5865 matches found
ECHO-50E8-AB97-5CB6
Bulletin has no description...
ECHO-726A-839D-2A72
Bulletin has no description...
ECHO-FD64-9D58-CCCA
Bulletin has no description...
ECHO-C1C4-20A6-4648
Bulletin has no description...
ECHO-DBDC-3FBA-63E2
Bulletin has no description...
ECHO-D290-6F63-5BEF
Bulletin has no description...
ECHO-3C1D-5D50-A591
Bulletin has no description...
ECHO-2628-E128-A8C1
Bulletin has no description...
ECHO-855F-2128-6E3E
Bulletin has no description...
ECHO-7790-2EA8-7D0B
Bulletin has no description...
SUSE CVE-2026-42594
Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, the webhook middleware spawns a goroutine that holds a reference to the request's echo.Context after the synchronous handler returns ErrAsyncProcess and Echo recycles the context back to its sync.Pool. When a concurrent...
SUSE CVE-2026-43644
podinfo through 6.11.2 contains a reflected cross-site scripting vulnerability in the /echo and /api/echo endpoints where the echoHandler writes request body content directly to the response without setting explicit Content-Type or X-Content-Type-Options headers. Attackers can craft cross-origin...
ECHO-2327-9760-E268 Claimed out-of-bounds write in dlx_rtype_to_howto() (bfd/elf32-dlx.c), reached from elf32_dlx_info_to_howto_rel() via the relocation type of a crafted ELF/DLX object. The DLX backend is not built. dlx_elf32_be_vec is selected only by the dlx-*-elf target triple (bfd/config.bfd), and that vec is the sole trigger for compiling elf32-dlx.lo (bfd/configure.ac); debian/rules passes an explicit per-architecture --enable-targets list and never --enable-targets=all. Verified against the shipped amd64 and arm64 debs: libbfd exports no dlx symbols, `objdump -b elf32-dlx` returns "invalid bfd target", `ld -m elf32dlx` is an unrecognised emulation, and a crafted EM_DLX (0x5aa5) object carrying relocation types past the end of the howto table is claimed by the generic elf32-big backend, which reports "architecture: UNKNOWN!" and every relocation as UNKNOWN. The function is never entered. Note that readelf prints DLX machine and relocation names from its own tables, independent of BFD, so its output is not evidence of the backend being present. Upstream also rejects the finding on its merits, even with DLX enabled. On the Red Hat bug that Debian's tracker carries as its only reference, maintainer Andrew Burgess concludes "I don't believe that this is actually a bug": DLX relocation types are a contiguous 0-9, not the non-contiguous space with extended types at 0x10000+ that the advisory describes; dlx_rtype_to_howto() already rejects r_type >= R_DLX_max (10); and types 6-9 have their own case arms, so the indexed access can only ever reach 0-5 of the 6-entry dlx_elf_howto_table. Patrick Monnerat adds that the advisory claims an out-of-bounds write while the procedure performs no indexed write at all. Both observations hold against the 2.45.50.20251201 source. Debian marks it unimportant (binutils not covered by security support) and ships no fix in any suite including forky/sid, so there is nothing to bump.
Bulletin has no description...
CVE-2026-14239 Tourmaster < 5.4.8 - Stored XSS via CSRF
The tourmaster WordPress plugin before 5.4.8 does not perform a nonce check when storing a custom-filter label taken from a request parameter, and does not escape that label when echoing it on the filter admin page, allowing an unauthenticated attacker to trick a logged-in administrator into...
ECHO-5D3C-0210-C193
Bulletin has no description...
ECHO-2055-6C03-D4B2
Bulletin has no description...
ECHO-57C1-ADEA-B0BF
Bulletin has no description...
ECHO-166A-43F5-1C18
Bulletin has no description...