https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T17:00:33.167527+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-33407 CVE-2026-33407 — Wallos: SSRF via HTTP Proxy Environment Variable 2026-10-06T17:00:33.197610+00:00

Affected: ellite Wallos

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.0, Wallos endpoints/logos/search.php accepts HTTP_PROXY and HTTPS_PROXY environment variables without validation, enabling SSRF via proxy hijacking. The server performs DNS resolution on user-supplied search terms, which can be controlled by attackers to trigger outbound requests to arbitrary domains. This issue has been patched in version 4.7.0.