wallabag vulnerabilities

CVEs per yearBy the year they were published

1. 20237
2. 20241
3. 20263

Newest CVEs

• CVE-2026-110228

  wallabag 2.6.13 through 2.6.14 Stored XSS via Failed HTML Import Upload

  wallabag · wallabag

  Medium5.1
• CVE-2026-82089

  The wallabag (aka fr.gaulupeau.apps.InThePoche) application through 2.6.0 for Android allows XSS because /api/entries data is loaded into a WebView.

  wallabag · android-app

  High8.8
• CVE-2026-82081

  wallabag 2 through 2.6.14 allows SSRF because a crafted title or content field is mishandled during PDF export.

  wallabag · wallabag

  Medium6.4
• CVE-2023-0737

  CSRF in wallabag/wallabag

  wallabag · wallabag/wallabag

  Medium6.5
• CVE-2023-4455

  Cross-Site Request Forgery (CSRF) in wallabag/wallabag

  wallabag · wallabag/wallabag

  Medium6.5
• CVE-2023-4454

  Cross-Site Request Forgery (CSRF) in wallabag/wallabag

  wallabag · wallabag/wallabag

  Medium4.3
• CVE-2023-0734

  Improper Authorization in wallabag/wallabag

  wallabag · wallabag/wallabag

  High7.3
• CVE-2023-0736

  Cross-site Scripting (XSS) - Stored in wallabag/wallabag

  wallabag · wallabag/wallabag

  Medium4.6
• CVE-2023-0735

  Cross-Site Request Forgery (CSRF) in wallabag/wallabag

  wallabag · wallabag/wallabag

  Medium6.5
• CVE-2023-0610

  Improper Authorization in wallabag/wallabag

  wallabag · wallabag/wallabag

  Medium5.4