Skip to content
OpenAdvisories
High · 8.8 CVE-2026-30840 EUVD-2026-10120

Wallos: Server-Side Request Forgery (SSRF) in Notification Testers

Published Mar 7, 2026 · Updated Mar 9, 2026 · Assigned by GitHub_M

Description

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, there is a server-side request forgery vulnerability in notification testers. This issue has been patched in version 4.6.2.

Affected products

VendorProductAffectedFixed
ellite Wallos < 4.6.2 —

References