6081 matches found
PT-2026-41607
Summary No authentication is required to invoke PUT /api/echo/like/:id. The handler is registered on the public router group. The service increments fav count for the given echo without checking identity, without a per-user limit, and without CSRF tokens. A remote client can arbitrarily inflate...
PT-2026-41606
Summary PUT /api/echo/like/:id at internal/router/echo.go:12 is registered on PublicRouterGroup with no authentication and no rate limit. Anonymous callers increment the fav count counter on any echo including private echoes by UUID, repeat the request without deduplication, and trigger a databas...
ECHO-B87E-1220-0565 Kernel vulnerabilities are irrelevant in container environments.
Bulletin has no description...
ECHO-0EC8-B04E-F14B Kernel vulnerabilities are irrelevant in container environments.
Bulletin has no description...
ECHO-C5B6-7968-60AF
Bulletin has no description...
ECHO-CDF4-0E18-2536
Bulletin has no description...
ECHO-F356-2B11-6F16
Bulletin has no description...
ECHO-C647-D5FA-C4ED
Bulletin has no description...
ECHO-2E8D-40A9-3AD3
Bulletin has no description...
CVE-2026-43137 ASoC: SOF: Intel: hda: Fix NULL pointer dereference
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Intel: hda: Fix NULL pointer dereference If there's a mismatch between the DAI links in the machine driver and the topology, it is possible that the playback/capture widget is not set, especially in the case of loopbac...
PT-2026-37477
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference can occur in the ASoC SOF Intel hda component. This happens when there is a mismatch between the DAI links in the machine driver and the topology, which may...
AVideo: Unauthenticated Disclosure of CloneSite `myKey` via Error Echo in `cloneClient.json.php` Enables Cross-Site DB Dump of the Configured Clone Server
Summary plugin/CloneSite/cloneClient.json.php echoes the local CloneSite shared secret $objClone-myKey, a constant md5$global'systemRootPath' . $global'salt' into the HTTP response body on every unauthenticated request. The unauthenticated error branch was intended to reject non-admin callers...
GHSA-QM9P-P5PW-JRX2 AVideo: Unauthenticated Disclosure of CloneSite `myKey` via Error Echo in `cloneClient.json.php` Enables Cross-Site DB Dump of the Configured Clone Server
Summary plugin/CloneSite/cloneClient.json.php echoes the local CloneSite shared secret $objClone-myKey, a constant md5$global'systemRootPath' . $global'salt' into the HTTP response body on every unauthenticated request. The unauthenticated error branch was intended to reject non-admin callers...
ECHO-E568-958C-EC51
Bulletin has no description...
ECHO-6551-DA8D-A4B8
Bulletin has no description...
ECHO-B229-8FDA-451C The vulnerable OIDC userinfo cache (token[:20] as cache key) was introduced in v1.80.8 via commit 4d13035. Our package is v1.78.0, which predates this feature entirely. The true affected range is >= 1.80.8, < 1.83.0. https://github.com/BerriAI/litellm/security/advisories/GHSA-jjhc-v7c2-5hh6 https://github.com/BerriAI/litellm/commit/4d13035bf9153efb34466336d63d1aa4489a6252
Bulletin has no description...
ECHO-F909-9693-1F3F
Bulletin has no description...
ECHO-D87E-E10C-F209
Bulletin has no description...