Package impact
npm / @haxtheweb/haxcms-nodejs
| CVE | Severity | CVSS | Risk | Flags | OS | Vendor | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-46395 | critical | — | 9.5 | 11d ago | HAXcms: Private Key Disclosure via Broken HMAC Implementation | |||
| CVE-2026-46357 | medium | — | 5.5 | 11d ago | HAX CMS: Denial of Service using Malicious Import Request | |||
| CVE-2026-46496 | medium | — | 5.5 | 11d ago | HAX CMS: Stored XSS via '<video-player>' component allows arbitrary JavaScript execution and token theft |