Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
33 results
Aug 31, 2026Wallos is an open-source, self-hostable personal subscription tracker.CVE-2026-77353 · Other software · ellite · reported by GitHubMedium 4.6
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, Wallos allows authenticated users to inject arbitrary iCalendar properties and events into their exported .ics feed by embedding raw CRLF sequences in subscription names or notes. Because the input validation layer only encodes HTML metacharacters but never strips newlines, and the export layer decodes those entities back before writing iCal output, an attacker with any valid account can craft a subscription whose name breaks out of the current VEVENT block and inserts fully attacker-controlled calendar events — including spoofed organizers, arbitrary email addresses in ATTENDEE properties, and misleading event content — into any calendar application subscribed to that feed. This issue has been patched in version 5.0.0.
- Product
- Wallos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2026Wallos is an open-source, self-hostable personal subscription tracker.CVE-2026-77352 · Other software · ellite · reported by GitHubMedium 4.3
Wallos is an open-source, self-hostable personal subscription tracker. From version 2.0.0 to before version 5.0.0, any authenticated Wallos user (no admin rights required) can make the server open arbitrary outbound SMTP connections to internal/link-local addresses, by setting the SMTP host of their personal email notifications to an internal IP. The per-user notification settings endpoint (endpoints/notifications/saveemailnotifications.php) performs no SSRF validation, and the notification cron (endpoints/cronjobs/sendnotifications.php) feeds that user-controlled host straight into PHPMailer ($mail->Host = $email['smtpAddress']). When the user's subscription notification fires, the server connects to the chosen host:port. This issue has been patched in version 5.0.0.
- Product
- Wallos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2026Wallos is an open-source, self-hostable personal subscription tracker.CVE-2026-77351 · Other software · ellite · reported by GitHubLow 3.5
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, Wallos lets any authenticated user store an arbitrary SMTP host — including private and cloud-metadata IP addresses — in their personal email notification settings, with no server-side SSRF validation. When the scheduled notification cron job runs, it passes the stored host directly to PHPMailer, causing the Wallos server to open an outbound TCP connection to whatever address the attacker specified. This gives a low-privileged attacker a reliable mechanism to probe internal network services from the server's perspective. This issue has been patched in version 5.0.0.
- Product
- Wallos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2026Wallos is an open-source, self-hostable personal subscription tracker.CVE-2026-77348 · Other software · ellite · reported by GitHubHigh 8.2
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, the fix for CVE-2026-33407 (GHSA-hhjq-82f8-m6rc, "SSRF via HTTP Proxy Environment Variable") hardened endpoints/logos/search.php by disabling cURL proxying (CURLOPT_PROXY = '' + CURLOPT_NOPROXY = '*'). However, Wallos ships a second, near-identical, unauthenticated logo-image search endpoint — endpoints/payments/search.php — that was not given the same hardening. It still passes the HTTP_PROXY/HTTPS_PROXY environment variable straight into CURLOPT_PROXY. This issue has been patched in version 5.0.0.
- Product
- Wallos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2026Wallos is an open-source, self-hostable personal subscription tracker.CVE-2026-61641 · Other software · ellite · reported by GitHubHigh 8.1
Wallos is an open-source, self-hostable personal subscription tracker. From version 4.0.0 to before version 4.9.6, Wallos's OIDC login links an incoming OIDC identity to an existing local account by matching the email claim alone, without verifying that the IdP marked that email as verified (email_verified). When Wallos is configured against an IdP that lets a user present an arbitrary or unverified email (multi-tenant IdPs, IdPs with open self-registration, or any IdP the attacker partly controls), an attacker with no Wallos account can authenticate with the admin's email and be logged in as the admin — full account takeover, no password needed. This issue has been patched in version 4.9.6.
- Product
- Wallos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2026Wallos is an open-source, self-hostable personal subscription tracker.CVE-2026-61640 · Other software · ellite · reported by GitHubHigh 8.5
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, Admin-configured OIDC token_url and user_info_url in includes/oidc/handle_oidc_callback.php:18-49 are used directly in curl_init() with zero SSRF filtering. Unlike logo/webhook URLs which have validate_webhook_url_for_ssrf(), OIDC URLs bypass all protections. Admin sets URL to http://169.254.169.254/latest/meta-data/ for cloud metadata access or internal network pivoting. This issue has been patched in version 4.9.6.
