Login Request a demo
WA
Product
wallabag
by wallabag · last CVE Oct 13, 2026
12
CVEs
0
On KEV
6.5
Max CVSS
1
New 30D
Vulnerabilities12In the news0Timeline
Severity mix
Critical 0High 0Medium 12Low 0
Severity
All severities12Critical0High0Medium12Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add wallabag to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2023-0737
6.5
0%
Nov 15
wallabag version 2.5.2 contains a Cross-Site Request Forgery (CSRF) vulnerability that allows attackers to arbitrarily delete user accounts via the /account/delete endpoint
Affected: 2.5.2
CVE-2023-4455
6.5
0%
Aug 21
Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.6.3
Affected: before 2.6.3
CVE-2023-3566
6.5
1%
Jul 10
A vulnerability was found in wallabag 2.5.4
Affected: 2.5.4
CVE-2023-0735
6.5
0%
Feb 7
Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.5.4
Affected: before 2.5.4
CVE-2026-82081
6.4
0%
Aug 28
wallabag 2 through 2.6.14 allows SSRF because a crafted title or content field is mishandled during PDF export
Affected: 2.0.0 through 2.6.14
CVE-2023-4454
5.7
0%
Aug 21
Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.6.3
Affected: before 2.6.3
CVE-2026-110228
5.4
0%
Oct 13
wallabag 2.6.13 through 2.6.14 Stored XSS via Failed HTML Import Upload
Affected: 2.6.13 through 2.6.14
CVE-2023-0736
5.4
0%
Feb 7
Cross-site Scripting (XSS) - Stored in GitHub repository wallabag/wallabag prior to 2.5.4
Affected: before 2.5.4
CVE-2023-0734
5.3
0%
Mar 5
Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.4
Affected: before 2.5.4
CVE-2023-0610
4.3
0%
Feb 1
Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3
Affected: before 2.5.3
CVE-2023-0609
4.3
1%
Feb 1
Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3
Affected: before 2.5.3
CVE-2018-11352
4.0
1%
Sep 21
The Wallabag application 2.2.3 to 2.3.2 is affected by one cross-site scripting (XSS) vulnerability that is stored within the configuration page
Affected: 2.2.3 through 2.3.2
Showing 12