Lin-snow Ech0 vulnerabilities

• lin-snow ech0 Ech0 before 4.5.1 Authorization Bypass via Session Tokens CVE-2026-79665 8.7 HighAugust 25, 2026
• lin-snow ech0 Ech0 before 5.0.1 Denial of Service via Accept-Language CVE-2026-79658 8.7 HighAugust 25, 2026
• lin-snow ech0 lin-snow Ech0 crypto.go MD5Encrypt risky encryption CVE-2026-77151 6.3 MediumAugust 20, 2026
• lin-snow ech0 Ech0 before 4.7.3 Access Token Revocation Bypass CVE-2026-79664 Fix available 9.1 CriticalMay 7, 2026
• lin-snow ech0 Ech0 before 4.7.3 OAuth Redirect URI Validation Bypass CVE-2026-79662 Fix available 8.8 HighMay 7, 2026
• lin-snow ech0 Ech0 before 4.7.3 Server-Side Request Forgery via fetchPeerConnectInfo CVE-2026-79659 Fix available 8.3 HighMay 7, 2026
• lin-snow ech0 Ech0 before 4.7.3 Unauthenticated fav_count Modification CVE-2026-79661 Fix available 6.9 MediumMay 7, 2026
• lin-snow ech0 Ech0 before 4.7.3 Unauthenticated Like Endpoint Metric Inflation CVE-2026-79668 Fix available 6.9 MediumMay 7, 2026
• lin-snow ech0 Ech0 before 4.7.3 Stored XSS via RSS feed tag names CVE-2026-79663 Fix available 4.8 MediumMay 7, 2026
• lin-snow ech0 Ech0 before 4.7.3 Email Disclosure via Public API CVE-2026-79660 Fix available 6.9 MediumMay 7, 2026
• lin-snow ech0 Ech0 before 4.4.3 Stored XSS via SVG Upload CVE-2026-79670 Fix available 4.8 MediumApril 10, 2026
• lin-snow ech0 Ech0 before 4.4.3 SSRF via DNS Resolution Bypass CVE-2026-79671 Fix available 5.1 MediumApril 10, 2026
• lin-snow ech0 Ech0 before 4.4.3 Missing Authorization on System Logs CVE-2026-79669 Fix available 5.3 MediumApril 10, 2026
• lin-snow ech0 Ech0 before 4.4.3 Authentication Bypass via Comment Panel CVE-2026-79672 Fix available 7.0 HighApril 10, 2026
• lin-snow ech0 Ech0 before 4.4.3 Scope Bypass via profile:read Token CVE-2026-79673 Fix available 8.5 HighApril 10, 2026
• lin-snow ech0 Ech0 before 4.4.3 Missing Authorization via dashboard log endpoints CVE-2026-79666 Fix available 7.1 HighApril 10, 2026
• lin-snow ech0 Ech0 before 4.4.3 Authentication Bypass via Scope Enforcement CVE-2026-79667 Fix available 7.2 HighApril 10, 2026
• ech0 Ech0 affected by unauthenticated SSRF in GetWebsiteTitle allows access to internal services and cloud metadata CVE-2026-35037 Public exploitFix available 7.2 HighApril 3, 2026
• ech0 Ech0 Affected by Unauthenticated Server-Side Request Forgery in Website Preview Feature CVE-2026-35036 Fix available 7.5 HighApril 3, 2026
• ech0 Ech0 authenticated user-list exposed data via public `/api/allusers` endpoint CVE-2026-33638 Fix available 5.3 MediumMarch 24, 2026