{"items":[{"id":"CVE-2026-118658","published":"2026-10-28T20:17:11.083Z","updated":"2026-11-02T20:44:22.513Z","title":"Echo: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto","severity":"MEDIUM","score":4.7,"vendor":"labstack","product":"echo","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2026-118657","published":"2026-10-28T20:14:09.883Z","updated":"2026-11-03T13:32:02.816Z","title":"Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers","severity":"MEDIUM","score":5.9,"vendor":"labstack","product":"echo","kev":false,"epss":0.00133,"kevAdded":null},{"id":"CVE-2026-118656","published":"2026-10-28T20:12:13.757Z","updated":"2026-10-29T17:23:39.728Z","title":"Echo: Open Redirect via Control-Character Prefix Defeating sanitizeURI","severity":"MEDIUM","score":6.1,"vendor":"labstack","product":"echo","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2026-118655","published":"2026-10-28T20:03:56.897Z","updated":"2026-10-29T18:29:50.622Z","title":"Echo: Static Middleware Double-Unescape Path Traversal","severity":"MEDIUM","score":5.9,"vendor":"labstack","product":"echo","kev":false,"epss":0.00303,"kevAdded":null},{"id":"CVE-2026-118654","published":"2026-10-28T19:59:27.911Z","updated":"2026-11-02T20:43:27.704Z","title":"Echo static file middleware route protection bypass via encoded dot-dot traversal","severity":"MEDIUM","score":5.9,"vendor":"labstack","product":"echo","kev":false,"epss":0.00347,"kevAdded":null},{"id":"CVE-2026-118653","published":"2026-10-28T19:42:05.556Z","updated":"2026-11-02T20:41:49.060Z","title":"Echo: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration","severity":"MEDIUM","score":5.3,"vendor":"labstack","product":"echo","kev":false,"epss":0.00415,"kevAdded":null},{"id":"CVE-2026-118652","published":"2026-10-28T19:35:47.103Z","updated":"2026-11-03T13:27:48.704Z","title":"Echo: Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob","severity":"MEDIUM","score":6.1,"vendor":"labstack","product":"echo","kev":false,"epss":0.00239,"kevAdded":null},{"id":"CVE-2026-118651","published":"2026-10-28T19:30:01.320Z","updated":"2026-10-29T20:53:54.404Z","title":"Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default","severity":"MEDIUM","score":5.3,"vendor":"labstack","product":"echo","kev":false,"epss":0.00207,"kevAdded":null},{"id":"CVE-2026-118650","published":"2026-10-28T19:25:02.952Z","updated":"2026-11-02T20:40:36.530Z","title":"Echo: middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path","severity":"HIGH","score":7.5,"vendor":"labstack","product":"echo","kev":false,"epss":0.00396,"kevAdded":null},{"id":"CVE-2026-118266","published":"2026-10-28T19:21:47.729Z","updated":"2026-11-03T13:26:12.648Z","title":"Echo: CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method","severity":"MEDIUM","score":5.3,"vendor":"labstack","product":"echo","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2026-118265","published":"2026-10-28T19:03:56.934Z","updated":"2026-10-29T20:54:10.718Z","title":"Echo: X-Real-IP extractor trusts the header value instead of the sending peer","severity":"MEDIUM","score":5.3,"vendor":"labstack","product":"echo","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2026-118264","published":"2026-10-28T19:03:01.533Z","updated":"2026-10-30T19:21:07.156Z","title":"Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls","severity":"CRITICAL","score":9.1,"vendor":"labstack","product":"echo","kev":false,"epss":0.0043,"kevAdded":null},{"id":"CVE-2026-118263","published":"2026-10-28T19:01:30.268Z","updated":"2026-11-02T20:38:12.788Z","title":"Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests","severity":"MEDIUM","score":6.3,"vendor":"labstack","product":"echo","kev":false,"epss":0.00385,"kevAdded":null},{"id":"CVE-2026-118262","published":"2026-10-28T19:00:12.315Z","updated":"2026-11-03T13:24:52.129Z","title":"Echo: WebSocket proxy can retain connections and handlers after client disconnect","severity":"HIGH","score":8.2,"vendor":"labstack","product":"echo","kev":false,"epss":0.00302,"kevAdded":null},{"id":"CVE-2026-118261","published":"2026-10-28T18:58:43.504Z","updated":"2026-10-29T20:54:55.973Z","title":"Echo: Decompress permits unbounded gzip expansion in v4","severity":"HIGH","score":8.2,"vendor":"labstack","product":"echo","kev":false,"epss":0.00372,"kevAdded":null},{"id":"CVE-2026-118260","published":"2026-10-28T18:56:56.747Z","updated":"2026-10-30T19:19:59.727Z","title":"Echo: BodyDump captures request and response bodies without size limits in v4","severity":"HIGH","score":8.2,"vendor":"labstack","product":"echo","kev":false,"epss":0.00372,"kevAdded":null},{"id":"CVE-2026-55677","published":"2026-06-26T16:15:55.633Z","updated":"2026-06-26T16:50:57.019Z","title":"Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files","severity":"HIGH","score":7.5,"vendor":"labstack","product":"echo","kev":false,"epss":0.00519,"kevAdded":null},{"id":"CVE-2026-25766","published":"2026-02-19T15:49:02.402Z","updated":"2026-02-19T19:46:01.829Z","title":"Echo has a Windows path traversal via backslash in middleware.Static default filesystem","severity":"MEDIUM","score":5.3,"vendor":"labstack","product":"echo","kev":false,"epss":0.00382,"kevAdded":null}]}