CVE-2026-77353

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0 , authenticated users could inject arbitrary iCalendar properties and events into their exported .ics feed by embedding raw CRLF sequences in subscription names or notes. The root cause is that the input...