CVE-2026-82089
Cross‑Site Scripting via Untrusted API Response in Wallabag Android App
The wallabag (aka fr.gaulupeau.apps.InThePoche) application through 2.6.0 for Android allows XSS because /api/entries data is loaded into a WebView.
CVSS 4.0 · 8.8 High
EPSS < 1%
KEV · Not listed
Vendors
Products