GitHub Advisory Database
Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.
Filter advisories
GitHub reviewed advisories
Unreviewed advisories
Malware advisories
9 advisories
Flight has reflected XSS through an unvalidated JSONP callback in Flight::jsonp()
High
CVE-2026-42548
was published
for
flightphp/core
(Composer)
May 6, 2026
Flight has path traversal in `make:controller` CLI that creates arbitrary directories outside project root
Moderate
CVE-2026-42549
was published
for
flightphp/core
(Composer)
May 6, 2026
Flight vulnerable to SQL Injection via unvalidated identifiers in SimplePdo::insert / update / delete
High
CVE-2026-42550
was published
for
flightphp/core
(Composer)
May 6, 2026
Flight: HTTP method override enabled by default, facilitating CSRF escalation and middleware bypass
High
CVE-2026-42551
was published
for
flightphp/core
(Composer)
May 6, 2026
Flight vulnerable to sensitive information disclosure via default error handler
High
CVE-2026-42552
was published
for
flightphp/core
(Composer)
May 6, 2026
Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths
Moderate
CVE-2026-47676
was published
for
hono
(npm)
Jun 4, 2026
hono: AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and Lattice
Moderate
CVE-2026-54287
was published
for
hono
(npm)
Jun 16, 2026
hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest
Moderate
CVE-2026-54289
was published
for
hono
(npm)
Jun 16, 2026
hono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length`
Moderate
CVE-2026-54288
was published
for
hono
(npm)
Jun 16, 2026
ProTip!
Advisories are also available from the
GraphQL API