Haxtheweb Haxcms-nodejs vulnerabilities

• haxtheweb haxcms-php, haxcms-nodejs +1 more haxcms-php Local File Inclusion via saveOutline API Location Parameter v2.0 CVE-2026-46397 6.5 MediumJune 5, 2026
• haxtheweb haxcms-nodejs, haxcms-php +1 more Authenticated Remote Code Execution via File Overwrite CVE-2026-46399 9.4 CriticalJune 5, 2026
• haxtheweb haxcms-nodejs, haxcms-php +1 more HaxCMS has a stored Cross-Site Scripting (XSS) bypass in saveNode endpoint CVE-2026-48527 Fix available 8.7 HighMay 29, 2026
• haxtheweb haxcms-nodejs HAX CMS NodeJS application Vulnerable to Denial of Service using Malicious Import Request CVE-2026-46357 Fix available 6.5 MediumMay 19, 2026
• haxtheweb haxcms-nodejs, haxcms-php +1 more HAXcms: Mass Token Exfiltration and Cross-Tenant Hijack CVE-2026-46511 Fix available 8.7 HighMay 19, 2026
• haxtheweb haxcms-nodejs, iframe-loader, video-player +2 more HAX CMS has a stored XSS via <iframe> that allows access to sensitive client-side data and account takeover CVE-2026-46396 Fix available 9.3 CriticalMay 19, 2026
• haxtheweb haxcms-nodejs HAX CMS Vulnerable to Private Key Disclosure via Broken HMAC Implementation CVE-2026-46395 Public exploitFix available 9.3 CriticalMay 19, 2026
• haxtheweb video-player, haxcms-nodejs +1 more HAX CMS: Stored XSS via '<video-player>' component allows arbitrary JavaScript execution and token theft CVE-2026-46496 Fix available 9.3 CriticalMay 19, 2026
• haxtheweb haxcms-nodejs, haxcms-php +1 more HAXcms createSite SSRF Enables Arbitrary File Read CVE-2026-46393 Fix available 7.1 HighMay 19, 2026