{"schemaVersion":3,"id":"CVE-2026-93981","aliases":["RHSA-2026:73654","GHSA-hxh3-vqpv-xpqv","CGA-22j8-mjpc-v568","CGA-2553-mmf9-mvf2","CGA-29v5-q87c-9pcx","CGA-2mgg-q3c2-hffq","CGA-2vg4-gq9g-4gcx","CGA-33jc-xvx5-wp2f","CGA-3fcg-p89r-3cxf","CGA-3jc9-87q4-4656","CGA-3vwq-fcm3-cg3c","CGA-48jg-3f82-2946","CGA-4q5m-8ggc-qvq5","CGA-4qxg-h3xx-m29r","CGA-4w3f-4j37-r6qr","CGA-5ghp-fj4m-g4h8","CGA-5m43-46c8-c5q5","CGA-5xxr-jp72-7cmv","CGA-6m49-cp78-2jp8","CGA-6pq8-cw82-326v","CGA-7229-285p-r7vg","CGA-73hr-vw44-vv3v","CGA-73q2-jcvr-2rgw","CGA-7h8w-q82p-5r8v","CGA-7hj3-gv33-r6jq","CGA-7qxj-x2c7-h86g","CGA-7w93-w7wh-79pw","CGA-86j6-8rrw-42mj","CGA-8c4f-77gw-6cxx","CGA-8p4r-g4x3-65fh","CGA-8rcp-qwh8-mcrg","CGA-9rxw-659c-pcr7","CGA-9v58-rhgg-3fw3","CGA-9w93-w376-55gv","CGA-c2fm-h5w7-4qxv","CGA-c592-h49m-m62w","CGA-c5xq-vjgr-crvh","CGA-c9r4-hrmc-pxg3","CGA-f28g-rxpq-fj82","CGA-f32x-wh34-4g7q","CGA-f3p4-q87c-mwp3","CGA-f6c8-mmp6-c966","CGA-fp4p-6745-m2m7","CGA-fqw8-vr82-gwhr","CGA-fx7v-452q-v4gw","CGA-gfwp-hrcc-3p36","CGA-gj45-55h8-92vw","CGA-gj7f-9p5x-8h4p","CGA-gm9f-g4gm-768r","CGA-gmqr-vx39-9mrc","CGA-h64g-8vq3-558f","CGA-hf9j-2h7j-38v8","CGA-jcwf-fgxp-jfgv","CGA-jj74-p3r7-ccpr","CGA-jq8g-2qjg-p2hf","CGA-jrjm-5qh8-68m4","CGA-m45v-8w96-6g9c","CGA-p9fq-5pq5-qqr7","CGA-pfx6-28mm-65jj","CGA-pg2v-692r-6qhp","CGA-pjpv-rgjm-hc24","CGA-ppgq-f4cr-qhqv","CGA-ppw2-g7pp-76hw","CGA-px3h-qc7w-jxw9","CGA-pxqc-3rw8-9m83","CGA-q425-8vxx-9cr8","CGA-qx4q-p57x-7pf9","CGA-r34x-xfh8-22wp","CGA-rh2x-v6xg-882w","CGA-rq94-wpp5-c7wq","CGA-rwwp-w36j-cfc4","CGA-v39j-j5r2-j4j9","CGA-v9jc-5799-p643","CGA-vghf-rfr9-mr29","CGA-vjpr-3cpq-8c3c","CGA-vr9v-8w47-5h4p","CGA-vvwc-qj8r-2p3w","CGA-w33p-ff59-9993","CGA-w52q-xp4x-w9c5","CGA-wcxv-68p6-hw3w","CGA-x5jv-vhhc-r52q","CGA-x5pr-j3rp-w263","CGA-xc3m-hpfm-wwc8","CGA-xj5g-9jrw-865r"],"status":"published","duplicateOf":null,"title":null,"description":"hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provider, or as the root value passed to renderToString() or renderToReadableStream() from hono/jsx/dom/server. These paths stringify their input and treat the result as already-escaped markup, so an attacker who controls such a string during server-side rendering can inject arbitrary HTML and execute script under the application's origin.","dates":{"published":"2026-09-19T11:53:34.294Z","modified":"2026-09-21T20:47:06.182Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":4.7,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"4.0","versionLabel":"v4.0","source":"CVE.org","score":2.3,"severity":"low","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":4.7,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Red hat","score":4.7,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","exploitability":4.1,"impact":4.5,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Npm","score":4.7,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","exploitability":4.1,"impact":4.5,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Chainguard","score":2.3,"severity":"low","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"NVD","score":2.3,"severity":"low","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":4.7,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00227,"percentile":0.12656,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[{"date":"2026-09-20T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00227,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00227,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00227,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00227,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00227,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00227,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00227,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00227,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00227,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00227,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00227,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00227,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00227,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00227,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00227,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00227,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00227,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00227,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00227,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00227,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00227,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00227,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00227,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00227,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00227,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00227,"percentile":0.12656}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00227,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00227,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00227,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00227,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00227,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00227,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00227,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00227,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00227,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00227,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