agentprime: ellite-wallosEvery new CVE for ellite-wallos.https://agentprime.io/CVE-2026-77353: Wallos: iCalendar Injection via CRLF in Subscription Name/Notes Exporthttps://agentprime.io/advisories/CVE-2026-77353/https://agentprime.io/advisories/CVE-2026-77353/CVSS 4.6 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 31 Aug 2026 21:22:35 GMTCVECVE-2026-77352: Wallos: Authenticated SSRF via per-user SMTP notification host (low-privilege user)https://agentprime.io/advisories/CVE-2026-77352/https://agentprime.io/advisories/CVE-2026-77352/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 31 Aug 2026 21:21:06 GMTCVECVE-2026-77348: Wallos incomplete fix for CVE-2026-33407: unauthenticated httpoxy SSRF still reachable via `endpoints/payments/search.php`https://agentprime.io/advisories/CVE-2026-77348/https://agentprime.io/advisories/CVE-2026-77348/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 31 Aug 2026 21:15:45 GMTCVECVE-2026-77351: Wallos: SSRF via Unvalidated User-Level SMTP Host in Email Notification Settingshttps://agentprime.io/advisories/CVE-2026-77351/https://agentprime.io/advisories/CVE-2026-77351/CVSS 3.5 (Low). Published by the CVE Program. Not analysed by agentprime yet.Mon, 31 Aug 2026 21:15:23 GMTCVECVE-2026-61641: Wallos: OIDC account takeover via email-based account linking without `email_verified` checkhttps://agentprime.io/advisories/CVE-2026-61641/https://agentprime.io/advisories/CVE-2026-61641/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 31 Aug 2026 20:49:46 GMTCVECVE-2026-61640: Wallos: SSRF via OIDC Token/UserInfo URL Configurationhttps://agentprime.io/advisories/CVE-2026-61640/https://agentprime.io/advisories/CVE-2026-61640/CVSS 8.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 31 Aug 2026 20:47:39 GMTCVECVE-2026-61639: Wallos: Zip Slip path traversal in database restore writes files to webroothttps://agentprime.io/advisories/CVE-2026-61639/https://agentprime.io/advisories/CVE-2026-61639/CVSS 8.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 31 Aug 2026 20:44:05 GMTCVECVE-2026-61638: Wallos: SSRF via Test Email Notification - unvalidated SMTP host/porthttps://agentprime.io/advisories/CVE-2026-61638/https://agentprime.io/advisories/CVE-2026-61638/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 31 Aug 2026 20:41:04 GMTCVECVE-2026-54600: Wallos: Unauthenticated database replacement via import endpoint on fresh installhttps://agentprime.io/advisories/CVE-2026-54600/https://agentprime.io/advisories/CVE-2026-54600/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 31 Aug 2026 20:32:58 GMTCVECVE-2026-54599: Wallos: OIDC state parameter never validated — login CSRF / account takeoverhttps://agentprime.io/advisories/CVE-2026-54599/https://agentprime.io/advisories/CVE-2026-54599/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 31 Aug 2026 20:30:30 GMTCVECVE-2026-54598: Missing Authentication for Critical Function in walloshttps://agentprime.io/advisories/CVE-2026-54598/https://agentprime.io/advisories/CVE-2026-54598/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 31 Aug 2026 20:28:17 GMTCVECVE-2026-50199: Wallos: Cross-user Fixer/API Layer credential consumption in exchange-rate refreshhttps://agentprime.io/advisories/CVE-2026-50199/https://agentprime.io/advisories/CVE-2026-50199/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 31 Aug 2026 20:25:41 GMTCVECVE-2026-50198: Wallos: Cross-user subscription cost inference via replacement_subscription_idhttps://agentprime.io/advisories/CVE-2026-50198/https://agentprime.io/advisories/CVE-2026-50198/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 31 Aug 2026 20:25:20 GMTCVECVE-2026-41689: Wallos: Shared local webhook allowlist lets low-privilege users send arbitrary requests to allowlisted internal serviceshttps://agentprime.io/advisories/CVE-2026-41689/https://agentprime.io/advisories/CVE-2026-41689/CVSS 6.