13172 matches found
PT-2026-122878
TuxCare rebuilt http-proxy-middleware to address 2 CVEs. Fixed in 4.0.0-tuxcare.1...
CVE-2026-109955
A flaw was found in Hono. A remote, unauthenticated attacker can exploit a double path decoding issue in the serveStatic component by submitting requests with specially crafted, encoded URL paths. This flaw allows attackers to bypass security middleware, granting unauthorized access to protected...
CVE-2026-102989 TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses
TanStack Router is a client-first, server-capable, fully type-safe router and full-stack framework for the web. From 1.143.12 until 1.169.39 for @tanstack/start-server-core, 1.168.60 for @tanstack/react-start, 1.168.57 for @tanstack/solid-start, and 1.168.56 for @tanstack/vue-start, an...
CVE-2026-102989 TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses
TanStack Router is a client-first, server-capable, fully type-safe router and full-stack framework for the web. From 1.143.12 until 1.169.39 for @tanstack/start-server-core, 1.168.60 for @tanstack/react-start, 1.168.57 for @tanstack/solid-start, and 1.168.56 for @tanstack/vue-start, an...
CLSA-2026-1791907870 TuxCare security update for webpack-dev-middleware (1 CVE)
TuxCare rebuilt webpack-dev-middleware to address 1 CVE. Fixed in 1.12.2-tuxcare.2...
CLSA-2026-1791907762 TuxCare security update for webpack-dev-middleware (1 CVE)
TuxCare rebuilt webpack-dev-middleware to address 1 CVE. Fixed in 3.5.1-tuxcare.2...
CVE-2026-109955
Hono from 4.12.4 before 4.13.11 contains a middleware bypass vulnerability in serveStatic that allows unauthenticated attackers to skip prefix middleware by exploiting double path decoding. Attackers can send malformed percent-encoded paths that the router matches in encoded form, reaching static...
EUVD-2026-98659
Hono from 4.12.4 before 4.13.11 contains a middleware bypass vulnerability in serveStatic that allows unauthenticated attackers to skip prefix middleware by exploiting double path decoding. Attackers can send malformed percent-encoded paths that the router matches in encoded form, reaching static...
CVE-2026-109955
Hono from 4.12.4 before 4.13.11 contains a middleware bypass vulnerability in serveStatic that allows unauthenticated attackers to skip prefix middleware by exploiting double path decoding. Attackers can send malformed percent-encoded paths that the router matches in encoded form, reaching static...
CVE-2026-109955 Hono 4.12.4 before 4.13.11 Middleware Bypass via serveStatic Double Decoding
Hono from 4.12.4 before 4.13.11 contains a middleware bypass vulnerability in serveStatic that allows unauthenticated attackers to skip prefix middleware by exploiting double path decoding. Attackers can send malformed percent-encoded paths that the router matches in encoded form, reaching static...
CVE-2026-109955 Hono 4.12.4 before 4.13.11 Middleware Bypass via serveStatic Double Decoding
Hono from 4.12.4 before 4.13.11 contains a middleware bypass vulnerability in serveStatic that allows unauthenticated attackers to skip prefix middleware by exploiting double path decoding. Attackers can send malformed percent-encoded paths that the router matches in encoded form, reaching static...
CVE-2026-109955
The Hono web framework (versions 4.12.4 before 4.13.11 ) is vulnerable to a middleware bypass in the serveStatic component. The root cause is double path decoding , where attackers can use malformed percent-encoded paths to bypass prefix middleware. This allows unauthenticated attackers to access...
CVE-2026-109955 Hono 4.12.4 before 4.13.11 Middleware Bypass via serveStatic Double Decoding
Hono from 4.12.4 before 4.13.11 contains a middleware bypass vulnerability in serveStatic that allows unauthenticated attackers to skip prefix middleware by exploiting double path decoding. Attackers can send malformed percent-encoded paths that the router matches in encoded form, reaching static...
CVE-2026-109955: Double Decoding of the Same Data
Hono from 4.12.4 before 4.13.11 contains a middleware bypass vulnerability in serveStatic that allows unauthenticated attackers to skip prefix middleware by exploiting double path decoding. Attackers can send malformed percent-encoded paths that the router matches in encoded form, reaching static...
PT-2026-122182
TuxCare rebuilt webpack-dev-middleware to address 1 CVE. Fixed in 3.5.1-tuxcare.2...
PT-2026-111550
Name of the Vulnerable Software and Affected Versions Hono versions 4.12.4 through 4.13.10 Description A middleware bypass exists in the serveStatic function. Unauthenticated attackers can bypass prefix middleware by using double path decoding, sending malformed percent-encoded paths that the...
PT-2026-122183
TuxCare rebuilt webpack-dev-middleware to address 1 CVE. Fixed in 1.12.2-tuxcare.2...
CVE-2026-89309: Missing Authentication for Critical Function
The authorization middleware of the WMS MobileServer fails to require authentication in two distinct cases. First, it only requires an Authorization header for GET and HEAD requests; requests using any other HTTP method are processed without an authentication check. Second, for any HTTP method...
CVE-2026-102989: Improper Neutralization of Input During Web Page Generation
TanStack Router is a client-first, server-capable, fully type-safe router and full-stack framework for the web. From 1.143.12 until 1.169.39 for @tanstack/start-server-core, 1.168.60 for @tanstack/react-start, 1.168.57 for @tanstack/solid-start, and 1.168.56 for @tanstack/vue-start, an...
p5-Plack -- Multiple vulnerabilities
Plack project reports: SECURITY Fix memory leak of every request env in Plack::Middleware::Recursive CVE-2026-110333 Plack::Request::Upload-basename never returns '', '.' or '..' CVE-2026-110332 Plack::App::URLMap matches SERVERPORT literally when stripping it from Host CVE-2026-110335 BUG FIXES...