Log in Start free

wallabag

Products

ProductCVEsExploitedLatest
wallabag/wallabag8–Nov 15, 2024
wallabag2–Oct 13, 2026
android-app1–Aug 28, 2026

Exploited and recent CVEs

  • CVE-2026-110228 Medium 5.4 wallabag 2.6.13 through 2.6.14 Stored XSS via Failed HTML Import Upload 0.3%
  • CVE-2026-82089 High 8.8 The wallabag (aka fr.gaulupeau.apps.InThePoche) application through 2.6.0 for Android allows XSS because /api/entries data is loaded into a WebView. 0.5%
  • CVE-2026-82081 Medium 6.4 wallabag 2 through 2.6.14 allows SSRF because a crafted title or content field is mishandled during PDF export. 0.2%
  • CVE-2023-0737 Medium 6.5 CSRF in wallabag/wallabag 0.3%
  • CVE-2023-4455 Medium 6.5 Cross-Site Request Forgery (CSRF) in wallabag/wallabag 0.3%
  • CVE-2023-4454 Medium 4.3 Cross-Site Request Forgery (CSRF) in wallabag/wallabag 0.3%
  • CVE-2023-0734 High 7.3 Improper Authorization in wallabag/wallabag 0.5%
  • CVE-2023-0736 Medium 4.6 Cross-site Scripting (XSS) - Stored in wallabag/wallabag 0.4%
  • CVE-2023-0735 Medium 6.5 Cross-Site Request Forgery (CSRF) in wallabag/wallabag 0.3%
  • CVE-2023-0609 Medium 6.5 Improper Authorization in wallabag/wallabag 0.6%
  • CVE-2023-0610 Medium 5.4 Improper Authorization in wallabag/wallabag 0.4%