Security: lin-snow/Ech0
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
Unauthenticated Like Endpoint Enables Arbitrary Engagement Metric InflationGHSA-rgj7-vg8v-j4wr published
May 3, 2026 by lin-snowModerate -
Unauthenticated Server-Side Request Forgery in Website Preview FeatureGHSA-wc4h-2348-jc3p published
Apr 1, 2026 by lin-snowHigh -
Missing Authorization on System Logs Allows Non-Admin Information DisclosureGHSA-w8jj-cwmc-wgq2 published
Apr 9, 2026 by lin-snowModerate -
Stored XSS via SVG Upload and Content-Type Validation Bypass in File UploadGHSA-69hx-63pv-f8f4 published
Apr 9, 2026 by lin-snowModerate -
SSRF via DNS Resolution Bypass in Webhook URL ValidationGHSA-r2x7-427f-rq69 published
Apr 9, 2026 by lin-snowModerate -
Comment Panel Endpoints Missing RequireScopes Middleware — Scoped Access Token BypassGHSA-fwg7-53p4-g33c published
Apr 9, 2026 by lin-snowModerate -
Scope Bypass: profile:read Access Token Can Change Admin Password and Escalate to Unrestricted SessionGHSA-hm2h-wwwh-g49x published
Apr 9, 2026 by lin-snowModerate -
Unauthenticated SSRF in GetWebsiteTitle allows access to internal services and cloud metadataGHSA-cqgf-f4x7-g6wc published
Apr 1, 2026 by lin-snowHigh -
Authenticated user-list exposed data via public `/api/allusers` endpointGHSA-m983-7426-5hrj published
Mar 22, 2026 by lin-snowModerate