Geekezbrowser
Monthly
Information disclosure in EchoHS GeekezBrowser through 1.8.0 lets any local process that can reach the application's localhost Public API read the /api/status response, because that endpoint served data without an authorization check and with a wildcard CORS origin. The exposure is local rather than remote, the leaked data is low sensitivity, and there is no integrity or availability impact, which keeps this at a low-to-moderate severity (CVSS 4.0 base 4.8). A public PoC reference exists in the project's GitHub issue tracker but is not verified as working exploit code; no CISA KEV listing was supplied, and the vendor has released 1.8.1 with a fix.
Information disclosure in EchoHS GeekezBrowser through 1.8.0 lets any local process that can reach the application's localhost Public API read the /api/status response, because that endpoint served data without an authorization check and with a wildcard CORS origin. The exposure is local rather than remote, the leaked data is low sensitivity, and there is no integrity or availability impact, which keeps this at a low-to-moderate severity (CVSS 4.0 base 4.8). A public PoC reference exists in the project's GitHub issue tracker but is not verified as working exploit code; no CISA KEV listing was supplied, and the vendor has released 1.8.1 with a fix.