https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T18:21:13.402511+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-363202 EUVD-2026-363202 2026-10-05T18:21:13.435565+00:00 EUVD-2026-363202 https://cve.radiocsirt.org/vuln/fkie_cve-2026-61640 fkie_cve-2026-61640 2026-10-05T18:21:13.435600+00:00

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, Admin-configured OIDC token_url and user_info_url in includes/oidc/handle_oidc_callback.php:18-49 are used directly in curl_init() with zero SSRF filtering. Unlike logo/webhook URLs which have validate_webhook_url_for_ssrf(), OIDC URLs bypass all protections. Admin sets URL to http://169.254.169.254/latest/meta-data/ for cloud metadata access or internal network pivoting. This issue has been patched in version 4.9.6.