ellite Wallos

• CVE-2026-77353 Medium 4.6 Wallos: iCalendar Injection via CRLF in Subscription Name/Notes Export 0.3%
• CVE-2026-77352 Medium 4.3 Wallos: Authenticated SSRF via per-user SMTP notification host (low-privilege user) 0.3%
• CVE-2026-77348 High 8.2 Wallos incomplete fix for CVE-2026-33407: unauthenticated httpoxy SSRF still reachable via `endpoints/payments/search.php` 0.4%
• CVE-2026-77351 Low 3.5 Wallos: SSRF via Unvalidated User-Level SMTP Host in Email Notification Settings 0.3%
• CVE-2026-61641 High 8.1 Wallos: OIDC account takeover via email-based account linking without `email_verified` check 0.5%
• CVE-2026-61640 High 8.5 Wallos: SSRF via OIDC Token/UserInfo URL Configuration 0.5%
• CVE-2026-61639 High 8.5 Wallos: Zip Slip path traversal in database restore writes files to webroot 0.5%
• CVE-2026-61638 High 8.2 Wallos: SSRF via Test Email Notification - unvalidated SMTP host/port 0.5%
• CVE-2026-54600 High 8.2 Wallos: Unauthenticated database replacement via import endpoint on fresh install 0.6%
• CVE-2026-54599 High 7.5 Wallos: OIDC state parameter never validated — login CSRF / account takeover 0.2%
• CVE-2026-54598 High 7.5 Missing Authentication for Critical Function in wallos 0.5%
• CVE-2026-50199 Medium 4.3 Wallos: Cross-user Fixer/API Layer credential consumption in exchange-rate refresh 0.3%
• CVE-2026-50198 Medium 4.3 Wallos: Cross-user subscription cost inference via replacement_subscription_id 0.3%
• CVE-2026-41689 Medium 6.0 Wallos: Shared local webhook allowlist lets low-privilege users send arbitrary requests to allowlisted internal services 0.2%
• CVE-2026-41688 High 7.7 Incomplete fix for CVE-2026-33399: SSRF in Wallos 0.2%
• CVE-2026-41687 Medium 4.3 Wallos: SSRF CGNAT Bypass in subscription/payments Logo URL — is_cgnat_ip() Not Used in Inline Checks 0.2%
• CVE-2026-33417 Medium 6.5 Wallos: Password Reset Tokens Never Expire 0.3%
• CVE-2026-33401 High 7.1 Wallos: Incomplete fix for CVE-2026-30840 - SSRF in AI and notification endpoints bypass ssrf_helper.php 0.3%
• CVE-2026-33400 Medium 5.4 Wallos: Stored cross-site scripting (XSS) vulnerability in the payment method rename endpoint 0.2%
• CVE-2026-33399 High 7.7 Wallos: SSRF Bypass - Incomplete Fix for CVE-2026-30839/30840 0.3%
• CVE-2026-33407 High 8.3 Wallos: SSRF via HTTP Proxy Environment Variable 0.4%
• CVE-2026-30842 Medium 4.3 Wallos: Authenticated Missing Authorization Allows Deletion of Other Users’ Uploaded Avatars 0.3%
• CVE-2026-30841 Medium 6.9 Wallos: Reflected XSS via unescaped token and email parameters in passwordreset.php 0.3%
• CVE-2026-30840 High 8.8 Wallos: Server-Side Request Forgery (SSRF) in Notification Testers 0.5%
• CVE-2026-30839 Medium 5.3 Wallos: SSRF via webhook test endpoint 0.4%
• CVE-2026-30828 High 8.7 Wallos: SSRF via url parameter leading to File Traversal 0.6%
• CVE-2026-27479 High 7.7 Wallos: SSRF via Redirect Bypass in Logo/Icon URL Fetch 0.4%