00227,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00227,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00227,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00227,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00227,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00227,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00227,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00227,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00227,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00227,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00227,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00227,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00227,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00227,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00227,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00227,"percentile":0.12656}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/79.html"}],"affected":[{"vendor":"chainguard","product":"commercial-gitlab-rails-ee-19.1","name":"commercial-gitlab-rails-ee-19.1","label":"commercial-gitlab-rails-ee-19.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/commercial-gitlab-rails-ee-19.1","purlType":"apk","versions":[{"text":"< 19.1.7-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.1.7-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"commercial-gitlab-rails-ee-19.2","name":"commercial-gitlab-rails-ee-19.2","label":"commercial-gitlab-rails-ee-19.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/commercial-gitlab-rails-ee-19.2","purlType":"apk","versions":[{"text":"< 19.2.7-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.2.7-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"commercial-gitlab-rails-ee-19.3","name":"commercial-gitlab-rails-ee-19.3","label":"commercial-gitlab-rails-ee-19.3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/commercial-gitlab-rails-ee-19.3","purlType":"apk","versions":[{"text":"< 19.3.3-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.3.3-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"commercial-gitlab-rails-ee-19.4","name":"commercial-gitlab-rails-ee-19.4","label":"commercial-gitlab-rails-ee-19.4","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/commercial-gitlab-rails-ee-19.4","purlType":"apk","versions":[{"text":"< 19.4.1-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.4.1-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"commercial-gitlab-rails-ee-fips-19.1","name":"commercial-gitlab-rails-ee-fips-19.1","label":"commercial-gitlab-rails-ee-fips-19.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/commercial-gitlab-rails-ee-fips-19.1","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"commercial-gitlab-rails-ee-fips-19.2","name":"commercial-gitlab-rails-ee-fips-19.2","label":"commercial-gitlab-rails-ee-fips-19.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/commercial-gitlab-rails-ee-fips-19.2","purlType":"apk","versions":[{"text":"< 19.2.7-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.2.7-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"commercial-gitlab-rails-ee-fips-19.3","name":"commercial-gitlab-rails-ee-fips-19.3","label":"commercial-gitlab-rails-ee-fips-19.3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/commercial-gitlab-rails-ee-fips-19.3","purlType":"apk","versions":[{"text":"< 19.3.3-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.3.3-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"commercial-gitlab-rails-ee-fips-19.4","name":"commercial-gitlab-rails-ee-fips-19.4","label":"commercial-gitlab-rails-ee-fips-19.4","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/commercial-gitlab-rails-ee-fips-19.4","purlType":"apk","versions":[{"text":"< 19.4.1-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.4.1-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"hono","name":"hono","label":"hono","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/hono","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"hono-adapter-mqtt","name":"hono-adapter-mqtt","label":"hono-adapter-mqtt","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/hono-adapter-mqtt","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"hono-cli","name":"hono-cli","label":"hono-cli","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/hono-cli","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"hono-compat","name":"hono-compat","label":"hono-compat","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/hono-compat","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"hono-service-auth","name":"hono-service-auth","label":"hono-service-auth","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/hono-service-auth","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"hono-service-command-router","name":"hono-service-command-router","label":"hono-service-command-router","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/hono-service-command-router","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"hono-service-device-registry-jdbc","name":"hono-service-device-registry-jdbc","label":"hono-service-device-registry-jdbc","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/hono-service-device-registry-jdbc","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"librechat","name":"librechat","label":"librechat","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/librechat","purlType":"apk","versions":[{"text":"< 