5971 matches found
ECHO-66D7-E273-5F0F
Bulletin has no description...
ECHO-AA38-89D5-F024
Bulletin has no description...
ALSA-2026:59737 Important: kernel-rt security, bug fix, and enhancement update
The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fixes: kernel: sctp: purge outqueue on stale COOKIE-ECHO handling CVE-2026-52924 kernel: scsi: target: iscsi: Validate CHAPR length before base64...
mediasoup: SCTP state cookie lacks cryptographic authentication, enabling unauthorized association establishment (RFC 9260 violation)
Summary mediasoup's built-in SCTP stack introduced in v3.20.0 authenticates SCTP state cookies using only hardcoded magic byte sequences rather than a per-instance HMAC keyed with a secret, violating RFC 9260 Section 5.1.3. An on-path attacker targeting a PlainTransport with SCTP enabled and no...
GHSA-VFP3-V2GW-7WFQ Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files
Summary Echo's router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path preserving %2F as-is, while StaticDirectoryHandler unescapes %2F to / before resolving filesystem paths. This allows an attacker to bypass route-level access controls...
EUVD-2026-39800
Echo: Encoded slash %2F bypasses route-level protection and exposes static files...
Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files
Summary Echo's router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path preserving %2F as-is, while StaticDirectoryHandler unescapes %2F to / before resolving filesystem paths. This allows an attacker to bypass route-level access controls...
CVE-2026-79661: Allocation of Resources Without Limits or Throttling
Ech0 through 4.5.6 registers the PUT /api/echo/like/:id endpoint on the public router group without authentication or rate limiting. Unauthenticated attackers can increment the favcount counter of any echo including private echoes by supplying its UUID, which can be harvested from the public GET...
CVE-2026-79668: Missing Authentication for Critical Function
Ech0 before 4.7.3 contains an authentication bypass vulnerability in the PUT /api/echo/like/:id endpoint that allows unauthenticated attackers to increment engagement metrics without identity verification or rate limiting. Attackers can send repeated requests to arbitrarily inflate the favcount...
SUSE SLES12 Security Update : kernel (Live Patch 71 for SUSE Linux Enterprise 12 SP5) (SUSE-SU-2026:3706-1)
The remote SUSE Linux SLES12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3706-1 advisory. This update for the SUSE Linux Enterprise Kernel 4.12.14-122.269 fixes various security issues: The following security issues were fixed: -...
CVE-2026-55663: Insufficient Verification of Data Authenticity
mediasoup is a WebRTC video conferencing system. From version 3.20.0 until 3.20.6 for the npm package and from 0.22.0 until 0.22.5 for the Rust crate, mediasoup's built-in SCTP stack authenticates state cookies using only the hardcoded msworker and 0xAD81 magic values instead of a per-instance...
ECHO-B159-47C9-E4C0
Bulletin has no description...
ECHO-F527-DF54-BB49
Bulletin has no description...
ECHO-25A6-FC70-1477
Bulletin has no description...
ECHO-4020-D607-EA47
Bulletin has no description...
ECHO-0FFE-8D46-73CA
Bulletin has no description...
ECHO-F83A-F1A3-51C1 The CVE has been rejected by the assigning CNA (Red Hat, CVSS 0.0): per upstream security policy binutils treats its input as trusted, so no security boundary is crossed. No fix exists upstream or in any Debian suite.
Bulletin has no description...
ECHO-929C-25C5-F964
Bulletin has no description...