- Product
- Wallos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2026Wallos is an open-source, self-hostable personal subscription tracker.CVE-2026-61639 · Other software · ellite · reported by GitHubHigh 8.5
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, POST /endpoints/db/restore.php calls ZipArchive::extractTo() without validating entry names for ../ sequences. Admin uploads crafted zip with entry logos/../../endpoints/shell.php to write webshell to webroot. Extension filter only applies to post-extraction logo copy step. This issue has been patched in version 4.9.6.
- Product
- Wallos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2026Wallos is an open-source, self-hostable personal subscription tracker.CVE-2026-61638 · Other software · ellite · reported by GitHubHigh 8.2
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, POST /endpoints/notifications/testemailnotifications.php accepts smtpaddress and smtpport from POST body with zero SSRF validation. PHPMailer connects to attacker-supplied host:port. Every other notification endpoint uses ssrf_helper.php but email was missed. Any authenticated user can probe internal network, cloud metadata. This issue has been patched in version 4.9.6.
- Product
- Wallos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2026Wallos is an open-source, self-hostable personal subscription tracker.CVE-2026-54600 · Other software · ellite · reported by GitHubHigh 8.2
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, endpoints/db/import.php has no authentication. The only guard is a user-table row count — if zero (fresh/unconfigured install), an unauthenticated attacker can replace the entire database. This issue has been patched in version 4.9.4.
- Product
- Wallos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2026Wallos is an open-source, self-hostable personal subscription tracker.CVE-2026-54599 · Other software · ellite · reported by GitHubHigh 7.5
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, login.php generates an OIDC state nonce stored in $_SESSION['oidc_state'], but checksession.php dispatches the OIDC callback without comparing the incoming state against the session value. An attacker can trick a victim into visiting a crafted URL, causing Wallos to exchange the attacker's authorization code and log the victim into the attacker's account. This issue has been patched in version 4.9.4.
- Product
- Wallos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2026Wallos is an open-source, self-hostable personal subscription tracker.CVE-2026-54598 · Other software · ellite · reported by GitHubHigh 7.5
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, endpoints/db/migrate.php executes database schema migrations when called over HTTP with zero authentication. Any unauthenticated attacker can trigger pending migration files against the live SQLite database. This issue has been patched in version 4.9.4.
- Product
- Wallos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2026Wallos is an open-source, self-hostable personal subscription tracker.CVE-2026-50199 · Other software · ellite · reported by GitHubMedium 4.3
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.1, endpoints/currency/update_exchange.php loads the first Fixer/API Layer credential globally instead of loading the credential for the authenticated user. As a result, a normal authenticated user without their own provider key can trigger exchange-rate refreshes using another user's stored provider credential. This issue has been patched in version 4.9.1.
- Product
- Wallos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2026Wallos is an open-source, self-hostable personal subscription tracker.CVE-2026-50198 · Other software · ellite · reported by GitHubMedium 4.3
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.1, an authenticated user can edit their own inactive subscription and set replacement_subscription_id to a subscription ID belonging to another user. The write is accepted, and later the stats logic dereferences that foreign subscription ID without user_id scoping. This lets the attacker infer the victim subscription's monthly-normalized cost by observing changes in their own stats output. This does not expose the full victim subscription object, but it does expose derived financial metadata. This issue has been patched in version 4.9.1.
- Product
- Wallos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2026Wallos is an open-source, self-hostable personal subscription tracker.CVE-2026-41689 · Other software · ellite · reported by GitHubMedium 6
Wallos is an open-source, self-hostable personal subscription tracker. In versions 4.8.4 and prior, the webhook notification feature reuses an administrator-configured local-target allowlist for every logged-in user. Any normal user can fully control a webhook URL, headers, and body, then use Wallos to send server-side requests to allowlisted internal automation services. When such a target exposes deployment or execution APIs, this can further enable adjacent-service RCE, but that downstream result is conditional on the target service. At time of publication, there are no publicly available patches.
- Product
- Wallos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2026Wallos is an open-source, self-hostable personal subscription tracker.CVE-2026-41688 · Other software · ellite · reported by GitHubHigh 7.7
Wallos is an open-source, self-hostable personal subscription tracker. In versions 4.8.4 and prior, the incomplete SSRF fix in Wallos validates webhook URLs via gethostbyname() but passes the original hostname to cURL without CURLOPT_RESOLVE pinning on 10 of 11 outbound HTTP endpoints, leaving a DNS rebinding TOCTOU window. At time of publication, there are no publicly available patches.
