Skip to content
OpenAdvisories

Vendor

open-wanderer

4 known vulnerabilities.

Products

wanderer 4
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.6
    CVE-2026-62346

    Wanderer: Stored XSS via waypoint.name and waypoint.icon in Elevation Profile innerHTML

    Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.19.3, an authenticated local user can submit crafted waypoint.name and waypoint.icon values that the trail elevation graph interpolates into an innerHTML template in web/sr…

    open-wanderer wanderer
  • High 7.6
    CVE-2026-62345

    Stored XSS via Unsanitized waypoint.icon in Map Marker (insertAdjacentHTML)

    Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.19.3, an authenticated user can store a crafted waypoint.icon value that createMarkerFromWaypoint() passes into FontawesomeMarker, where insertAdjacentHTML inserts the unva…

    open-wanderer wanderer
  • High 7.5
    CVE-2026-62344

    Wanderer: Unauthenticated Access to Private Trails and Comments via ActivityPub Endpoints

    Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.19.3, the unauthenticated GET /activitypub/trail/{id} and GET /activitypub/comment/{id} endpoints call ActivitypubTrail() and ActivitypubComment() to return full trail and …

    open-wanderer wanderer