CVE-2026-59896 hono/jsx does not isolate context per request, leading to cross-request data disclosure

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.11.8 before 4.12.27, hono/jsx did not isolate context values per request during server-side rendering, allowing createContext, useContext, jsxRenderer, or useRequestContext data from a different in-flight...

CVE-2026-59896 hono/jsx does not isolate context per request, leading to cross-request data disclosure

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.11.8 before 4.12.27, hono/jsx did not isolate context values per request during server-side rendering, allowing createContext, useContext, jsxRenderer, or useRequestContext data from a different in-flight...

CVE-2026-59896

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.11.8 before 4.12.27, hono/jsx did not isolate context values per request during server-side rendering, allowing createContext, useContext, jsxRenderer, or useRequestContext data from a different in-flight...

CVE-2026-59897 Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.3.3 before 4.12.27, the AWS API Gateway v1 adapter can drop a distinct repeated request header value because it de-duplicates values using a substring comparison instead of an exact match, so middleware o...

CVE-2026-59897 Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.3.3 before 4.12.27, the AWS API Gateway v1 adapter can drop a distinct repeated request header value because it de-duplicates values using a substring comparison instead of an exact match, so middleware o...

google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation

A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 :path pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed :path that omits the mandato...

CVE-2026-56359 n8n - Cross-Site Scripting in Credential Management OAuth2 Authorization URL

n8n before 2.8.0 contains a cross-site scripting vulnerability in the credential management flow where authenticated users can inject malicious JavaScript URLs into OAuth2 credential Authorization URL fields. Attackers can craft malicious credentials and trick victims into clicking the OAuth...

windows7-eternalblue-lab

MS17-010 EternalBlue Exploitation Lab Hands-on penetration t...

PT-2026-56580

Name of the Vulnerable Software and Affected Versions Elysia versions prior to 1.4.29 Description Elysia is a Typescript framework used for request validation, type inference, OpenAPI documentation, and client-server communication. The framework uses the getAll function during form data...

An Automated Framework for Generating Stealthy Cell-Embedded Hardware Trojans

Hardware Trojans HTs pose significant threats across the Integrated Circuit IC design lifecycle because they can be inserted by untrusted entities at different stages under the zero-trust model. When triggered under rare conditions, HTs can compromise the functionality, reliability, or security o...

PT-2026-56507

Name of the Vulnerable Software and Affected Versions Hono versions 4.3.3 through 4.12.26 Description The AWS API Gateway v1 adapter incorrectly de-duplicates repeated request header values by using a substring comparison instead of an exact match. This behavior can lead to the loss of distinct...

PT-2026-56505

Name of the Vulnerable Software and Affected Versions Hono versions 4.0.0 through 4.12.26 Description The cx function in hono/css composes class names from plain strings but marks the result as already escaped without performing HTML-escaping on the input. This allows untrusted className values...

PT-2026-56516

Name of the Vulnerable Software and Affected Versions Astro version 6.4.7 Description Astro performs authorization decisions on a partially decoded pathname after reaching the iterative URL decoder limit. Subsequently, rewrite route matching performs an additional decodeURI operation, which can...

PT-2026-56506

Name of the Vulnerable Software and Affected Versions Hono versions 4.11.8 through 4.12.26 Description During server-side rendering, the hono/jsx module fails to isolate context values on a per-request basis. This allows data from a different in-flight request to be accessed after an await...

K000162130: Spring Framework vulnerability CVE-2026-41851

Security Advisory Description Applications which accept user-supplied Spring Expression Language SpEL expressions may be vulnerable to a Denial of Service DoS attack if the evaluation of a SpEL expression triggers unbounded cache growth. Affected versions: Spring Framework 7.0.0 through 7.0.7;...

CVE-2026-56812

Improper Check for Unusual or Exceptional Conditions vulnerability in phoenixframework phoenix Presence JavaScript client allows an attacker with ordinary channel access to cause a persistent client-side denial of service against every viewer of a presence channel topic. This vulnerability is...

databricks-genai (>=1.1.8, <=1.2.0a22), sports-prediction-framework (>=0.1.0, <=0.1.4) potentially affected by CVE-2025-10279 via mlflow (2.20.2)

mlflow PYPI version 2.20.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - databricks-genai =1.1.8, =0.1.0, =0.1.4 Source cves: CVE-2025-10279 Source advisory: OSV:PYSEC-2026-1639...

lback-framework (>=0.1.0, <=1.0.1), ncalab (0.1.0) +6 more potentially affected by CVE-2026-0994 via protobuf (4.25.7)

protobuf PYPI version 4.25.7 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - lback-framework =0.1.0, =1.3.2, =0.27.0b1, =0.47.0b1, =1.0.0b1, =0.3.0b5, =0.37.0b1, =1.8.0b1 Source cves: CVE-2026-0994 Source advisory:...

mask-anonymization-framework (>=1.2.0, <=1.3.2), python-dev-tools (2019.8.24) +2 more potentially affected by CVE-2025-71176 via pytest (5.1.1)

pytest PYPI version 5.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on pytest and may be impacted: - mask-anonymization-framework =1.2.0, =0.0.1, =0.0.1, =0.0.4 Source cves: CVE-2025-71176 Source advisory: OSV:PYSEC-2026-1845...

databricks-genai (>=1.1.8, <=1.2.0a22), sports-prediction-framework (>=0.1.0, <=0.1.4) potentially affected by CVE-2025-14279 via mlflow (2.20.2)

mlflow PYPI version 2.20.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - databricks-genai =1.1.8, =0.1.0, =0.1.4 Source cves: CVE-2025-14279 Source advisory: OSV:PYSEC-2026-1656...