ellite vulnerabilities

Newest CVEs

• CVE-2026-77353

  Wallos: iCalendar Injection via CRLF in Subscription Name/Notes Export

  ellite · Wallos

  Medium4.6
• CVE-2026-77352

  Wallos: Authenticated SSRF via per-user SMTP notification host (low-privilege user)

  ellite · Wallos

  Medium4.3
• CVE-2026-77348

  Wallos incomplete fix for CVE-2026-33407: unauthenticated httpoxy SSRF still reachable via `endpoints/payments/search.php`

  ellite · Wallos

  High8.2
• CVE-2026-77351

  Wallos: SSRF via Unvalidated User-Level SMTP Host in Email Notification Settings

  ellite · Wallos

  Low3.5
• CVE-2026-61641

  Wallos: OIDC account takeover via email-based account linking without `email_verified` check

  ellite · Wallos

  High8.1
• CVE-2026-61640

  Wallos: SSRF via OIDC Token/UserInfo URL Configuration

  ellite · Wallos

  High8.5
• CVE-2026-61639

  Wallos: Zip Slip path traversal in database restore writes files to webroot

  ellite · Wallos

  High8.5
• CVE-2026-61638

  Wallos: SSRF via Test Email Notification - unvalidated SMTP host/port

  ellite · Wallos

  High8.2
• CVE-2026-54600

  Wallos: Unauthenticated database replacement via import endpoint on fresh install

  ellite · Wallos

  High8.2
• CVE-2026-54599

  Wallos: OIDC state parameter never validated — login CSRF / account takeover

  ellite · Wallos

  High7.5