1189 matches found
CVE-2026-106451 vulnerabilities
Vulnerabilities for packages: strimzi-kafka-operator, apache-nifi, logstash, elasticsearch, kayenta, flink-kubernetes-operator-fips, wazuh-indexer, apache-polaris-fips, apache-pulsar-fips, flink-kubernetes-operator, apache-polaris, kafbat-ui, confluent-kafka-jre-bcfips, opensearch-fips, kafka-fip...
CVE-2026-106450 vulnerabilities
Vulnerabilities for packages: strimzi-kafka-operator, apache-nifi, logstash, elasticsearch, kayenta, flink-kubernetes-operator-fips, wazuh-indexer, apache-polaris-fips, apache-pulsar-fips, flink-kubernetes-operator, apache-polaris, kafbat-ui, confluent-kafka-jre-bcfips, opensearch-fips, kafka-fip...
GHSA-343H-94H5-C4WR vulnerabilities
Vulnerabilities for packages: strimzi-kafka-operator, apache-nifi, logstash, elasticsearch, kayenta, flink-kubernetes-operator-fips, wazuh-indexer, apache-polaris-fips, apache-pulsar-fips, flink-kubernetes-operator, apache-polaris, kafbat-ui, confluent-kafka-jre-bcfips, opensearch-fips, kafka-fip...
GHSA-GM45-99XC-R7WV vulnerabilities
Vulnerabilities for packages: strimzi-kafka-operator, apache-nifi, logstash, elasticsearch, kayenta, flink-kubernetes-operator-fips, wazuh-indexer, apache-polaris-fips, apache-pulsar-fips, flink-kubernetes-operator, apache-polaris, kafbat-ui, confluent-kafka-jre-bcfips, opensearch-fips, kafka-fip...
GHSA-MCR4-QMVW-PX4G vulnerabilities
Vulnerabilities for packages: strimzi-kafka-operator, apache-nifi, logstash, elasticsearch, kayenta, flink-kubernetes-operator-fips, wazuh-indexer, apache-polaris-fips, apache-pulsar-fips, flink-kubernetes-operator, apache-polaris, kafbat-ui, confluent-kafka-jre-bcfips, opensearch-fips, kafka-fip...
8router (>=0.5.12, <=0.5.24), @11kit/tinyengine-material (>=1.0.0, <=1.0.7) +2765 more potentially affected by CVE-2026-109345 via dompurify (>=3.0.0, <=3.4.15)
dompurify NPM version =3.0.0, =0.5.12, =1.0.0, =1.5.1, =0.18.0-beta.0, =0.0.1, =0.1.0, =0.10.2, =0.1.0-alpha.1, =0.1.0, =0.1.0, =0.1.0, =0.0.0-dev-20240828032938, =0.2.8-experimental.0, =1.2.0, =1.5.1 and more Source cves: CVE-2026-109345 Source advisory: OSV:GHSA-6688-9RHM-GJV2...
Security Bulletin: middleware is vulnerable to algorithmic complexity denial of service when processing a crafted language tag containing a large number of hyphen separated subtags.
Summary Upgrade to InformixHQ 3.3.2 included in 14.10.14W1 and 15.0.1.16 Vulnerability Details CVEID:CVE-2026-69207 DESCRIPTION: Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.34, the built-in CORS middleware, hono/cors, is vulnerable to a...
CVE-2026-89425 vulnerabilities
Vulnerabilities for packages: flyway-fips, kserve-modelmesh, apache-nifi, logstash, wazuh-indexer, apache-polaris-fips, flink-kubernetes-operator, drain-cleaner, apache-polaris, ontop, opensearch-fips, hono, pinot, cruise-control, cass-config-builder-fips, metabase, jenkins-plugin-manager,...
GHSA-7HHH-6RMP-J9QF vulnerabilities
Vulnerabilities for packages: flyway-fips, kserve-modelmesh, apache-nifi, logstash, wazuh-indexer, apache-polaris-fips, flink-kubernetes-operator, drain-cleaner, apache-polaris, ontop, opensearch-fips, hono, pinot, cruise-control, cass-config-builder-fips, metabase, jenkins-plugin-manager,...
