| CVE-2026-118264 | CRITICAL | github.com/labstack/echo/v4 | v4.15.4 | 4.16.1 | Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's ... |
| CVE-2026-118264 | CRITICAL | github.com/labstack/echo/v5 | v5.3.1 | 5.4.1 | Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's ... |
| CVE-2026-116587 | HIGH | github.com/go-jose/go-jose/v4 | v4.1.4 | 4.1.6 | github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs |
| CVE-2026-118260 | HIGH | github.com/labstack/echo/v4 | v4.15.4 | 4.16.1 | Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in ... |
| CVE-2026-118261 | HIGH | github.com/labstack/echo/v4 | v4.15.4 | 4.16.1 | Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in ... |
| CVE-2026-118262 | HIGH | github.com/labstack/echo/v4 | v4.15.4 | 4.16.1 | Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's ... |
| CVE-2026-118262 | HIGH | github.com/labstack/echo/v5 | v5.3.1 | 5.4.1 | Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's ... |
| CVE-2026-118650 | HIGH | github.com/labstack/echo/v4 | v4.15.4 | 4.16.0 | Echo's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path |
| CVE-2026-118650 | HIGH | github.com/labstack/echo/v5 | v5.3.1 | 5.4.0 | Echo's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path |
| CVE-2026-114437 | MEDIUM | github.com/go-chi/chi/v5 | v5.3.1 | 5.4.0 | github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware |
| CVE-2026-116585 | MEDIUM | github.com/go-jose/go-jose/v4 | v4.1.4 | 4.1.5 | github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption |
| CVE-2026-116586 | MEDIUM | github.com/go-jose/go-jose/v4 | v4.1.4 | 4.1.5 | github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing |
| CVE-2026-118263 | MEDIUM | github.com/labstack/echo/v5 | v5.3.1 | 5.4.1 | Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests |
| CVE-2026-118265 | MEDIUM | github.com/labstack/echo/v5 | v5.3.1 | 5.4.1 | Echo: X-Real-IP extractor trusts the header value instead of the sending peer |
| CVE-2026-118266 | MEDIUM | github.com/labstack/echo/v4 | v4.15.4 | 4.16.0 | Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's MethodOv ... |
| CVE-2026-118266 | MEDIUM | github.com/labstack/echo/v5 | v5.3.1 | 5.4.0 | Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's MethodOv ... |
| CVE-2026-118651 | MEDIUM | github.com/labstack/echo/v5 | v5.3.1 | 5.4.0 | Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middlewa ... |
| CVE-2026-118652 | MEDIUM | github.com/labstack/echo/v4 | v4.15.4 | 4.16.0 | Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.JSONP a ... |
| CVE-2026-118652 | MEDIUM | github.com/labstack/echo/v5 | v5.3.1 | 5.4.0 | Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.JSONP a ... |
| CVE-2026-118654 | MEDIUM | github.com/labstack/echo/v4 | v4.15.4 | 4.16.0 | Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's static f ... |
| CVE-2026-118654 | MEDIUM | github.com/labstack/echo/v5 | v5.3.1 | 5.4.0 | Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's static f ... |
| CVE-2026-118656 | MEDIUM | github.com/labstack/echo/v4 | v4.15.4 | 4.16.0 | Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, sanitizeURI che ... |
| CVE-2026-118656 | MEDIUM | github.com/labstack/echo/v5 | v5.3.1 | 5.4.0 | Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, sanitizeURI che ... |
| CVE-2026-118657 | MEDIUM | github.com/labstack/echo/v4 | v4.15.4 | 4.16.0 | Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.Scheme ... |
| CVE-2026-118657 | MEDIUM | github.com/labstack/echo/v5 | v5.3.1 | 5.4.0 | Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.Scheme ... |
| CVE-2026-118651 | MEDIUM | github.com/labstack/echo/v4 | v4.15.4 | — غير قابلة للإصلاح | Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middlewa ... |
| CVE-2026-118653 | MEDIUM | github.com/labstack/echo/v4 | v4.15.4 | — غير قابلة للإصلاح | Echo is a Go web framework. From 4.0.0 until 5.1.0, Context.RealIP fal ... |
| CVE-2023-36308 | LOW | github.com/disintegration/imaging | v1.6.2 | — غير قابلة للإصلاح | disintegration Imaging 1.6.2 allows attackers to cause a panic (becaus ... |
| CVE-2026-78661 | UNKNOWN | golang.org/x/net | v0.60.0 | 0.62.0 | When coalescing adjacent text nodes in addText and fosterParent, appen ... |
| CVE-2026-97045 | UNKNOWN | golang.org/x/net | v0.60.0 | 0.62.0 | In childTextNodesAreLiteral, walking up the tree previously stopped at ... |
| GO-2026-5932 | UNKNOWN | golang.org/x/crypto | v0.57.0 | — غير قابلة للإصلاح | The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues |
