Vulnerabilities in ellite
27 resultsCVE-2026-33417MEDIUMWallos: Password Reset Tokens Never ExpireEPSS 0.3%CVE-2026-50199MEDIUMWallos: Cross-user Fixer/API Layer credential consumption in exchange-rate refreshEPSS 0.3%CVE-2026-41688HIGHIncomplete fix for CVE-2026-33399: SSRF in WallosEPSS 0.2%CVE-2026-54599HIGHWallos: OIDC state parameter never validated — login CSRF / account takeoverEPSS 0.2%CVE-2026-41687MEDIUMWallos: SSRF CGNAT Bypass in subscription/payments Logo URL — is_cgnat_ip() Not Used in Inline ChecksEPSS 0.2%CVE-2026-33400MEDIUMWallos: Stored cross-site scripting (XSS) vulnerability in the payment method rename endpointEPSS 0.2%CVE-2026-41689MEDIUMWallos: Shared local webhook allowlist lets low-privilege users send arbitrary requests to allowlisted internal servicesEPSS 0.2%