ellite Wallos

13 known vulnerabilities in ellite Wallos, with patch priority, exploit likelihood and the news covering them.

Latest vulnerabilities

  • CVE-2026-77353 CVSS 4.6 medium Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, Wallos allows authenticated users to inject…
  • CVE-2026-77352 CVSS 4.3 medium Wallos is an open-source, self-hostable personal subscription tracker. From version 2.0.0 to before version 5.0.0, any authenticated…
  • CVE-2026-77351 CVSS 3.5 low Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, Wallos lets any authenticated user store an…
  • CVE-2026-77348 CVSS 8.2 high Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, the fix for CVE-2026-33407…
  • CVE-2026-61641 CVSS 8.1 high Wallos is an open-source, self-hostable personal subscription tracker. From version 4.0.0 to before version 4.9.6, Wallos's OIDC login…
  • CVE-2026-61640 CVSS 8.5 high Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, Admin-configured OIDC token_url and…
  • CVE-2026-61639 CVSS 8.5 high Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, POST /endpoints/db/restore.php calls…
  • CVE-2026-61638 CVSS 8.2 high Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, POST…
  • CVE-2026-54600 CVSS 8.2 high Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, endpoints/db/import.php has no…
  • CVE-2026-54599 CVSS 7.5 high Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, login.php generates an OIDC state nonce…
  • CVE-2026-54598 CVSS 7.5 high Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, endpoints/db/migrate.php executes database…
  • CVE-2026-50199 CVSS 4.3 medium Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.1, endpoints/currency/update_exchange.php…
  • CVE-2026-50198 CVSS 4.3 medium Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.1, an authenticated user can edit their own…