Medium
CVE-2026-49459
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 112
Reset filters
Medium
CVE-2026-47676
Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths
Medium
CVE-2026-47674
Hono: IP Restriction bypasses static deny rules for non-canonical IPv6
Medium
CVE-2026-47675
Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection
Medium
CVE-2026-47673
Hono: JWT middleware accepts any Authorization scheme, not only Bearer
Medium
CVE-2026-44646
LiquidJS's `{% render %}` tag silently bypasses per-render `ownPropertyOnly:true` via `Context.spawn()`
Low
CVE-2026-46549
NocoDB: OAuth Token Scope Not Enforced at ACL Layer Allows Scope Escalation
Low
CVE-2026-44582
Next.js vulnerable to cache poisoning via collisions in React Server Component cache-busting
Medium
CVE-2026-44576
Next.js vulnerable to cache poisoning in React Server Component responses
High
CVE-2026-44574
Next.js has a Middleware / Proxy bypass through dynamic route parameter injection
Medium
CVE-2026-44458
Hono has CSS Declaration Injection via Style Object Values in JSX SSR
Low
CVE-2026-44459
Hono has improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()
Medium
CVE-2026-44457
Hono's Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage
Medium
CVE-2026-44456
Hono: bodyLimit() can be bypassed for chunked / unknown-length requests
Medium
CVE-2026-44455
hono/jsx has Unvalidated JSX Tag Names that May Allow HTML Injection
Medium
CVE-2026-44373
Nitro has a proxy scope bypass via percent-encoded path traversal in `routeRules`
High
CVE-2026-42043
Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0
High
CVE-2026-42349
Clerk has an authorization bypass when combining organization, billing, or reverification checks
Medium
CVE-2026-42438
OpenClaw: Sender policy bypass in host media attachment reads allows unauthorized local file disclosure
Medium
CVE-2026-43567
OpenClaw: screen_record outPath bypassed workspace-only filesystem guard
Medium
CVE-2026-56761
hono Improperly Handles JSX Attribute Names Allows HTML Injection in hono/jsx SSR
Medium
CVE-2026-39410
Hono: Non-breaking space prefix bypass in cookie name handling in getCookie()
Medium
CVE-2026-39409
Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses
Medium
CVE-2026-56762
Hono missing validation of cookie name on write path in setCookie()
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.