CVE-2026-82089
The wallabag (aka fr.gaulupeau.apps.InThePoche) application through 2.6.0 for Android allows XSS because /api/entries data is loaded into a WebView.
- Published Aug 28, 2026
- CVSS 8.8 high
- 0.5% chance of exploitation in the next 30 days (EPSS)