CVE-2026-77151

LowCVSS 3.7/10Last modified Oct 18, 2026

Description

A security flaw has been discovered in lin-snow Ech0 up to 5.4.1. Affected by this issue is the function MD5Encrypt of the file internal/util/crypto/crypto.go. Performing a manipulation results in risky cryptographic algorithm. Remote exploitation of the attack is possible. The complexity of an attack is rather high. The exploitation is known to be difficult. Upgrading to version 5.4.2 can resolve this issue. The patch is named 9ce19a3b0d0765086a655f45d3a706ec1810404f. It is recommended to upgrade the affected component.

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-310CWE-327

Affected software

No affected versions have been published.

Timeline

Published
Aug 20, 2026
Last modified
Oct 18, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-771566.4Incomplete validation of extracted archive entry paths in ast-cli's tar extraction logic on Linux and macOS (used when installing the VorpalCVE-2026-771576.4ast-cli downloads two helper binaries, the Vorpal ASCA real-time engine and the SCA Resolver, from "download.checkmarx.com" as part of its aCVE-2026-771595.5A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost() function. The function uses a path-based chown() on the swtpm lCVE-2026-77166.3A vulnerability was found in code-projects Gym Management System In PHP and Windows NT 1.0. This vulnerability affects unknown code of the fCVE-2026-771616.5The Smart Marketing SMS and Newsletters Forms plugin for WordPress is vulnerable to generic SQL Injection via Parameter Name in all versionsCVE-2026-771646.2Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote instance is established, CVE-2026-771656.5File owners were unable to unlock TYPE_TOKEN locks placed by other users, leaving files permanently locked with no recovery path outside of CVE-2026-771662.4The emoji field in the page emoji update endpoint does not properly validate user input. By injecting long text and line breaks, the sidebarCVE-2026-771696.5A vulnerability in the team folders (formerly group folders) app when used in combination with the workspace app allowed API/REST-only delegCVE-2026-77178.8A vulnerability was determined in Totolink WA300 5.2cu.7112_B20190227. This issue affects the function UploadCustomModule of the file /cgi-bCVE-2026-771704.3The Deck config API allows authenticated users to set board-scoped configuration keys for arbitrary board IDs without validating whether theCVE-2026-771768.1A flaw was found in Kata Containers. In configurations utilizing genpolicy for Confidential Containers guest protection, a malicious host op