Skip to content
OpenAdvisories

Vendor

walinejs

3 known vulnerabilities.

Products

waline 3
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 6.5
    CVE-2026-55369

    Waline login accepts a non-string email as a match-all MongoDB query

    Waline is a comment system with backend support. Prior to version 1.41.1, the login endpoint POST /api/token reads the email field from the request body without checking its type and passes it straight into the MongoDB storage query. When email is not a strin…

    walinejs waline @waline/vercel npm