XSS in Wallabag Android-App

CVE-2026-82089

The wallabag (aka fr.gaulupeau.apps.InThePoche) application through 2.6.0 for Android allows XSS because /api/entries data is loaded into a WebView.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.003 (25.1th percentile) — read the EPSS interpretation.