https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T14:27:51.636971+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-61638 CVE-2026-61638 — Wallos: SSRF via Test Email Notification - unvalidated SMTP host/port 2026-10-07T14:27:51.652698+00:00

Affected: ellite Wallos

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, POST /endpoints/notifications/testemailnotifications.php accepts smtpaddress and smtpport from POST body with zero SSRF validation. PHPMailer connects to attacker-supplied host:port. Every other notification endpoint uses ssrf_helper.php but email was missed. Any authenticated user can probe internal network, cloud metadata. This issue has been patched in version 4.9.6.