13
CVEs
0
Critical
8
High
0
KEV
0
PoC
0
Unpatched C/H
100.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
8
MEDIUM
4
LOW
1
Monthly CVE Trend
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-61639 | Zip Slip path traversal in Wallos's database restore endpoint allows an authenticated administrator to write arbitrary files - including PHP webshells - directly into the application webroot. The flaw exists in POST /endpoints/db/restore.php, where ZipArchive::extractTo() processes ZIP entries without sanitizing ../ sequences, enabling directory escape before any extension-based filtering runs. An admin who uploads a crafted ZIP with an entry like logos/../../endpoints/shell.php achieves remote code execution on the server. No public exploit or CISA KEV listing has been identified at time of analysis; however, the technique is well-understood and the attack is low-complexity once admin credentials are held. | HIGH | 8.5 | 0.3% | 43 |
|
| CVE-2026-61640 | SSRF via admin-configurable OIDC endpoint URLs in Wallos subscription tracker allows an authenticated admin to direct the server to issue arbitrary outbound HTTP requests, including to cloud provider metadata services and internal network hosts. All Wallos releases prior to 4.9.6 are affected; the OIDC callback handler at includes/oidc/handle_oidc_callback.php:18-49 passes admin-supplied token_url and user_info_url directly to curl_init() without the validate_webhook_url_for_ssrf() protection already applied to logo and webhook URL fields. No public exploit has been identified at time of analysis, and a confirmed vendor patch is available in v4.9.6 released 2026-06-22. | HIGH | 8.5 | 0.3% | 43 |
|
| CVE-2026-54600 | Wallos prior to 4.9.4 exposes its database import endpoint at endpoints/db/import.php with no authentication, allowing a remote unauthenticated attacker to fully replace the application's SQLite database on any fresh or unconfigured instance. The sole guard - a user-table row count of zero - is a setup-state check, not a security control, meaning any newly deployed Wallos instance is vulnerable before the first administrator account is created. No public exploit has been identified at time of analysis, and the issue is patched in v4.9.4 (use v4.9.5, as the v4.9.4 container image is broken). | HIGH | 8.2 | 0.3% | 41 |
|
| CVE-2026-61638 | Server-side request forgery in Wallos prior to version 4.9.6 enables authenticated users to force the server's PHPMailer instance to connect to any attacker-specified host and port by supplying crafted smtpaddress and smtpport values to the test email notification endpoint. The flaw is a coverage gap - every other notification endpoint applies the application's ssrf_helper.php guard, but testemailnotifications.php was omitted. An authenticated attacker can probe internal network services and query cloud metadata APIs such as AWS IMDSv1, potentially harvesting cloud credentials. No public exploit or CISA KEV listing is identified at time of analysis; a vendor patch is available as v4.9.6. | HIGH | 8.2 | 0.3% | 41 |
|
| CVE-2026-77348 | Incomplete patch coverage in Wallos, the self-hosted subscription tracker, leaves a second unauthenticated logo-search endpoint (`endpoints/payments/search.php`) vulnerable to SSRF via HTTP proxy header injection - an oversight from the fix for CVE-2026-33407. Wallos prior to 5.0.0 passes the `HTTP_PROXY`/`HTTPS_PROXY` environment variable directly into cURL's `CURLOPT_PROXY`, allowing any unauthenticated network attacker to force the server's outbound HTTP requests through an attacker-controlled proxy. No active exploitation is confirmed (not in CISA KEV) and no public POC is referenced in available data, but the attack requires no credentials and no special configuration. | HIGH | 8.2 | 0.2% | 41 |
|
| CVE-2026-61641 | Full account takeover in Wallos 4.0.0-4.9.5 is possible via OIDC authentication bypass when the application links an incoming OIDC identity to an existing local account using only the email claim, ignoring whether the IdP marked that email as verified via the `email_verified` flag. An attacker operating on a multi-tenant or open-registration IdP trusted by the target Wallos instance can claim the administrator's email, trigger the OIDC login flow, and be granted full admin access with no password or prior Wallos credentials. No public exploit has been identified at time of analysis; the attack complexity is rated High (AC:H) reflecting the IdP-configuration prerequisite. | HIGH | 8.1 | 0.3% | 41 |
|
