https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T15:39:44.380814+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-266726 EUVD-2026-266726 2026-10-04T15:39:44.460495+00:00 EUVD-2026-266726 https://cve.radiocsirt.org/vuln/fkie_cve-2026-24771 fkie_cve-2026-24771 2026-10-04T15:39:44.460538+00:00

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, a Cross-Site Scripting (XSS) vulnerability exists in the `ErrorBoundary` component of the hono/jsx library. Under certain usage patterns, untrusted user-controlled strings may be rendered as raw HTML, allowing arbitrary script execution in the victim's browser. Version 4.11.7 patches the issue.

 https://cve.radiocsirt.org/vuln/ghsa-9r54-q6cx-xmh5 GHSA-9r54-q6cx-xmh5 — Hono vulnerable to XSS through ErrorBoundary component 2026-10-04T15:39:44.460576+00:00

Affected: npm: hono

## Summary

A Cross-Site Scripting (XSS) vulnerability exists in the `ErrorBoundary` component of the hono/jsx library. Under certain usage patterns, untrusted user-controlled strings may be rendered as raw HTML, allowing arbitrary script execution in the victim's browser.

## Details

The issue is in the `ErrorBoundary` component (`src/jsx/components.ts`). `ErrorBoundary` previously forced certain rendered output paths to be treated as raw HTML, bypassing the library's default escaping behavior. This could result in unescaped rendering when developers pass user-controlled strings directly as children, or when fallbackRender returns user-controlled strings (for example, reflecting error messages that contain attacker input).

This vulnerability is only exploitable when an application renders untrusted user input within `ErrorBoundary` without appropriate escaping or sanitization.

## Impact

Successful exploitation may allow attackers to execute arbitrary JavaScript in the victim’s browser (reflected XSS). Depending on the application context, this can lead to actions such as session compromise, data exfiltration, or performing unauthorized actions as the victim.

## Affected Components

* hono/jsx: `ErrorBoundary` component

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0574 WID-SEC-W-2026-0574 — IBM App Connect Enterprise: Mehrere Schwachstellen 2026-10-04T15:39:44.460621+00:00

Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um einen Denial of Service Angriff durchzuführen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen, und um einen Cross-Site Scripting Angriff durchzuführen.