Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 10 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,638All CVEsplus 19,141 rejected
- 668Last 24 hours2,951 in the last 7 days
- 17,123Last 30 days1,606 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 6 | 37 | 3 | 0 | 46 | 55 |
| 2025 | 0 | 2 | 1 | 0 | 0 | 3 | 9 |
| 2024 | 0 | 1 | 4 | 0 | 0 | 5 | 6 |
| 2023 | 0 | 0 | 1 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-118663 | @hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static pathshonojs · node-server | Medium5.3 |
| CVE-2026-111757 | Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static pathshonojs · hono | Medium5.3 |
| CVE-2026-109955 | Hono 4.12.4 before 4.13.11 Middleware Bypass via serveStatic Double Decodinghonojs · hono | Medium6.9 |
| CVE-2026-93981 | hono/jsx before 4.13.7 Cross-Site Scripting via Unescaped Stringshonojs · hono | Low2.3 |
| CVE-2026-84365 | Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directoryhonojs · hono | Medium6.5 |
| CVE-2026-84364 | Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustionhonojs · hono | Medium5.3 |
| CVE-2026-84363 | Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentialshonojs · hono | Medium5.9 |
| CVE-2026-81888 | @hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linkinghonojs · @hono/oauth-providers | Medium5.4 |
| CVE-2026-73565 | @hono/node-server: Unauthenticated memory-leak DoS via aborted WebSocket handshakehonojs · node-server | Medium5.3 |
| CVE-2026-69207 | Hono: ReDoS in CORS middleware via Access-Control-Request-Headershonojs · hono | Medium5.3 |
| CVE-2026-71850 | Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosurehonojs · hono | Medium4.8 |
| CVE-2026-71849 | Hono: Proxy Helper does not remove response headers listed in the `Connection` headerhonojs · hono | Low3.7 |
| CVE-2026-71848 | Hono: Algorithmic Complexity DoS in Language Middlewarehonojs · hono | Medium5.3 |
| CVE-2026-59895 | Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utilityhonojs · hono | Medium6.1 |
| CVE-2026-59896 | hono/jsx does not isolate context per request, leading to cross-request data disclosurehonojs · hono | Medium6.5 |
| CVE-2026-59897 | Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplicationhonojs · hono | Medium4.8 |
| CVE-2026-54288 | Hono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length`honojs · hono | Medium6.5 |
| CVE-2026-54289 | Hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the resthonojs · hono | Medium4.8 |
| CVE-2026-54290 | Hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcardhonojs · hono | High7.1 |
| CVE-2026-54286 | Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)honojs · hono | Medium5.9 |
| CVE-2026-54287 | Hono: AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and Latticehonojs · hono | Medium5.3 |
| CVE-2026-47673 | Hono: JWT middleware accepts any Authorization scheme, not only Bearerhonojs · hono | Medium4.8 |
| CVE-2026-47674 | Hono: IP Restriction bypasses static deny rules for non-canonical IPv6honojs · hono | Medium5.3 |
| CVE-2026-47675 | Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injectionhonojs · hono | Medium4.3 |
| CVE-2026-47676 | Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded pathshonojs · hono | Medium5.3 |
| CVE-2026-44459 | Hono: Improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()honojs · hono | Low3.8 |
| CVE-2026-44458 | Hono: CSS Declaration Injection via Style Object Values in JSX SSRhonojs · hono | Medium4.3 |
| CVE-2026-44457 | Hono: Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakagehonojs · hono | Medium5.3 |
| CVE-2026-44456 | Hono: bodyLimit() can be bypassed for chunked / unknown-length requestshonojs · hono | Medium6.5 |
| CVE-2026-44455 | Hono: Unvalidated JSX Tag Names in hono/jsx May Allow HTML Injectionhonojs · hono | Medium4.7 |
| CVE-2026-39410 | Hono has a non-breaking space prefix bypass in cookie name handling in getCookie()honojs · hono | Medium4.8 |
| CVE-2026-39409 | Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresseshonojs · hono | Medium6.3 |
| CVE-2026-39408 | Hono has a path traversal in toSSG() allows writing files outside the output directoryhonojs · hono | Medium5.9 |
| CVE-2026-39407 | Hono has a middleware bypass via repeated slashes in serveStatichonojs · hono | Medium5.3 |
| CVE-2026-39406 | @hono/node-server has a middleware bypass via repeated slashes in serveStatichonojs · node-server | Medium5.3 |
| CVE-2026-29087 | @hono/node-server: Authorization bypass for protected static paths via encoded slashes in Serve Static Middlewarehonojs · node-server | High7.5 |
| CVE-2026-29085 | Hono: SSE Control Field Injection via CR/LF in writeSSE()honojs · hono | Medium6.5 |
| CVE-2026-29045 | Hono: Arbitrary file access via serveStatic vulnerabilityhonojs · hono | High7.5 |
| CVE-2026-29086 | Hono: Cookie Attribute Injection via Unsanitized domain and path in setCookie()honojs · hono | Medium5.4 |
| CVE-2026-27700 | Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfohonojs · hono | High8.2 |
| CVE-2026-24771 | Hono has a Cross-site Scripting vulnerabilityhonojs · hono | Medium4.7 |
| CVE-2026-24473 | Hono has an Arbitrary Key Read in Serve static Middleware (Cloudflare Workers Adapter)honojs · hono | Medium6.3 |
| CVE-2026-24472 | Hono cache middleware ignores "Cache-Control: private" leading to Web Cache Deceptionhonojs · hono | Medium5.3 |
| CVE-2026-24398 | Hono's IPv4 address validation bypass in IP Restriction Middleware allows IP spoofinghonojs · hono | Medium4.8 |
| CVE-2026-22817 | JWT Algorithm Confusion via Unsafe Default (HS256) in Hono JWT Middleware Allows Token Forgery and Auth Bypasshonojs · hono | High8.2 |
| CVE-2026-22818 | JWT algorithm confusion in Hono JWK Auth Middleware when JWK lacks "alg" (untrusted header.alg fallback)honojs · hono | High8.2 |
| CVE-2025-62610 | Hono Improperly Authorizes JWT Audience Validationhonojs · hono | High8.1 |
| CVE-2025-59139 | Hono has Body Limit Middleware Bypasshonojs · hono | Medium5.3 |
| CVE-2025-58362 | Hono contains a flaw in URL path parsing, potentially leading to path confusionhonojs · hono | High7.5 |
| CVE-2024-48913 | Hono vulnerable to bypass of CSRF Middleware by a request without Content-Type header.honojs · hono | Medium5.9 |