MEDIUM5.4CVE-2026-47694EPSS 0.03%WWBN AVideo: Stored XSS via unescaped Gallery category description
MEDIUM5.3CVE-2026-47676Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths
MEDIUM5.3CVE-2026-47674Hono: IP Restriction bypasses static deny rules for non-canonical IPv6
MEDIUM4.3CVE-2026-47675Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection
MEDIUM4.8CVE-2026-47673Hono: JWT middleware accepts any Authorization scheme, not only Bearer
—CVE-2026-44393An issue was discovered in OpenStack oslo.messaging 1.0.0 through 17.3.0.
MEDIUM5.4CVE-2026-47671Nhost CLI local configserver allows cross-origin unauthenticated read/write access to local development configuration and secrets
HIGH7.5CVE-2026-34077React Router vulnerable to Denial of Service via reflected user input in single-fetch
HIGH7.6CVE-2026-45337Better Auth: Device authorization approve and deny accept any authenticated session while the user code is pending
MEDIUM4.9CVE-2026-45057Incomplete message edit validation in matrix-sdk-ui
—CVE-2026-45056Sender-binding gaps in to-device messages
—CVE-2026-44476Doorkeeper Openid Connect: Dynamic Client Registration feature creates public clients with client_secret
HIGH7.5CVE-2026-44496Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection
HIGH7.5CVE-2026-44488Allocation of Resources Without Limits or Throttling in Axios