TI-2026-40198 CVE-2026-55677 · GHSA-vfp3-v2gw-7wfq
Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files
Priority HIGH 72
Echo is a Go web framework.
RHSA-2026:61585
osbuild-composer security update
Released 2026-08-31 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream E4S (v.9.2) osbuild-composer-76.1-8.el9_2, osbuild-composer-core-76.1-8.el9_2, osbuild-composer-dnf-json-76.1-8.el9_2 +1
Fixes 4 records
TI-2026-30785 CVE-2026-42502 · GHSA-wrh2-89vg-4j9g
Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
Priority LOW 27
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree.
TI-2026-21586 CVE-2026-27136 · GHSA-m9x8-m34x-fj9q
Invoking duplicate attributes can cause XSS in golang.org/x/net/html
Priority LOW 27
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree.
TI-2026-20766 CVE-2026-25681 · GHSA-w9p8-pvxh-rxpj
Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
Priority LOW 27
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree.