CVE-2026-118657 Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.Scheme unconditionally trusts forwarded scheme headers from any client. A client that reaches Echo directly over plaintext HTTP can claim an HTTPS scheme and bypass HTTPSRedirect because the request is treated as already secure...

CVE-2026-118657 Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.Scheme unconditionally trusts forwarded scheme headers from any client. A client that reaches Echo directly over plaintext HTTP can claim an HTTPS scheme and bypass HTTPSRedirect because the request is treated as already secure...

CVE-2026-118657

The Echo Go web framework (versions prior to 4.16.0 and 5.4.0 ) is vulnerable to an HTTPS redirect and HSTS bypass because Context.Scheme unconditionally trusts forwarded scheme headers from any client. An attacker can bypass HTTPSRedirect by claiming an HTTPS scheme over plaintext HTTP, or suppr...

Security Bulletin: This Power System update is being released to address CVE-2026-17427

Summary The BMC's HTTPS service allows unauthenticated attackers to crash the BMC's HTTPS service, resulting in denial of service. Vulnerability Details CVEID:CVE-2026-17427 DESCRIPTION: OPENBMC could allow a remote attacker to cause a denial of service due to improper validation of input length...

Security Bulletin: This Power System update is being released to address CVE-2026-16697

Summary The BMC's HTTPS service allows unauthenticated attackers to crash the BMC, resulting in denial of service. Vulnerability Details CVEID:CVE-2026-16697 DESCRIPTION: OPENBMC could allow a remote attacker to cause a denial of service due to improper restriction of excessive computational...

GHSA-6PQ8-JHM2-2VCW vulnerabilities

Vulnerabilities for packages: unleash-proxy, opensearch-dashboards, json-server, wazuh-dashboard, http-https-echo, dotstatsuite-supercore, renovate, unleash-fips, prism, azurite, http-https-echo-fips, eco-jess, arangodb, gitlab-rails-ce, wazuh-dashboard-fips, unleash...

CVE-2026-110816 vulnerabilities

Vulnerabilities for packages: unleash-proxy, opensearch-dashboards, json-server, wazuh-dashboard, http-https-echo, dotstatsuite-supercore, renovate, unleash-fips, prism, azurite, http-https-echo-fips, eco-jess, arangodb, gitlab-rails-ce, wazuh-dashboard-fips, unleash...

Malicious code in csvflow-schema (npm)

csvflow-schema is described as a "Lightweight CSV column-schema validation helper" index.js exports a small validateSchema function and adds a postinstall script that runs node ./postinstall.js on npm install. postinstall.js writes the username, hostname, working directory, parent process id and...

Malicious code in spectral-net-probe (npm)

spectral-net-probe has no functional code. Versions 1.0.1 and 1.0.4 have a postinstall script that runs node index.js on npm install, which sends an HTTPS GET to a Cloudflare quick tunnel https://nobody-johnston-with-enabling.trycloudflare.com/aa?x=1 and...

MAL-2026-18368 Malicious code in spectral-net-probe (npm)

spectral-net-probe has no functional code. Versions 1.0.1 and 1.0.4 have a postinstall script that runs node index.js on npm install, which sends an HTTPS GET to a Cloudflare quick tunnel https://nobody-johnston-with-enabling.trycloudflare.com/aa?x=1 and...

KaringX clashmi encryption issue vulnerability

Versions KaringX clashmi 1.0.32.1801 and earlier contain an encryption vulnerability. This vulnerability stems from the default disabling of TLS certificate validation within the HttpUtils helper program. Attackers can exploit this by providing any certificate to intercept HTTPS traffic. They can...

LabStack Echo input validation error vulnerability

Versions of LabStack Echo prior to 4.16.0 and from 5.0.0 up to 5.4.0 contain an input validation error vulnerability. This vulnerability arises because Context.Scheme unconditionally trusts protocol headers forwarded by any client, potentially allowing attackers to bypass HTTPS Redirects by...

CVE-2026-118682: KaringX clashmi: KaringX ClashMi through 1.0.32.1801 disables TLS certificate validation by default in the HttpUtils helper, allowing…

KaringX ClashMi through 1.0.32.1801 disables TLS certificate validation by default in the HttpUtils helper, allowing attackers to intercept HTTPS traffic by presenting any certificate. Attackers operating the user's proxy node can serve a forged update manifest omitting sha256 to deliver a...

PT-2026-129191

KaringX ClashMi through 1.0.32.1801 disables TLS certificate validation by default in the HttpUtils helper, allowing attackers to intercept HTTPS traffic by presenting any certificate. Attackers operating the user's proxy node can serve a forged update manifest omitting sha256 to deliver a...

SUSE CVE-2026-115570

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 42.11.16, 43.8.1, 44.9.1, and 45.0.0-beta.6, Electron does not block compromised eMudhra intermediate certificates in Chromium networking, Node.js tls, Node.js https, or Node.js fetch...

CVE-2026-106174

A improper locking vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.4 through 7.6.6 may allow an unauthenticated attacker with network access to the device to cause a denial of service of the HTTPS management interface via crafted HTTP requests...

CVE-2026-106174

A improper locking vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.4 through 7.6.6 may allow an unauthenticated attacker with network access to the device to cause a denial of service of the HTTPS management interface via crafted HTTP requests...

CVE-2026-106174

A improper locking vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.4 through 7.6.6 may allow an unauthenticated attacker with network access to the device to cause a denial of service of the HTTPS management interface via crafted HTTP requests...

EUVD-2026-110616

A improper locking vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.4 through 7.6.6 may allow an unauthenticated attacker with network access to the device to cause a denial of service of the HTTPS management interface via crafted HTTP requests...

CVE-2026-106174

An improper locking vulnerability in Fortinet FortiOS versions 8.0.0 and 7.6.4 through 7.6.6 allows an unauthenticated attacker with network access to the device to cause a denial of service (DoS) of the HTTPS management interface . This can be triggered by sending crafted HTTP requests to the af...