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 07 May 2026 13:53:12 GMTCVECVE-2026-41688: Incomplete fix for CVE-2026-33399: SSRF in Walloshttps://agentprime.io/advisories/CVE-2026-41688/https://agentprime.io/advisories/CVE-2026-41688/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 07 May 2026 13:52:00 GMTCVECVE-2026-41687: Wallos: SSRF CGNAT Bypass in subscription/payments Logo URL — is_cgnat_ip() Not Used in Inline Checkshttps://agentprime.io/advisories/CVE-2026-41687/https://agentprime.io/advisories/CVE-2026-41687/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 07 May 2026 13:48:43 GMTCVECVE-2026-33417: Wallos: Password Reset Tokens Never Expirehttps://agentprime.io/advisories/CVE-2026-33417/https://agentprime.io/advisories/CVE-2026-33417/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 24 Mar 2026 18:01:07 GMTCVECVE-2026-33401: Wallos: Incomplete fix for CVE-2026-30840 - SSRF in AI and notification endpoints bypass ssrf_helper.phphttps://agentprime.io/advisories/CVE-2026-33401/https://agentprime.io/advisories/CVE-2026-33401/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 24 Mar 2026 17:58:47 GMTCVECVE-2026-33400: Wallos: Stored cross-site scripting (XSS) vulnerability in the payment method rename endpointhttps://agentprime.io/advisories/CVE-2026-33400/https://agentprime.io/advisories/CVE-2026-33400/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 24 Mar 2026 17:45:27 GMTCVECVE-2026-33399: Wallos: SSRF Bypass - Incomplete Fix for CVE-2026-30839/30840https://agentprime.io/advisories/CVE-2026-33399/https://agentprime.io/advisories/CVE-2026-33399/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 24 Mar 2026 17:43:52 GMTCVECVE-2026-33407: Wallos: SSRF via HTTP Proxy Environment Variablehttps://agentprime.io/advisories/CVE-2026-33407/https://agentprime.io/advisories/CVE-2026-33407/CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 24 Mar 2026 17:40:58 GMTCVECVE-2026-30842: Wallos: Authenticated Missing Authorization Allows Deletion of Other Users’ Uploaded Avatarshttps://agentprime.io/advisories/CVE-2026-30842/https://agentprime.io/advisories/CVE-2026-30842/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sat, 07 Mar 2026 05:41:54 GMTCVECVE-2026-30841: Wallos: Reflected XSS via unescaped token and email parameters in passwordreset.phphttps://agentprime.io/advisories/CVE-2026-30841/https://agentprime.io/advisories/CVE-2026-30841/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sat, 07 Mar 2026 05:40:58 GMTCVECVE-2026-30840: Wallos: Server-Side Request Forgery (SSRF) in Notification Testershttps://agentprime.io/advisories/CVE-2026-30840/https://agentprime.io/advisories/CVE-2026-30840/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Sat, 07 Mar 2026 05:39:40 GMTCVECVE-2026-30839: Wallos: SSRF via webhook test endpointhttps://agentprime.io/advisories/CVE-2026-30839/https://agentprime.io/advisories/CVE-2026-30839/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sat, 07 Mar 2026 05:29:55 GMTCVECVE-2026-30828: Wallos: SSRF via url parameter leading to File Traversalhttps://agentprime.io/advisories/CVE-2026-30828/https://agentprime.io/advisories/CVE-2026-30828/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Sat, 07 Mar 2026 05:27:13 GMTCVECVE-2026-27479: Wallos: SSRF via Redirect Bypass in Logo/Icon URL Fetchhttps://agentprime.io/advisories/CVE-2026-27479/https://agentprime.io/advisories/CVE-2026-27479/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Sat, 21 Feb 2026 08:15:19 GMTCVE