WA
Vendor
wallabag
13
CVEs
0
On KEV
1
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-110228 | WA wallabag wallabag | 5.4 | Oct 13 | wallabag 2.6.13 through 2.6.14 Stored XSS via Failed HTML Import Upload |
| CVE-2026-82089 | AN android-app wallabag | 8.8 | Aug 28 | The wallabag (aka fr.gaulupeau.apps.InThePoche) application through 2.6.0 for Android allows XSS because /api/entries data is loaded into a WebView |
| CVE-2026-82081 | WA wallabag wallabag | 6.4 | Aug 28 | wallabag 2 through 2.6.14 allows SSRF because a crafted title or content field is mishandled during PDF export |
| CVE-2023-0737 | WA Wallabag Wallabag | 6.5 | Nov 15 | wallabag version 2.5.2 contains a Cross-Site Request Forgery (CSRF) vulnerability that allows attackers to arbitrarily delete user accounts via the /account/delete endpoint |
| CVE-2023-4455 | WA Wallabag Wallabag | 6.5 | Aug 21 | Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.6.3 |
| CVE-2023-4454 | WA Wallabag Wallabag | 5.7 | Aug 21 | Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.6.3 |
| CVE-2023-3566 | WA Wallabag Wallabag | 6.5 | Jul 10 | A vulnerability was found in wallabag 2.5.4 |
| CVE-2023-0734 | WA Wallabag Wallabag | 5.3 | Mar 5 | Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.4 |
| CVE-2023-0736 | WA Wallabag Wallabag | 5.4 | Feb 7 | Cross-site Scripting (XSS) - Stored in GitHub repository wallabag/wallabag prior to 2.5.4 |
| CVE-2023-0735 | WA Wallabag Wallabag | 6.5 | Feb 7 | Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.5.4 |
| CVE-2023-0610 | WA Wallabag Wallabag | 4.3 | Feb 1 | Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3 |
| CVE-2023-0609 | WA Wallabag Wallabag | 4.3 | Feb 1 | Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3 |
| CVE-2018-11352 | WA Wallabag Wallabag | 4.0 | Sep 21 | The Wallabag application 2.2.3 to 2.3.2 is affected by one cross-site scripting (XSS) vulnerability that is stored within the configuration page |