CVE-2026-89407 vulnerabilities
Vulnerabilities for packages: flyway-fips, kserve-modelmesh, apache-nifi, logstash, wazuh-indexer, apache-polaris-fips, flink-kubernetes-operator, drain-cleaner, apache-polaris, ontop, opensearch-fips, hono, pinot, cruise-control, cass-config-builder-fips, metabase, jenkins-plugin-manager,...
GHSA-P6PP-M3F8-5C89 vulnerabilities
Vulnerabilities for packages: flyway-fips, kserve-modelmesh, apache-nifi, logstash, wazuh-indexer, apache-polaris-fips, flink-kubernetes-operator, drain-cleaner, apache-polaris, ontop, opensearch-fips, hono, pinot, cruise-control, cass-config-builder-fips, metabase, jenkins-plugin-manager,...
hono: hono/jsx: Cross-Site Scripting via Unescaped Strings
A flaw was found in hono/jsx. This vulnerability occurs because the software fails to properly escape plain strings when they are rendered in certain contexts during server-side rendering. A remote attacker can exploit this by providing specially crafted input, leading to Cross-Site Scripting XSS...
CLSA-2026-1790854808 TuxCare security update for hono (2 CVEs)
TuxCare rebuilt hono to address 2 CVEs. Fixed in 3.12.12-tuxcare.3...
GHSA-HXH3-VQPV-XPQV hono/jsx renders plain strings unescaped in boundary components, leading to XSS
Summary hono/jsx does not HTML-escape a plain string placed directly as a child or fallback of Suspense or ErrorBoundary, as the only child of a Context.Provider, or as the root value of renderToString / renderToReadableStream from hono/jsx/dom/server. Such a string is emitted as markup instead o...
NPM: hono/jsx renders plain strings unescaped in boundary components, leading to XSS
NPM: hono/jsx renders plain strings unescaped in boundary components, leading to XSS vulnerability discovered by ? in WordPress Npm hono versions 4.13.7...
EUVD-2026-83586
hono/jsx renders plain strings unescaped in boundary components, leading to XSS...
@3ngram/server (>=1.2.6, <=1.8.4), @aaarc/recursivelearnmcp (>=0.1.0, <=0.1.3) +956 more potentially affected by CVE-2026-93981 via hono (>=4.0.0, <=4.13.5)
hono NPM version =4.0.0, =1.2.6, =0.1.0, =0.3.1, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.0.148, =0.0.138, =0.0.0-pr-306-20260707164534, =0.9.0, =0.1.9, =0.2.0, =0.30.14 and more Source cves: CVE-2026-93981 Source advisory: GHSA-HXH3-VQPV-XPQV...
@3ngram/server (>=1.2.6, <=1.8.4), @aaarc/recursivelearnmcp (>=0.1.0, <=0.1.3) +956 more potentially affected by CVE-2026-93981 via hono (>=4.0.0, <=4.13.5)
hono NPM version =4.0.0, =1.2.6, =0.1.0, =0.3.1, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.0.148, =0.0.138, =0.0.0-pr-306-20260707164534, =0.9.0, =0.1.9, =0.2.0, =0.30.14 and more Source cves: CVE-2026-93981 Source advisory: OSV:GHSA-HXH3-VQPV-XPQV...
hono/jsx renders plain strings unescaped in boundary components, leading to XSS
Summary hono/jsx does not HTML-escape a plain string placed directly as a child or fallback of Suspense or ErrorBoundary, as the only child of a Context.Provider, or as the root value of renderToString / renderToReadableStream from hono/jsx/dom/server. Such a string is emitted as markup instead o...
hono: hono/jsx: Cross-Site Scripting via Unescaped Strings
A flaw was found in hono/jsx. This vulnerability occurs because the software fails to properly escape plain strings when they are rendered in certain contexts during server-side rendering. A remote attacker can exploit this by providing specially crafted input, leading to Cross-Site Scripting XSS...