https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 17:30:43 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-363586 EUVD-2026-363586 https://cve.radiocsirt.org/vuln/euvd-2026-363586 https://cve.radiocsirt.org/vuln/fkie_cve-2026-77348 <p>Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, the fix for CVE-2026-33407 (GHSA-hhjq-82f8-m6rc, &#34;SSRF via HTTP Proxy Environment Variable&#34;) hardened endpoints/logos/search.php by disabling cURL proxying (CURLOPT_PROXY = &#39;&#39; + CURLOPT_NOPROXY = &#39;*&#39;). However, Wallos ships a second, near-identical, unauthenticated logo-image search endpoint — endpoints/payments/search.php — that was not given the same hardening. It still passes the HTTP_PROXY/HTTPS_PROXY environment variable straight into CURLOPT_PROXY. This issue has been patched in version 5.0.0.</p> <p>Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, the fix for CVE-2026-33407 (GHSA-hhjq-82f8-m6rc, &#34;SSRF via HTTP Proxy Environment Variable&#34;) hardened endpoints/logos/search.php by disabling cURL proxying (CURLOPT_PROXY = &#39;&#39; + CURLOPT_NOPROXY = &#39;*&#39;). However, Wallos ships a second, near-identical, unauthenticated logo-image search endpoint — endpoints/payments/search.php — that was not given the same hardening. It still passes the HTTP_PROXY/HTTPS_PROXY environment variable straight into CURLOPT_PROXY. This issue has been patched in version 5.0.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-77348