cve.bz

open-wanderer wanderer vulnerabilities, newest first

Filter

By year: all 2026 2025 2024 2023 2022 2021

  1. 10.0CVE-2026-71495EPSS 0.3%

    Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.20.0, when PUBLIC_PRIVATE_INSTANCE is not set to true, the unauthenticated POST /api/v1/trail/download handler passes the attacker-controlled JSON url f…

  2. 7.6CVE-2026-62346EPSS 0.3%

    Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.19.3, an authenticated local user can submit crafted waypoint.name and waypoint.icon values that the trail elevation graph interpolates into an innerHTM…

  3. 7.6CVE-2026-62345EPSS 0.3%

    Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.19.3, an authenticated user can store a crafted waypoint.icon value that createMarkerFromWaypoint() passes into FontawesomeMarker, where insertAdjacentH…

  4. 7.5CVE-2026-62344EPSS 0.3%

    Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.19.3, the unauthenticated GET /activitypub/trail/{id} and GET /activitypub/comment/{id} endpoints call ActivitypubTrail() and ActivitypubComment() to re…