CVE-2026-35199

SymCrypt is the core cryptographic function library currently used by Windows. From 103.5.0 to before 103.11.0, The SymCryptXmssSign function passes a 64-bit leaf count value to a helper function that accepts a 32-bit parameter. For XMSS^MT parameter sets with total tree height = 32 which include...

CVE-2026-35185

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to 25.0.0, the /server-status endpoint is publicly accessible and exposes sensitive information including authentication tokens usertoken, user activity, client IP addresses, and server configuration details. This allows a...

GHSA-MMM5-3G4X-QW39

creationtimestamp| type| source ---|---|--- 2026-04-06 19:30:06+00:00| seen| Telegram/3kkVmslj1pOIg13wE1G-TkOn-GF7E-LtfSm5ZR30UKw8qQ...

CVE-2026-35185

Summary: CVE-2026-35185 affects HAX CMS prior to version 25.0.0, where the /server-status endpoint is publicly accessible and can disclose sensitive information without authentication. What is affected: HAX CMS with PHP or Node.js backends. Impact (as stated): Exposure of authentication tokens (u...

CVE-2026-35185

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to 25.0.0, the /server-status endpoint is publicly accessible and exposes sensitive information including authentication tokens usertoken, user activity, client IP addresses, and server configuration details. This allows a...

EUVD-2026-19469

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to 25.0.0, the /server-status endpoint is publicly accessible and exposes sensitive information including authentication tokens usertoken, user activity, client IP addresses, and server configuration details. This allows a...

CVE-2026-35185 HAX CMS's public /server-status endpoint exposes authentication tokens, user activity, and client IP addresses

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to 25.0.0, the /server-status endpoint is publicly accessible and exposes sensitive information including authentication tokens usertoken, user activity, client IP addresses, and server configuration details. This allows a...

CVE-2026-35185 HAX CMS's public /server-status endpoint exposes authentication tokens, user activity, and client IP addresses

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to 25.0.0, the /server-status endpoint is publicly accessible and exposes sensitive information including authentication tokens usertoken, user activity, client IP addresses, and server configuration details. This allows a...

CVE-2026-31063

creationtimestamp| type| source ---|---|--- 2026-04-06 16:31:06+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116358713535158087...

CVE-2026-5613

creationtimestamp| type| source ---|---|--- 2026-04-06 04:01:18+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3misevyk2yb2d 2026-04-06 04:01:38+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3misewmkiiw2r 2026-04-06 05:16:26+00:00|...

CVE-2026-5610

creationtimestamp| type| source ---|---|--- 2026-04-06 02:18:11+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mis75n53qe2t 2026-04-06 02:18:22+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mis75wzgi22p 2026-04-06 03:00:27+00:00| seen|...

HAX 日志信息泄露漏洞

HAX is an open-source microsite managed using HAX+CMS with a PHP backend. Versions prior to HAX25.0.0 contained a vulnerability related to log information leakage. This vulnerability stemmed from the /server-status endpoint being publicly accessible, which could allow unverified users to access...

PT-2026-30720

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to 25.0.0, the /server-status endpoint is publicly accessible and exposes sensitive information including authentication tokens user token, user activity, client IP addresses, and server configuration details. This allows...

CVE-2026-5614

creationtimestamp| type| source ---|---|--- 2026-04-05 16:51:06+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116353129908955135 2026-04-06 04:17:42+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3misftdrazw2h 2026-04-06 04:30:29+00:00| seen|...

CVE-2026-5608

creationtimestamp| type| source ---|---|--- 2026-04-05 16:24:07+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116353023805462489 2026-04-06 01:18:36+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mis3t3gdkd2w 2026-04-06 01:30:26+00:00| seen|...

CVE-2026-3571

The Pie Register – User Registration, Profiles & Content Restriction plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the piemain function in all versions up to, and including, 3.8.4.8. This makes it possible for unauthenticated attacker...

CVE-2026-5590

creationtimestamp| type| source ---|---|--- 2026-04-05 04:09:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mipuw2fmfb2d...

CGA-63MH-P78V-HJ5P

Bulletin has no description...

CVE-2026-5567

creationtimestamp| type| source ---|---|--- 2026-04-04 17:00:07+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116347502875060524 2026-04-05 15:16:27+00:00| published-proof-of-concept| Telegram/bba5KoRxZjw4aUqHfMWZuI7ux2762ZWKOY2q9V8MiGPKQ0 2026-04-05 15:29:21+00:00| seen|...

CVE-2026-5550

creationtimestamp| type| source ---|---|--- 2026-04-04 16:33:04+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116347396717928485 2026-04-05 09:00:29+00:00| seen| https://infosec.exchange/users/offseq/statuses/116351279339813810 2026-04-05 09:00:31+00:00| seen|...