- Product
- Wallos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2026Wallos is an open-source, self-hostable personal subscription tracker.CVE-2026-41687 · Other software · ellite · reported by GitHubMedium 4.3
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.8.1, the SSRF protection in endpoints/subscription/add.php (line 42) and endpoints/payments/add.php (line 40) uses an inline IP validation check (FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE) that does not block CGNAT addresses (100.64.0.0/10, RFC 6598). The includes/ssrf_helper.php file explicitly defines is_cgnat_ip() to cover this gap (used by notification endpoints), but the logo/icon URL fetching in subscription and payment endpoints performs its own inline validation that misses this range. This allows authenticated users to perform Blind SSRF to internal services in Tailscale, Carrier-Grade NAT, and other environments using 100.64.0.0/10 addresses. This issue has been patched in version 4.8.1.
- Product
- Wallos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026Wallos is an open-source, self-hostable personal subscription tracker.CVE-2026-33417 · Other software · ellite · reported by GitHubMedium 6.5
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.2, password reset tokens in Wallos never expire. The password_resets table includes a created_at timestamp column, but the token validation logic never checks it. A password reset token remains valid indefinitely until it is used, allowing an attacker who intercepts a reset link at any point to use it days, weeks, or months later. This issue has been patched in version 4.7.2.
- Product
- Wallos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026Wallos is an open-source, self-hostable personal subscription tracker.CVE-2026-33407 · Other software · ellite · reported by GitHubHigh 8.3
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.0, Wallos endpoints/logos/search.php accepts HTTP_PROXY and HTTPS_PROXY environment variables without validation, enabling SSRF via proxy hijacking. The server performs DNS resolution on user-supplied search terms, which can be controlled by attackers to trigger outbound requests to arbitrary domains. This issue has been patched in version 4.7.0.
- Product
- Wallos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026Wallos is an open-source, self-hostable personal subscription tracker.CVE-2026-33401 · Other software · ellite · reported by GitHubHigh 7.1
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.0, the patch introduced in commit e8a513591 (CVE-2026-30840) added SSRF protection to notification test endpoints but left three additional attack surfaces unprotected: the AI Ollama host parameter, the AI recommendations endpoint, and the notification cron job. An authenticated user can reach internal network services, cloud metadata endpoints (AWS IMDSv1, GCP, Azure IMDS), or localhost-bound services by supplying a crafted URL to any of these endpoints. This issue has been patched in version 4.7.0.
- Product
- Wallos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026Wallos is an open-source, self-hostable personal subscription tracker.CVE-2026-33400 · Other software · ellite · reported by GitHubMedium 5.4
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.0, a stored cross-site scripting (XSS) vulnerability in the payment method rename endpoint allows any authenticated user to inject arbitrary JavaScript that executes when any user visits the Settings, Subscriptions, or Statistics pages. Combined with the wallos_login authentication cookie lacking the HttpOnly flag, this enables full session hijacking. This issue has been patched in version 4.7.0.
- Product
- Wallos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026Wallos is an open-source, self-hostable personal subscription tracker.CVE-2026-33399 · Other software · ellite · reported by GitHubHigh 7.7
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.0, the SSRF fix applied in version 4.6.2 for CVE-2026-30839 and CVE-2026-30840 is incomplete. The validate_webhook_url_for_ssrf() protection was added to the test* notification endpoints but not to the corresponding save* endpoints. An authenticated user can save an internal/private IP address as a notification URL, and when the cron job sendnotifications.php executes, the request is sent to the internal IP without any SSRF validation. This issue has been patched in version 4.7.0.
- Product
- Wallos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2026Wallos is an open-source, self-hostable personal subscription tracker.CVE-2026-30842 · Other software · ellite · reported by GitHubMedium 4.3
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, Wallos allows an authenticated user to delete avatar files uploaded by other users. The avatar deletion endpoint does not verify that the requested avatar belongs to the current user. As a result, any authenticated user who knows or can discover another user's uploaded avatar filename can delete that file. This issue has been patched in version 4.6.2.
- Product
- Wallos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2026Wallos is an open-source, self-hostable personal subscription tracker.CVE-2026-30841 · Other software · ellite · reported by GitHubMedium 6.9
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, passwordreset.php outputs $_GET["token"] and $_GET["email"] directly into HTML input value attributes using <?= $token ?> and <?= $email ?> without calling htmlspecialchars(). This allows reflected XSS by breaking out of the attribute context. This issue has been patched in version 4.6.2.
