Skip to content
OpenAdvisories
Medium WID-SEC-2026-4131 6 CVEs

IBM App Connect Enterprise: Mehrere Schwachstellen

Published Oct 22, 2026 · Updated Nov 8, 2026 · Revision 2 · de

Vendor: IBM Product: App Connect Enterprise Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um Dateien zu manipulieren, um einen Denial of Service Angriff durchzuführen und um einen Cross-Site Scripting Angriff durchzuführen.

Product

IBM App Connect Enterprise kombiniert die branchenbewährten Technologien des IBM Integration Bus mit Cloud-nativen Technologien.

Vulnerabilities 6

  • Medium 6.5
    CVE-2026-84365

    Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory

    Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.12 until 4.13.5, the fix released for CVE-2026-39408 does not cover every traversal sequence, and toSSG() can still write files outside the configured output direc…

    honojs hono hono npm
  • Medium 5.9
    CVE-2026-84363

    Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

    Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, Hono's query helpers treat a question mark after a literal hash fragment as the start of a query string, so the application can read request parameters that…

    honojs hono hono npm
  • Medium 5.4
    CVE-2026-18196

    IBM App Connect Enterprise web user interface and Administration REST API are vulnerable to html injection

    IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2, and 12.0.1.0 through 12.0.12.30 could allow a remote attacker to inject arbitrary HTML due to improper output neutralization.

    IBM App Connect Enterprise
  • Medium 5.3
    CVE-2026-84364

    Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion

    Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, when parseBody() expands dot-separated form field names into nested objects with dot-notation parsing enabled, it does not limit the nesting depth or the to…

    honojs hono hono npm
  • Medium 4.7
    CVE-2026-93981

    hono/jsx before 4.13.7 Cross-Site Scripting via Unescaped Strings

    hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provider, or as the root value passed to rend…

    honojs hono hono npm
  • Medium 4.2
    CVE-2026-18195

    IBM App Connect Enterprise web user interface and Administration REST API are vulnerable to html injection

    IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2, and 12.0.1.0 through 12.0.12.30 could allow a remote attacker to perform content spoofing due to improper output encoding of error messages.

    IBM App Connect Enterprise

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2026-119700, EUVD-2026-119699

  2. #1

    Initiale Fassung

References