919 matches found
CVE-2026-89425 vulnerabilities
Vulnerabilities for packages: elasticsearch, request-9047-keycloak-fips, kates-fips, tez, flink-kubernetes-operator, solr-fips, ontop, strimzi-kafka-oauth, camunda, dependency-track, flink-kubernetes-operator-fips, s3proxy-fips, floci-az, knative-kafka-broker-fips, knative-kafka-broker, metabase,...
GHSA-7HHH-6RMP-J9QF vulnerabilities
Vulnerabilities for packages: elasticsearch, request-9047-keycloak-fips, kates-fips, tez, flink-kubernetes-operator, solr-fips, ontop, strimzi-kafka-oauth, camunda, dependency-track, flink-kubernetes-operator-fips, s3proxy-fips, floci-az, knative-kafka-broker-fips, knative-kafka-broker, metabase,...
CVE-2026-89407 vulnerabilities
Vulnerabilities for packages: elasticsearch, request-9047-keycloak-fips, kates-fips, tez, flink-kubernetes-operator, solr-fips, ontop, strimzi-kafka-oauth, camunda, dependency-track, flink-kubernetes-operator-fips, s3proxy-fips, floci-az, knative-kafka-broker-fips, knative-kafka-broker, metabase,...
GHSA-P6PP-M3F8-5C89 vulnerabilities
Vulnerabilities for packages: elasticsearch, request-9047-keycloak-fips, kates-fips, tez, flink-kubernetes-operator, solr-fips, ontop, strimzi-kafka-oauth, camunda, dependency-track, flink-kubernetes-operator-fips, s3proxy-fips, floci-az, knative-kafka-broker-fips, knative-kafka-broker, metabase,...
hono: hono/jsx: Cross-Site Scripting via Unescaped Strings
A flaw was found in hono/jsx. This vulnerability occurs because the software fails to properly escape plain strings when they are rendered in certain contexts during server-side rendering. A remote attacker can exploit this by providing specially crafted input, leading to Cross-Site Scripting XSS...
NPM: hono/jsx renders plain strings unescaped in boundary components, leading to XSS
NPM: hono/jsx renders plain strings unescaped in boundary components, leading to XSS vulnerability discovered by ? in WordPress Npm hono versions 4.13.7...
GHSA-HXH3-VQPV-XPQV hono/jsx renders plain strings unescaped in boundary components, leading to XSS
Summary hono/jsx does not HTML-escape a plain string placed directly as a child or fallback of Suspense or ErrorBoundary, as the only child of a Context.Provider, or as the root value of renderToString / renderToReadableStream from hono/jsx/dom/server. Such a string is emitted as markup instead o...
EUVD-2026-83586
hono/jsx renders plain strings unescaped in boundary components, leading to XSS...
hono/jsx renders plain strings unescaped in boundary components, leading to XSS
Summary hono/jsx does not HTML-escape a plain string placed directly as a child or fallback of Suspense or ErrorBoundary, as the only child of a Context.Provider, or as the root value of renderToString / renderToReadableStream from hono/jsx/dom/server. Such a string is emitted as markup instead o...
hono: hono/jsx: Cross-Site Scripting via Unescaped Strings
A flaw was found in hono/jsx. This vulnerability occurs because the software fails to properly escape plain strings when they are rendered in certain contexts during server-side rendering. A remote attacker can exploit this by providing specially crafted input, leading to Cross-Site Scripting XSS...
hono: hono/jsx: Cross-Site Scripting via Unescaped Strings
A flaw was found in hono/jsx. This vulnerability occurs because the software fails to properly escape plain strings when they are rendered in certain contexts during server-side rendering. A remote attacker can exploit this by providing specially crafted input, leading to Cross-Site Scripting XSS...
CLSA-2026-1790597695 TuxCare security update for hono (12 CVEs)
TuxCare rebuilt hono to address 12 CVEs. Fixed in 3.12.12-tuxcare.2...
roninforge-hono
roninforge-hono Cursor plugin for Hono v4 TypeScript edge web framework + TypeScript. Pinned to hono ^4.12.19, @hono/zod-validator ^0.8.0, @hono/zod-openapi ^1.4.0 peer zod ^4.x, @hono/node-server ^2.0.3 Node 20+. Teaches the v4 APIs that LLMs trained on pre-2024 data do not know c.json always...
CLSA-2026-1790413170 TuxCare security update for hono (15 CVEs)
TuxCare rebuilt hono to address 15 CVEs. Fixed in 3.12.12-tuxcare.1...
Security Bulletin: Security Vulnerabilities in Third-Party Node.js Packages Used by IBM Rhapsody Systems Engineering
Summary Security vulnerabilities were identified in the product's Node.js dependencies. The issue has been mitigated by removing the vulnerable packages and updating dependencies to secure versions. Vulnerability Details CVEID:CVE-2026-29087 DESCRIPTION: @hono/node-server allows running the Hono...
hono: hono/jsx: Cross-Site Scripting via Unescaped Strings
A flaw was found in hono/jsx. This vulnerability occurs because the software fails to properly escape plain strings when they are rendered in certain contexts during server-side rendering. A remote attacker can exploit this by providing specially crafted input, leading to Cross-Site Scripting XSS...
ROOT-APP-NPM-CVE-2026-54288 CVE-2026-54288 in hono - Patched by Root
Root has patched CVE-2026-54288 in the hono package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-59895 CVE-2026-59895 in hono - Patched by Root
Root has patched CVE-2026-59895 in the hono package for Root:npm. Multiple fixed versions available...