0.8.7-r16","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.8.7-r16","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard","name":"wazuh-dashboard","label":"wazuh-dashboard","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard","purlType":"apk","versions":[{"text":"< 4.14.8-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.14.8-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard-alerting-dashboards-plugin","name":"wazuh-dashboard-alerting-dashboards-plugin","label":"wazuh-dashboard-alerting-dashboards-plugin","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard-alerting-dashboards-plugin","purlType":"apk","versions":[{"text":"< 4.14.8-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.14.8-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard-alerting-dashboards-plugin-fips","name":"wazuh-dashboard-alerting-dashboards-plugin-fips","label":"wazuh-dashboard-alerting-dashboards-plugin-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard-alerting-dashboards-plugin-fips","purlType":"apk","versions":[{"text":"< 4.14.8-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.14.8-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard-anomaly-detection-dashboards-plugin","name":"wazuh-dashboard-anomaly-detection-dashboards-plugin","label":"wazuh-dashboard-anomaly-detection-dashboards-plugin","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard-anomaly-detection-dashboards-plugin","purlType":"apk","versions":[{"text":"< 4.14.8-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.14.8-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard-anomaly-detection-dashboards-plugin-fips","name":"wazuh-dashboard-anomaly-detection-dashboards-plugin-fips","label":"wazuh-dashboard-anomaly-detection-dashboards-plugin-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard-anomaly-detection-dashboards-plugin-fips","purlType":"apk","versions":[{"text":"< 4.14.8-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.14.8-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard-dashboards-maps","name":"wazuh-dashboard-dashboards-maps","label":"wazuh-dashboard-dashboards-maps","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard-dashboards-maps","purlType":"apk","versions":[{"text":"< 4.14.8-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.14.8-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard-dashboards-maps-fips","name":"wazuh-dashboard-dashboards-maps-fips","label":"wazuh-dashboard-dashboards-maps-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard-dashboards-maps-fips","purlType":"apk","versions":[{"text":"< 4.14.8-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.14.8-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard-dashboards-notifications","name":"wazuh-dashboard-dashboards-notifications","label":"wazuh-dashboard-dashboards-notifications","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard-dashboards-notifications","purlType":"apk","versions":[{"text":"< 4.14.8-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.14.8-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard-dashboards-notifications-fips","name":"wazuh-dashboard-dashboards-notifications-fips","label":"wazuh-dashboard-dashboards-notifications-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard-dashboards-notifications-fips","purlType":"apk","versions":[{"text":"< 4.14.8-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.14.8-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard-dashboards-reporting","name":"wazuh-dashboard-dashboards-reporting","label":"wazuh-dashboard-dashboards-reporting","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard-dashboards-reporting","purlType":"apk","versions":[{"text":"< 4.14.8-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.14.8-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard-dashboards-reporting-fips","name":"wazuh-dashboard-dashboards-reporting-fips","label":"wazuh-dashboard-dashboards-reporting-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard-dashboards-reporting-fips","purlType":"apk","versions":[{"text":"< 4.14.8-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.14.8-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard-dashboards-visualizations","name":"wazuh-dashboard-dashboards-visualizations","label":"wazuh-dashboard-dashboards-visualizations","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard-dashboards-visualizations","purlType":"apk","versions":[{"text":"< 4.14.8-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.14.8-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard-dashboards-visualizations-fips","name":"wazuh-dashboard-dashboards-visualizations-fips","label":"wazuh-dashboard-dashboards-visualizations-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard-dashboards-visualizations-fips","purlType":"apk","versions":[{"text":"< 4.14.8-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.14.8-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard-fips","name":"wazuh-dashboard-fips","label":"wazuh-dashboard-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard-fips","purlType":"apk","versions":[{"text":"< 4.14.8-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.14.8-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard-index-management-dashboards-plugin","name":"wazuh-dashboard-index-management-dashboards-plugin","label":"wazuh-dashboard-index-management-dashboards-plugin","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard-index-management-dashboards-plugin","purlType":"apk","versions":[{"text":"< 