CVE-2026-35185

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to 25.0.0, the /server-status endpoint is publicly accessible and exposes sensitive information including authentication tokens usertoken, user activity, client IP addresses, and server configuration details. This allows a...

CVE-2026-35185 HAX CMS's public /server-status endpoint exposes authentication tokens, user activity, and client IP addresses

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to 25.0.0, the /server-status endpoint is publicly accessible and exposes sensitive information including authentication tokens usertoken, user activity, client IP addresses, and server configuration details. This allows a...

CVE-2026-35185

Summary: CVE-2026-35185 affects HAX CMS prior to version 25.0.0, where the /server-status endpoint is publicly accessible and can disclose sensitive information without authentication. What is affected: HAX CMS with PHP or Node.js backends. Impact (as stated): Exposure of authentication tokens (u...

CVE-2026-35185 HAX CMS's public /server-status endpoint exposes authentication tokens, user activity, and client IP addresses

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to 25.0.0, the /server-status endpoint is publicly accessible and exposes sensitive information including authentication tokens usertoken, user activity, client IP addresses, and server configuration details. This allows a...

CVE-2026-35185

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to 25.0.0, the /server-status endpoint is publicly accessible and exposes sensitive information including authentication tokens usertoken, user activity, client IP addresses, and server configuration details. This allows a...

CVE-2026-31063

creationtimestamp| type| source ---|---|--- 2026-04-06 16:31:06+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116358713535158087...

CVE-2026-5613

creationtimestamp| type| source ---|---|--- 2026-04-06 04:01:18+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3misevyk2yb2d 2026-04-06 04:01:38+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3misewmkiiw2r 2026-04-06 05:16:26+00:00|...

CVE-2026-5610

creationtimestamp| type| source ---|---|--- 2026-04-06 02:18:11+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mis75n53qe2t 2026-04-06 02:18:22+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mis75wzgi22p 2026-04-06 03:00:27+00:00| seen|...

PT-2026-30720

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to 25.0.0, the /server-status endpoint is publicly accessible and exposes sensitive information including authentication tokens user token, user activity, client IP addresses, and server configuration details. This allows...

HAX log information leakage vulnerability

HAX is an open-source microsite managed using HAX+CMS with a PHP backend. Versions prior to HAX25.0.0 contained a vulnerability related to log information leakage. This vulnerability stemmed from the /server-status endpoint being publicly accessible, which could allow unverified users to access...

CVE-2026-35185: Improper Access Control

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to 25.0.0, the /server-status endpoint is publicly accessible and exposes sensitive information including authentication tokens usertoken, user activity, client IP addresses, and server configuration details. This allows a...

CVE-2026-5614

creationtimestamp| type| source ---|---|--- 2026-04-05 16:51:06+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116353129908955135 2026-04-06 04:17:42+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3misftdrazw2h 2026-04-06 04:30:29+00:00| seen|...

CVE-2026-5608

creationtimestamp| type| source ---|---|--- 2026-04-05 16:24:07+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116353023805462489 2026-04-06 01:18:36+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mis3t3gdkd2w 2026-04-06 01:30:26+00:00| seen|...

CVE-2026-3571

The Pie Register – User Registration, Profiles & Content Restriction plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the piemain function in all versions up to, and including, 3.8.4.8. This makes it possible for unauthenticated attacker...

CVE-2026-5590

creationtimestamp| type| source ---|---|--- 2026-04-05 04:09:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mipuw2fmfb2d...

CGA-63MH-P78V-HJ5P

Bulletin has no description...

CVE-2026-5567

creationtimestamp| type| source ---|---|--- 2026-04-04 17:00:07+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116347502875060524 2026-04-05 15:16:27+00:00| published-proof-of-concept| Telegram/bba5KoRxZjw4aUqHfMWZuI7ux2762ZWKOY2q9V8MiGPKQ0 2026-04-05 15:29:21+00:00| seen|...

CVE-2026-5550

creationtimestamp| type| source ---|---|--- 2026-04-04 16:33:04+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116347396717928485 2026-04-05 09:00:29+00:00| seen| https://infosec.exchange/users/offseq/statuses/116351279339813810 2026-04-05 09:00:31+00:00| seen|...

tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation

A flaw was found in Apache Tomcat. When an Online Certificate Status Protocol OCSP responder is used, the Tomcat Native component, and Tomcat's FFM port of the Tomcat Native code, does not properly verify or check the freshness of the OCSP response. This improper input validation vulnerability...

Missing Authentication for Critical Function

Overview wwbn/avideo is an Audio and Video Platform or simply "A Video Platform". Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the check.ffmpeg.json.php endpoint, which lacks access control checks. An attacker can obtain information about th...