haxtheweb haxcms-nodejs

• CVE-2026-46357 Medium 6.5 HAX CMS NodeJS application Vulnerable to Denial of Service using Malicious Import Request 0.2%
• CVE-2026-46397 Medium 6.5 haxcms-php Local File Inclusion via saveOutline API Location Parameter v2.0 0.3%
• CVE-2026-46496 Critical 9.3 HAX CMS: Stored XSS via '<video-player>' component allows arbitrary JavaScript execution and token theft 0.2%
• CVE-2026-46396 Critical 9.3 HAX CMS has a stored XSS via <iframe> that allows access to sensitive client-side data and account takeover 0.2%
• CVE-2026-46511 High 8.7 HAXcms: Mass Token Exfiltration and Cross-Tenant Hijack 0.3%
• CVE-2026-46395 Critical 9.3 HAX CMS Vulnerable to Private Key Disclosure via Broken HMAC Implementation 0.3%
• CVE-2026-46393 High 7.1 HAXcms createSite SSRF Enables Arbitrary File Read 0.2%
• CVE-2026-46399 Critical 9.4 Authenticated Remote Code Execution via File Overwrite 0.3%
• CVE-2026-48527 High 8.7 HaxCMS has a stored Cross-Site Scripting (XSS) bypass in saveNode endpoint 0.2%