4.14.8-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.14.8-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard-index-management-dashboards-plugin-fips","name":"wazuh-dashboard-index-management-dashboards-plugin-fips","label":"wazuh-dashboard-index-management-dashboards-plugin-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard-index-management-dashboards-plugin-fips","purlType":"apk","versions":[{"text":"< 4.14.8-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.14.8-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard-plugins","name":"wazuh-dashboard-plugins","label":"wazuh-dashboard-plugins","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard-plugins","purlType":"apk","versions":[{"text":"< 4.14.8-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.14.8-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard-plugins-fips","name":"wazuh-dashboard-plugins-fips","label":"wazuh-dashboard-plugins-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard-plugins-fips","purlType":"apk","versions":[{"text":"< 4.14.8-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.14.8-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard-security-plugin","name":"wazuh-dashboard-security-plugin","label":"wazuh-dashboard-security-plugin","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard-security-plugin","purlType":"apk","versions":[{"text":"< 4.14.8-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.14.8-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard-security-plugin-fips","name":"wazuh-dashboard-security-plugin-fips","label":"wazuh-dashboard-security-plugin-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard-security-plugin-fips","purlType":"apk","versions":[{"text":"< 4.14.8-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.14.8-r6","eol":null,"hubHref":null},{"vendor":"honojs","product":"hono","name":"hono","label":"hono","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 4.13.7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.13.7","eol":null,"hubHref":"/vendor/honojs/hono"},{"vendor":"Npm","product":"hono","name":"hono","label":"hono","ecosystem":"Npm","cpePart":null,"purl":"pkg:npm/hono","purlType":"npm","versions":[{"text":"< 4.13.7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.13.7","eol":null,"hubHref":null},{"vendor":"redhat","product":"grafana12.4","name":"grafana12.4","label":"grafana12.4","ecosystem":"Red Hat","cpePart":null,"purl":"pkg:rpm/redhat/grafana12.4","purlType":"rpm","versions":[{"text":"< 0:12.4.10-0.10.hum1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0:12.4.10-0.10.hum1","eol":null,"hubHref":null}],"affectedCount":39,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/honojs/hono/security/advisories/GHSA-hxh3-vqpv-xpqv","label":"github.com/honojs/hono/security/advisories/GHSA-hxh3-vqpv-xpqv","hostname":"github.com","tags":["Vendor Advisory","ARTICLE","WEB","Advisory"]},{"url":"https://www.vulncheck.com/advisories/hono-jsx-before-4.13.7-cross-site-scripting-via-unescaped-strings","label":"www.vulncheck.com/advisories/hono-jsx-before-4.13.7-cross-site-scripting-via-unescaped-strings","hostname":"www.vulncheck.com","tags":["Third Party Advisory","ARTICLE","WEB","Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:73654","label":"access.redhat.com/errata/RHSA-2026:73654","hostname":"access.redhat.com","tags":["Advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-93981","label":"access.redhat.com/security/cve/CVE-2026-93981","hostname":"access.redhat.com","tags":["REPORT"]},{"url":"https://access.redhat.com/security/updates/classification/","label":"access.redhat.com/security/updates/classification/","hostname":"access.redhat.com","tags":["ARTICLE"]},{"url":"https://images.redhat.com/","label":"images.redhat.com","hostname":"images.redhat.com","tags":["ARTICLE"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_73654.json","label":"security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_73654.json","hostname":"security.access.redhat.com","tags":["Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2538284","label":"bugzilla.redhat.com/show_bug.cgi?id=2538284","hostname":"bugzilla.redhat.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-93981","label":"www.cve.org/CVERecord?id=CVE-2026-93981","hostname":"www.cve.org","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93981","label":"nvd.nist.gov/vuln/detail/CVE-2026-93981","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/honojs/hono/commit/2b8ed402cdab6dfc5e829b480806dcd8db94161e","label":"github.com/honojs/hono/commit/2b8ed402cdab6dfc5e829b480806dcd8db94161e","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/honojs/hono","label":"github.com/honojs/hono","hostname":"github.com","tags":["PACKAGE"]},{"url":"https://github.com/honojs/hono/releases/tag/v4.13.7","label":"github.com/honojs/hono/releases/tag/v4.13.7","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93981.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93981.json","hostname":"github.com","tags":["Advisory"]}],"lineage":{"upstream":["GHSA-6623-4Q32-82V8"],"downstream":["RHSA-2026:71906","RHSA-2026:73655","RHSA-2026:74869"],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-09-19T11:53:34.294Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-09-21T20:47:06.182Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":19,"level":"low","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T04:09:46.259Z","stale":false,"partial":false}}