CVE-2026-46357
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, the HAX CMS NodeJS application crashes when an
CVSS
6.5
Medium
EPSS
0.2%
p15
KEV
—
Exploit Today
4
0-100
Published: Jun 5, 2026 · Last modified: Jul 23, 2026 · CWE-20
0.2%EPSS · 30 days0.2%
2026-07-292026-08-26
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, the HAX CMS NodeJS application crashes when an authenticated attacker sends a specially crafted site creation request to the createSite endpoint. A single request is sufficient to take the entire application offline, requiring a manual server restart to restore service. Version 26.0.0 fixes the issue.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-565473.5 LOW—
———The Apple profile generated for the Apple built-in Mail, Calendar and Contacts account to synchronize with HCL Traveler requires the Logon Name and Mail Address to be embedded in them. The values cannot be changed later on, so the Apple profile generation page asks for those values and reflects them back in the generated Apple profile. The Apple profile is not usable without additional information and only allows the attacker to attack their own device, but HCL Traveler could at least check that the values submitted and reflected back in the Apple profile are found in the Domino directory entry for the already authenticated user.1dCVE-2026-775409.1 CRI—
———A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS Server to execute a Command Injection on the host device.17hCVE-2026-775399.1 CRI—
———A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS Server to execute a Command Injection on the host device.17hCVE-2026-182615.7 MED3.5%
——1Vulnerability in Drupal Powerful Surveys. This issue affects Powerful Surveys versions: *.*.1dCVE-2026-182605.7 MED3.5%
——1Vulnerability in Drupal Disable Login Page. This issue affects Disable Login Page versions: *.*.4hCVE-2026-166435.7 MED3.5%
——1Vulnerability in Drupal Lunr exposed filters. This issue affects Lunr exposed filters versions: *.*.1d