npm @haxtheweb/haxcms-nodejs

Name: npm @haxtheweb/haxcms-nodejs
Brand: npm

productUS

pkg:npm/%40haxtheweb/haxcms-nodejs

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

EPSS ≥ 10%

unpatched

by severity

1critical1high5medium0low

updated 2026-10-28

vulnerabilities (16)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2026-22704US	medium5.4	1.03% (63rd)	Exploit	25.0.0	2026-01-10	11.0.6 → 25.0.0
CVE-2026-46395US	—OT elevated	0.29% (22nd)	Exploit	26.0.0	2026-06-05	< 26.0.0
CVE-2025-49141US	high8.8	1.49% (74th)	—	11.0.3	2025-06-09	< 11.0.3
CVE-2025-54378US	—OT elevated	0.57% (47th)	—	11.0.14	2025-07-26	< 11.0.14
CVE-2025-54134US	medium6.5	0.47% (41st)	—	11.0.9	2025-07-21	< 11.0.9
CVE-2025-54127US	critical9.8OT elevated	0.46% (39th)	—	11.0.7	2025-07-21	< 11.0.7
CVE-2025-54137US	—OT elevated	0.39% (33rd)	—	11.0.10	2025-07-22	< 11.0.10
CVE-2025-49139US	medium6.5	0.37% (31st)	—	11.0.0	2025-06-09	< 11.0.0
CVE-2025-54139US	medium6.1	0.36% (29th)	—	11.0.13	2025-07-23	< 11.0.13
CVE-2026-46511US	—	0.27% (20th)	—	26.0.0	2026-06-05	< 26.0.0
CVE-2026-46357US	—	0.24% (15th)	—	26.0.0	2026-06-05	< 26.0.0
CVE-2026-46393US	—	0.24% (15th)	—	26.0.0	2026-06-05	< 26.0.0
CVE-2025-54128US	medium6.1	0.23% (14th)	—	11.0.8	2025-07-21	< 11.0.8
CVE-2026-46496US	—	0.23% (14th)	—	26.0.0	2026-06-05	< 26.0.0
CVE-2026-46396US	—	0.23% (14th)	—	26.0.0	2026-06-05	< 26.0.0
CVE-2026-48527US	—	0.23% (13th)	—	26.0.1	2026-05-29	< 26.0.1

The flaw types (CWEs) most of these CVEs share.

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')6 CVEs
CWE-1021Improper Restriction of Rendered UI Layers or Frames2 CVEs
CWE-20Improper Input Validation2 CVEs
CWE-116Improper Encoding or Escaping of Output1 CVEs
CWE-1188Initialization of a Resource with an Insecure Default1 CVEs
CWE-1392Use of Default Credentials1 CVEs
CWE-200Exposure of Sensitive Information to an Unauthorized Actor1 CVEs
CWE-248Uncaught Exception1 CVEs

Which sources assert this record, and when.

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.