Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, testwebhooknotifications.php does not validate the target URL against private/reserved IP ranges, enabling full-read SSRF. The server response is returned to the caller. This issue has been patched in version 4.6.2.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-30839 Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, testwebhooknotifications.php does not validate the target URL against p… https://www.cve.org/CVERecord?id=CVE-2026-30839
Post summary
The statement briefly discloses that Wallos pre‑4.6.2 lacks target‑URL validation in testwebhooknotifications.php for CVE‑2026‑30839, but offers no details on exploitation, mitigation, or a PoC.
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-30839 - Wallos: SSRF via webhook test endpoint Intel Report: https://ift.tt/YKrQAki
Post summary
The post announces CVE-2026-30839 as an SSRF vulnerability in Wallos via the webhook test endpoint and references an intel report.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | wallosapp | wallos | - | - | - |