https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T08:10:04.955636+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-362377 EUVD-2026-362377 2026-10-06T08:10:04.957935+00:00 EUVD-2026-362377 https://cve.radiocsirt.org/vuln/fkie_cve-2026-61638 fkie_cve-2026-61638 2026-10-06T08:10:04.957967+00:00

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, POST /endpoints/notifications/testemailnotifications.php accepts smtpaddress and smtpport from POST body with zero SSRF validation. PHPMailer connects to attacker-supplied host:port. Every other notification endpoint uses ssrf_helper.php but email was missed. Any authenticated user can probe internal network, cloud metadata. This issue has been patched in version 4.9.6.