https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 18:34:13 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-362444 EUVD-2026-362444 https://cve.radiocsirt.org/vuln/euvd-2026-362444 https://cve.radiocsirt.org/vuln/fkie_cve-2026-54599 <p>Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, login.php generates an OIDC state nonce stored in $_SESSION[&#39;oidc_state&#39;], but checksession.php dispatches the OIDC callback without comparing the incoming state against the session value. An attacker can trick a victim into visiting a crafted URL, causing Wallos to exchange the attacker&#39;s authorization code and log the victim into the attacker&#39;s account. This issue has been patched in version 4.9.4.</p> <p>Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, login.php generates an OIDC state nonce stored in $_SESSION[&#39;oidc_state&#39;], but checksession.php dispatches the OIDC callback without comparing the incoming state against the session value. An attacker can trick a victim into visiting a crafted URL, causing Wallos to exchange the attacker&#39;s authorization code and log the victim into the attacker&#39;s account. This issue has been patched in version 4.9.4.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-54599