5815 matches found
ECHO-B87A-6495-4598 Flagged by review on PR #19827: this ID needs a documented disposition here, not silent removal, since the raw scanner (matching on [email protected]'s version string alone) will otherwise keep reporting it as an open finding forever. Upstream's fix (GHSA-gvgg-2r3r-53x7) closes a path where OrganizationMemberResource trusted a client-session note to determine organization membership, letting a crafted note forge an org claim. 25.0.6's OrganizationMembershipMapper does not have that trust path at all — it always re-verifies membership directly against the organization store (provider.getByMember(user)) rather than trusting anything client- or session-supplied. With no client-session-note-based membership check present, the described forgery has no mechanism to exploit here.
Bulletin has no description...
ECHO-DC8F-BECE-24E2
Bulletin has no description...
ECHO-A685-7F88-C69B
Bulletin has no description...
ECHO-A380-E585-5861
Bulletin has no description...
ECHO-7E6C-6FDF-B723
Bulletin has no description...
ECHO-2E54-CE79-4B18
Bulletin has no description...
ECHO-0030-65EC-F55D
Bulletin has no description...
ECHO-6900-BD3B-3EC6
Bulletin has no description...
ECHO-C2E7-D06A-81E1
Bulletin has no description...
ECHO-B76B-475E-7EF9
Bulletin has no description...
ECHO-ADD6-7BB2-F327
Bulletin has no description...
SUSE CVE-2026-55677
Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path preserving %2F as-is, while StaticDirectoryHandler unescapes %2F to / before resolving filesystem paths. This allows an...
ECHO-52F8-53B9-AE20
Bulletin has no description...
ECHO-F6AE-4560-1E3C
Bulletin has no description...
ECHO-9C5B-9FE7-F077
Bulletin has no description...
ECHO-AA1E-733E-C387
Bulletin has no description...
ECHO-961E-FB97-7609
Bulletin has no description...
ECHO-4A45-30EC-EEF0
Bulletin has no description...