-287

TI-2026-44145 CVE-2026-61640

Wallos: SSRF via OIDC Token/UserInfo URL Configuration

MEDIUM 44

Wallos is an open-source, self-hostable personal subscription tracker.

CVSS 4.0HIGH 8.5 Network High privileges No interaction EPSS 0.0054 Published 2026-08-31 Fixed in 4.9.6 CWE-918

TI-2026-44144 CVE-2026-61639

Wallos: Zip Slip path traversal in database restore writes files to webroot

LOW 39

Wallos is an open-source, self-hostable personal subscription tracker.

CVSS 4.0HIGH 8.5 Network High privileges No interaction EPSS 0.00508 Published 2026-08-31 Fixed in 4.9.6 CWE-22

TI-2026-44143 CVE-2026-61638

Wallos: SSRF via Test Email Notification - unvalidated SMTP host/port

LOW 38

Wallos is an open-source, self-hostable personal subscription tracker.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00496 Published 2026-08-31 Fixed in 4.9.6 CWE-918

TI-2026-39433 CVE-2026-54600

Wallos: Unauthenticated database replacement via import endpoint on fresh install

HIGH 75

Wallos is an open-source, self-hostable personal subscription tracker.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00583 Published 2026-08-31 Fixed in 4.9.4 CWE-287

TI-2026-39432 CVE-2026-54599

Wallos: OIDC state parameter never validated — login CSRF / account takeover

HIGH 68

Wallos is an open-source, self-hostable personal subscription tracker.

CVSS 4.0HIGH 7.5 Network No auth User interaction EPSS 0.00223 Published 2026-08-31 Fixed in 4.9.4 CWE-352

TI-2026-39431 CVE-2026-54598

Missing Authentication for Critical Function in wallos

HIGH 72

Wallos is an open-source, self-hostable personal subscription tracker.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00458 Published 2026-08-31 Fixed in 4.9.4 CWE-306

TI-2026-36958 CVE-2026-50199

Wallos: Cross-user Fixer/API Layer credential consumption in exchange-rate refresh

MEDIUM 53

Wallos is an open-source, self-hostable personal subscription tracker.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00264 Published 2026-08-31 Fixed in 4.9.1 CWE-863

TI-2026-36957 CVE-2026-50198

Wallos: Cross-user subscription cost inference via replacement_subscription_id

MEDIUM 53

Wallos is an open-source, self-hostable personal subscription tracker.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00294 Published 2026-08-31 Fixed in 4.9.1 CWE-639

TI-2026-30206 CVE-2026-41689

Wallos: Shared local webhook allowlist lets low-privilege users send arbitrary requests to allowlisted internal services

MEDIUM 60

Wallos is an open-source, self-hostable personal subscription tracker.

CVSS 3.1MEDIUM 6.0 Network Low privileges No interaction EPSS 0.00176 Published 2026-05-07 No fix listed CWE-863

TI-2026-30205 CVE-2026-41688

Incomplete fix for CVE-2026-33399: SSRF in Wallos

HIGH 67

Wallos is an open-source, self-hostable personal subscription tracker.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00227 Published 2026-05-07 No fix listed CWE-918

TI-2026-30204 CVE-2026-41687

Wallos: SSRF CGNAT Bypass in subscription/payments Logo URL — is_cgnat_ip() Not Used in Inline Checks

MEDIUM 53

Wallos is an open-source, self-hostable personal subscription tracker.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00204 Published 2026-05-07 Fixed in 4.8.1 CWE-918

TI-2026-25814 CVE-2026-33417

Wallos: Password Reset Tokens Never Expire

MEDIUM 64

Wallos is an open-source, self-hostable personal subscription tracker.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00274 Published 2026-03-24 Fixed in 4.7.2 CWE-613

TI-2026-25798 CVE-2026-33401

Wallos: Incomplete fix for CVE-2026-30840 - SSRF in AI and notification endpoints bypass ssrf_helper.php

MEDIUM 64

Wallos is an open-source, self-hostable personal subscription tracker.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00294 Published 2026-03-24 Fixed in 4.7.0 CWE-918

TI-2026-25797 CVE-2026-33400

Wallos: Stored cross-site scripting (XSS) vulnerability in the payment method rename endpoint

MEDIUM 58

Wallos is an open-source, self-hostable personal subscription tracker.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.002 Published 2026-03-24 Fixed in 4.7.0 CWE-79

TI-2026-25796 CVE-2026-33399

Wallos: SSRF Bypass - Incomplete Fix for CVE-2026-30839/30840

HIGH 67

Wallos is an open-source, self-hostable personal subscription tracker.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00293 Published 2026-03-24 Fixed in 4.7.0 CWE-918

TI-2026-25804 CVE-2026-33407

Wallos: SSRF via HTTP Proxy Environment Variable

HIGH 75

Wallos is an open-source, self-hostable personal subscription tracker.

CVSS 4.0HIGH 8.3 Network No auth No interaction EPSS 0.00383 Published 2026-03-24 Fixed in 4.7.0 CWE-918

TI-2026-23671 CVE-2026-30842

Wallos: Authenticated Missing Authorization Allows Deletion of Other Users’ Uploaded Avatars

MEDIUM 53

Wallos is an open-source, self-hostable personal subscription tracker.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00328 Published 2026-03-07 Fixed in 4.6.2 CWE-862

TI-2026-23670 CVE-2026-30841

Wallos: Reflected XSS via unescaped token and email parameters in passwordreset.php

MEDIUM 64

Wallos is an open-source, self-hostable personal subscription tracker.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.0032 Published 2026-03-07 Fixed in 4.6.2 CWE-79

TI-2026-23669 CVE-2026-30840

Wallos: Server-Side Request Forgery (SSRF) in Notification Testers

HIGH 73

Wallos is an open-source, self-hostable personal subscription tracker.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.00516 Published 2026-03-07 Fixed in 4.6.2 CWE-295

TI-2026-23668 CVE-2026-30839

Wallos: SSRF via webhook test endpoint

LOW 24

Wallos is an open-source, self-hostable personal subscription tracker.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00373 Published 2026-03-07 Fixed in 4.6.2 CWE-918

Vulnerabilities

Filters