- Product
- Wallos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2026Wallos is an open-source, self-hostable personal subscription tracker.CVE-2026-30840 · Other software · ellite · reported by GitHubHigh 8.8
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, there is a server-side request forgery vulnerability in notification testers. This issue has been patched in version 4.6.2.
- Product
- Wallos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2026Wallos is an open-source, self-hostable personal subscription tracker.CVE-2026-30839 · Other software · ellite · reported by GitHubMedium 5.3
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, testwebhooknotifications.php does not validate the target URL against private/reserved IP ranges, enabling full-read SSRF. The server response is returned to the caller. This issue has been patched in version 4.6.2.
- Product
- Wallos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2026Wallos is an open-source, self-hostable personal subscription tracker.CVE-2026-30828 · Other software · ellite · reported by GitHubHigh 8.7
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, the url parameter can be used to retrieve local system files. This issue has been patched in version 4.6.2.
- Product
- Wallos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2026Wallos is an open-source, self-hostable personal subscription tracker.CVE-2026-27479 · Other software · ellite · reported by GitHubHigh 7.7
Wallos is an open-source, self-hostable personal subscription tracker. Versions 4.6.0 and below contain a Server-Side Request Forgery (SSRF) vulnerability in the subscription and payment logo/icon upload functionality. The application validates the IP address of the provided URL before making the request, but allows HTTP redirects (CURLOPT_FOLLOWLOCATION = true), enabling an attacker to bypass the IP validation and access internal resources, including cloud instance metadata endpoints. The getLogoFromUrl() function validates the URL by resolving the hostname and checking if the resulting IP is in a private or reserved range using FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE. However, the subsequent cURL request is configured with CURLOPT_FOLLOWLOCATION = true and CURLOPT_MAXREDIRS = 3, which means the request will follow HTTP redirects without re-validating the destination IP. This issue has been fixed in version 4.6.1.
- Product
- Wallos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2025A Cross-Site Request Forgery (CSRF) in the component /endpoints/currency/currency of Wallos v4.1.1 allows attackers to execute arbitrary operations via a crafteCVE-2025-60535 · Other software · reported by MITREHigh 7.3
A Cross-Site Request Forgery (CSRF) in the component /endpoints/currency/currency of Wallos v4.1.1 allows attackers to execute arbitrary operations via a crafted GET request.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2025Wallos <=2.38.2 has a file upload vulnerability in the restore database function, which allows unauthenticated users to restore database by uploading a ZIP fileCVE-2024-55372 · Other software · Wallosapp · reported by MITRECritical 9.8
Wallos <=2.38.2 has a file upload vulnerability in the restore database function, which allows unauthenticated users to restore database by uploading a ZIP file. The contents of the ZIP file are extracted on the server. This functionality enables an unauthenticated attacker to upload malicious files to the server. Once a web shell is installed, the attacker gains the ability to execute arbitrary commands.
- Product
- Wallos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2025Wallos <= 2.38.2 has a file upload vulnerability in the restore backup function, which allows authenticated users to restore backups by uploading a ZIP file.CVE-2024-55371 · Other software · Wallosapp · reported by MITRECritical 9.8
Wallos <= 2.38.2 has a file upload vulnerability in the restore backup function, which allows authenticated users to restore backups by uploading a ZIP file. The contents of the ZIP file are extracted on the server. This functionality enables an authenticated attacker (being an administrator is not required) to upload malicious files to the server. Once a web shell is installed, the attacker gains the ability to execute arbitrary commands.
- Product
- Wallos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2025Cross Site Scripting vulnerability in Wallos v.2.41.0 allows a remote attacker to execute arbitrary code via the profile picture function.CVE-2024-57386 · Other software · Wallosapp · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in Wallos v.2.41.0 allows a remote attacker to execute arbitrary code via the profile picture function.
- Product
- Wallos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2024Wallos before 1.15.3 is vulnerable to SQL Injection via the category and payment parameters to /subscriptions/get.php.CVE-2024-29320 · Other software · ellite · reported by MITREHigh 8.1
Wallos before 1.15.3 is vulnerable to SQL Injection via the category and payment parameters to /subscriptions/get.php.
- Product
- wallos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2024Wallos 0.9 is vulnerable to Cross Site Scripting (XSS) in all text-based input fields without proper validation, excluding those requiring specific formats likeCVE-2024-22776 · Other software · ellite · reported by MITREMedium 4.7
Wallos 0.9 is vulnerable to Cross Site Scripting (XSS) in all text-based input fields without proper validation, excluding those requiring specific formats like date fields.
- Product
- wallos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwebity-luescher.notion.site
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.