Recent Advisories

Severity ID Title Vendor Product Date Type
HIGH 8.8 CVE-2026-5411

WP Captcha PRO <= 5.38 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload_CVE-2026-5411

The WP Captcha PRO (the premium version of the Advanced Google reCAPTCHA plugin, both have the same slug) plugin for WordPress is vulnerable to arb...

webfactory Advanced Google reCAPTCHA CVE
HIGH 8.7 CVE-2026-46511

HAXcms: Mass Token Exfiltration and Cross-Tenant Hijack_CVE-2026-46511

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, an attack chain utilizing Stored XSS alongside dynami...

haxtheweb haxcms-nodejs < 26.0.0 CVE
HIGH 7.7 CVE-2026-46394

HAX CMS Vulnerable to Command Injection using Git.php_CVE-2026-46394

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, an OS command injection vulnerability exists in the G...

haxtheweb haxcms-php < 26.0.0 CVE
HIGH 7.1 CVE-2026-46393

HAXcms createSite SSRF Enables Arbitrary File Read_CVE-2026-46393

HAX CMS helps manage microsite universe with PHP or NodeJs backends. An authenticated Server-Side Request Forgery (SSRF) vulnerability in versions ...

haxtheweb haxcms-nodejs < 26.0.0 CVE
HIGH 8.7 CVE-2026-46392

HAX CMS PHP Has a Stored XSS via Case-Sensitivity Mismatch in HTML Upload Validation_CVE-2026-46392

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0 of HAX CMS PHP, the `saveFile` endpoint validates uplo...

haxtheweb haxcms-php < 26.0.0 CVE
HIGH 8.7 CVE-2026-46391

HAX open-apis: Credential Theft via Server-Side Request Forgery (SSRF) in open-apis_CVE-2026-46391

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 9.0.1 and prior to version 26.0.0 of @haxtheweb/open-apis,...

haxtheweb @haxtheweb/open-apis >= 9.0.1, < 26.0.0 CVE
HIGH 7.2 PACKETSTORM:222804

📄 Lyrion Music Server 9.2.0 server.log Persistent Cross Site Scripting_PACKETSTORM:222804

The log viewer in Lyrion Music Server version 9.2.0 reflects request parameters and raw log content into HTML with no escaping. Any attacker-provid...

N/A N/A PACKETSTORM
HIGH 8.7 PACKETSTORM:222811

📄 Lyrion Music Server 9.2.0 Path Traversal / File Read_PACKETSTORM:222811

Lyrion Music Server version 9.2.0 suffers from a directory traversal vulnerability. Exploiting this issue will allow an unauthenticated attacker to...

N/A N/A PACKETSTORM
HIGH 7.2 PACKETSTORM:222805

📄 Lyrion Music Server 9.2.0 metadata Persistent Cross Site Scripting_PACKETSTORM:222805

Lyrion Music Server version 9.2.0 stores media file metadata tags such as GENRE, ARTIST, and ALBUM exactly as written in the file and later renders...

N/A N/A PACKETSTORM
HIGH 7.3 PACKETSTORM:222760

📄 Craft CMS 5.9.5 Missing Authorization / Denial of Service_PACKETSTORM:222760

Craft CMS versions 5.9.5 and below suffer from a missing authorization vulnerability that can trigger an unwanted migration...

N/A N/A PACKETSTORM