What’s Vulnerable › Products
lin-snow Ech0 vulnerabilities
20 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 20 published in the last 12 months.
Check whether your lin-snow Ech0 version is affected
Latest lin-snow Ech0 vulnerabilities
- CVE-2026-79673 — Ech0 before 4.4.3 Scope Bypass via profile:read Token (CVSS 6.5)
- CVE-2026-79672 — Ech0 before 4.4.3 Authentication Bypass via Comment Panel (CVSS 5.5)
- CVE-2026-79671 — Ech0 before 4.4.3 SSRF via DNS Resolution Bypass (CVSS 5.5)
- CVE-2026-79670 — Ech0 before 4.4.3 Stored XSS via SVG Upload (CVSS 4.8)
- CVE-2026-79669 — Ech0 before 4.4.3 Missing Authorization on System Logs (CVSS 4.3)
- CVE-2026-79668 — Ech0 before 4.7.3 Unauthenticated Like Endpoint Metric Inflation (CVSS 5.3)
- CVE-2026-79667 — Ech0 before 4.4.3 Authentication Bypass via Scope Enforcement (CVSS 7.6)
- CVE-2026-79666 — Ech0 before 4.4.3 Missing Authorization via dashboard log endpoints (CVSS 6.5)
- CVE-2026-79665 — Ech0 before 4.5.1 Authorization Bypass via Session Tokens (CVSS 8.8)
- CVE-2026-79664 — Ech0 before 4.7.3 Access Token Revocation Bypass (CVSS 7.4)
- CVE-2026-79663 — Ech0 before 4.7.3 Stored XSS via RSS feed tag names (CVSS 4.8)
- CVE-2026-79662 — Ech0 before 4.7.3 OAuth Redirect URI Validation Bypass (CVSS 8.0)
- CVE-2026-79661 — Ech0 before 4.7.3 Unauthenticated fav_count Modification (CVSS 6.5)
- CVE-2026-79660 — Ech0 before 4.7.3 Email Disclosure via Public API (CVSS 5.3)
- CVE-2026-79659 — Ech0 before 4.7.3 Server-Side Request Forgery via fetchPeerConnectInfo (CVSS 7.7)
- CVE-2026-79658 — Ech0 before 5.0.1 Denial of Service via Accept-Language (CVSS 7.5)
- CVE-2026-77151 — lin-snow Ech0 crypto.go MD5Encrypt risky encryption (CVSS 3.7)
- CVE-2026-35037 — Ech0 affected by unauthenticated SSRF in GetWebsiteTitle allows access to internal services and cloud metadata (CVSS 7.2)
- CVE-2026-35036 — Ech0 Affected by Unauthenticated Server-Side Request Forgery in Website Preview Feature (CVSS 7.5)
- CVE-2026-33638 — Ech0 authenticated user-list exposed data via public `/api/allusers` endpoint (CVSS 5.3)