27151 matches found
CVE-2026-35450
CVE-2026-35450 affects WWBN AVideo (versions 26.0 and earlier). The plugin/API/check.ffmpeg.json.php endpoint exposes FFmpeg remote server configuration and connectivity status without authentication, while sibling endpoints (kill.ffmpeg.json.php, list.ffmpeg.json.php, ffmpeg.php) require admin a...
CVE-2026-35185
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to 25.0.0, the /server-status endpoint is publicly accessible and exposes sensitive information including authentication tokens usertoken, user activity, client IP addresses, and server configuration details. This allows a...
CVE-2026-35199
SymCrypt is the core cryptographic function library currently used by Windows. From 103.5.0 to before 103.11.0, The SymCryptXmssSign function passes a 64-bit leaf count value to a helper function that accepts a 32-bit parameter. For XMSS^MT parameter sets with total tree height = 32 which include...
GHSA-MMM5-3G4X-QW39
creationtimestamp| type| source ---|---|--- 2026-04-06 19:30:06+00:00| seen| Telegram/3kkVmslj1pOIg13wE1G-TkOn-GF7E-LtfSm5ZR30UKw8qQ...
CVE-2026-35185
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to 25.0.0, the /server-status endpoint is publicly accessible and exposes sensitive information including authentication tokens usertoken, user activity, client IP addresses, and server configuration details. This allows a...
CVE-2026-35185
Summary: CVE-2026-35185 affects HAX CMS prior to version 25.0.0, where the /server-status endpoint is publicly accessible and can disclose sensitive information without authentication. What is affected: HAX CMS with PHP or Node.js backends. Impact (as stated): Exposure of authentication tokens (u...
CVE-2026-35185 HAX CMS's public /server-status endpoint exposes authentication tokens, user activity, and client IP addresses
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to 25.0.0, the /server-status endpoint is publicly accessible and exposes sensitive information including authentication tokens usertoken, user activity, client IP addresses, and server configuration details. This allows a...
EUVD-2026-19469
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to 25.0.0, the /server-status endpoint is publicly accessible and exposes sensitive information including authentication tokens usertoken, user activity, client IP addresses, and server configuration details. This allows a...
CVE-2026-35185 HAX CMS's public /server-status endpoint exposes authentication tokens, user activity, and client IP addresses
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to 25.0.0, the /server-status endpoint is publicly accessible and exposes sensitive information including authentication tokens usertoken, user activity, client IP addresses, and server configuration details. This allows a...
CVE-2026-31063
creationtimestamp| type| source ---|---|--- 2026-04-06 16:31:06+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116358713535158087...
CVE-2026-5613
creationtimestamp| type| source ---|---|--- 2026-04-06 04:01:18+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3misevyk2yb2d 2026-04-06 04:01:38+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3misewmkiiw2r 2026-04-06 05:16:26+00:00|...
CVE-2026-5610
creationtimestamp| type| source ---|---|--- 2026-04-06 02:18:11+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mis75n53qe2t 2026-04-06 02:18:22+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mis75wzgi22p 2026-04-06 03:00:27+00:00| seen|...
CVE-2026-35185: Improper Access Control
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to 25.0.0, the /server-status endpoint is publicly accessible and exposes sensitive information including authentication tokens usertoken, user activity, client IP addresses, and server configuration details. This allows a...
PT-2026-30720
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to 25.0.0, the /server-status endpoint is publicly accessible and exposes sensitive information including authentication tokens user token, user activity, client IP addresses, and server configuration details. This allows...
HAX log information leakage vulnerability
HAX is an open-source microsite managed using HAX+CMS with a PHP backend. Versions prior to HAX25.0.0 contained a vulnerability related to log information leakage. This vulnerability stemmed from the /server-status endpoint being publicly accessible, which could allow unverified users to access...
CVE-2026-5614
creationtimestamp| type| source ---|---|--- 2026-04-05 16:51:06+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116353129908955135 2026-04-06 04:17:42+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3misftdrazw2h 2026-04-06 04:30:29+00:00| seen|...
CVE-2026-5608
creationtimestamp| type| source ---|---|--- 2026-04-05 16:24:07+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116353023805462489 2026-04-06 01:18:36+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mis3t3gdkd2w 2026-04-06 01:30:26+00:00| seen|...
CVE-2026-3571
The Pie Register – User Registration, Profiles & Content Restriction plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the piemain function in all versions up to, and including, 3.8.4.8. This makes it possible for unauthenticated attacker...