| CVE-2026-54598 | Unauthenticated remote execution of database schema migrations in Wallos prior to version 4.9.4 allows any attacker with HTTP access to trigger pending SQLite migration files against the live database by calling endpoints/db/migrate.php directly. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this requires zero authentication, zero complexity, and no user interaction against default-configured instances. No public exploit has been identified at time of analysis, but the trivial attack surface makes this a straightforward integrity threat to any internet-exposed Wallos deployment. | HIGH | 7.5 | 0.3% | 38 |
|
| CVE-2026-54599 | OIDC login CSRF in Wallos prior to 4.9.4 allows a remote unauthenticated attacker to log a victim into the attacker's own account by tricking them into visiting a crafted callback URL. The root cause is that checksession.php processes the OIDC authorization callback without validating the state parameter against the session-stored nonce generated in login.php, breaking the OIDC CSRF protection mechanism entirely. No public exploit has been identified at time of analysis, but the attack requires only that the victim use OIDC login and click a malicious link, making it low-friction for a motivated attacker. | HIGH | 7.5 | 0.2% | 38 |
|
| CVE-2026-77353 | iCalendar injection in Wallos prior to v5.0.0 allows authenticated users to break out of VEVENT blocks in exported .ics feeds by embedding raw CRLF sequences in subscription names or notes, enabling insertion of fully attacker-controlled calendar events - including spoofed organizers and arbitrary ATTENDEE email addresses - into any calendar application subscribed to the feed. The root cause is a validation/export mismatch: input sanitization encodes HTML metacharacters but never strips newlines, while the iCal export layer decodes those entities back before writing output, letting CRLF pass through unmodified. No public exploit code or active exploitation (CISA KEV) has been identified; the vendor-released patch is v5.0.0. | MEDIUM | 4.6 | 0.2% | 23 |
|
| CVE-2026-50198 | Cross-user data isolation failure in Wallos prior to v4.9.1 allows authenticated users to infer the monthly-normalized subscription cost belonging to other users on the same instance. By setting replacement_subscription_id on their own inactive subscription to a victim's subscription ID, an attacker causes Wallos's stats aggregation engine to dereference the foreign record without user_id scoping, leaking derived financial metadata. A vendor-released patch is available in v4.9.1; no public exploit or CISA KEV listing has been identified at time of analysis. | MEDIUM | 4.3 | 0.2% | 22 |
|
| CVE-2026-77352 | Server-side request forgery in Wallos (versions 2.0.0 through 4.x) lets any authenticated user force the application server to open arbitrary outbound TCP connections to attacker-chosen hosts, including internal and link-local addresses. The per-user SMTP notification settings endpoint stores a user-supplied host without validation, and the notification cron job passes it directly to PHPMailer - no admin rights are required to abuse this path. No public exploit or CISA KEV listing has been identified at time of analysis; the vendor patched this in version 5.0.0. | MEDIUM | 4.3 | 0.2% | 22 |
|
| CVE-2026-50199 | Incorrect authorization in Wallos prior to version 4.9.1 allows any authenticated user to consume another user's third-party currency API credentials. The endpoint endpoints/currency/update_exchange.php selects the first Fixer or API Layer provider key stored globally rather than scoping it to the requesting user, meaning a user without their own API key can trigger exchange-rate refreshes that exhaust a different user's API quota. No public exploit has been identified at time of analysis, and the vendor-released patch (v4.9.1) resolves the cross-user data isolation flaw. | MEDIUM | 4.3 | 0.2% | 22 |
|
| CVE-2026-77351 | Server-Side Request Forgery in Wallos prior to version 5.0.0 allows any authenticated low-privileged user to store an arbitrary SMTP host - including private RFC 1918 addresses and cloud metadata endpoints - in their personal email notification settings without server-side validation. When the scheduled notification cron job fires, the Wallos server opens an outbound TCP connection to the attacker-specified address, giving the attacker a reliable blind SSRF primitive to probe internal network services from the server's network vantage point. No public exploit is identified at time of analysis, and no active exploitation is confirmed by CISA KEV. | LOW | 3.5 | 0.2% | 18 |
|