tag
Haxcms
Critical
HAXcms Node.js Private Key Disclosure via Broken HMAC (CVE-2026-46395)
CVE-2026-46395·
HAXcms Node.js backend (elmsln/HAXcms, haxcms-nodejs) — src/lib/HAXCMS.js
patched
High
HAXcms Git.php OS Command Injection (CVE-2026-46394)
CVE-2026-46394·
HAXcms PHP backend (elmsln/HAXcms) — system/backend/php/lib/Git.php
patched
High
@haxtheweb/open-apis Credential Exposure via SSRF in cacheAddress Endpoint (CVE-2026-46391)
CVE-2026-46391 (GHSA-4fg7-f244-3j49)·
@haxtheweb/open-apis (HAXcms/HAX ecosystem web service APIs)
unpatched