{"vulnerability": "cve-2026-4639", "sightings": [{"uuid": "ed394bcc-26f2-4c0b-a5fe-8b27b4d32e6b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-4639", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mhrtjzaysb2e", "content": "", "creation_timestamp": "2026-03-24T05:25:11.050348Z"}, {"uuid": "1fe18e9b-e2f5-40ce-a110-a2fd28545127", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-4639", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mhryra3c622d", "content": "", "creation_timestamp": "2026-03-24T06:58:40.944490Z"}, {"uuid": "636868f4-a3ec-4a20-bc53-48d161e308a7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46391", "type": "seen", "source": "Telegram/Ab4OFqOZ0GdnyIUaC77uZ2CbzoeHzh_CrZHfEopJ-gCMQVg", "content": "", "creation_timestamp": "2026-05-14T09:00:04.000000Z"}, {"uuid": "767e096b-9157-4ea2-9b2d-f4cfd5970ce0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-46391", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-4fg7-f244-3j49", "content": "", "creation_timestamp": "2026-05-19T14:44:46.000000Z"}, {"uuid": "8fa20619-a256-42ae-8c05-68547fad6771", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-46396", "type": "published-proof-of-concept", "source": "https://github.com/haxtheweb/issues/security/advisories/GHSA-jh3h-rpxg-fr36", "content": "", "creation_timestamp": "2026-05-12T20:26:06.000000Z"}, {"uuid": "6ae5b07e-8c65-41ff-923b-0d9709168eb6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-46395", "type": "published-proof-of-concept", "source": "https://github.com/haxtheweb/issues/security/advisories/GHSA-6c8g-9hfh-pq5h", "content": "", "creation_timestamp": "2026-05-12T20:26:15.000000Z"}, {"uuid": "23869aef-96df-4eca-869c-caa678d1fdb0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-46393", "type": "published-proof-of-concept", "source": "https://github.com/haxtheweb/issues/security/advisories/GHSA-q862-gcgq-5m6g", "content": "", "creation_timestamp": "2026-05-12T20:23:35.000000Z"}, {"uuid": "856ebf45-3828-478d-93bb-82ac7bb990b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46392", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mnkwj2rvxl2o", "content": "\ud83d\udfe0 CVE-2026-46392 - High (8.7)\n\nHAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0 of H...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-46392/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-06-05T20:00:52.574217Z"}, {"uuid": "0707cecf-3681-442c-82b9-6ce6c71d81f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46398", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mnl3rq4wz32z", "content": "CVE-2026-46398 - HAX CMS Missing Secure Flag on Cookie\nCVE ID : CVE-2026-46398\n \n Published : June 5, 2026, 8:17 p.m. | 15\u00a0minutes ago\n \n Description : HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 25.0.0 and prior to version 26.0.0, ...", "creation_timestamp": "2026-06-05T21:35:10.451233Z"}, {"uuid": "bf3a489b-fc6f-4440-8542-9dcfa3efe22e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46397", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mnl42opps527", "content": "CVE-2026-46397 - haxcms-php Local File Inclusion via saveOutline API Location Parameter v2.0\nCVE ID : CVE-2026-46397\n \n Published : June 5, 2026, 8:17 p.m. | 15\u00a0minutes ago\n \n Description : HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 2...", "creation_timestamp": "2026-06-05T21:40:10.815949Z"}, {"uuid": "1214031f-f69c-4d90-9c53-02c66ce5f9d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-4639", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mo7s2ovlww2j", "content": "\ud83d\udccc CVE-2026-4639 - Vitals ESP developed by Galaxy Software Services has a Incorrect Authorization vulnerability, allowing authenticated remote attackers to perform certa... https://www.cyberhub.blog/cves/CVE-2026-4639", "creation_timestamp": "2026-06-14T03:07:09.275144Z"}, {"uuid": "cff8a0f4-f76c-4459-b8a5-f2f111d3a8ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46394", "type": "published-proof-of-concept", "source": "Telegram/Twzxtbvyqic9grgE7JaZrbs3i9BOrZG8PBBvMyWgrTB7Ya8", "content": "", "creation_timestamp": "2026-06-09T19:00:13.000000Z"}, {"uuid": "f113d05d-044e-4aae-8d9f-6272d9876571", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46395", "type": "published-proof-of-concept", "source": "Telegram/Twzxtbvyqic9grgE7JaZrbs3i9BOrZG8PBBvMyWgrTB7Ya8", "content": "", "creation_timestamp": "2026-06-09T19:00:13.000000Z"}, {"uuid": "142b0a2a-bc5a-41ba-b9f8-adeb27282da9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46394", "type": "published-proof-of-concept", "source": "Telegram/avQcqITCN0CdPqbu_zPd1c2U29MoQRx_NSjCudrYTZic4II", "content": "", "creation_timestamp": "2026-06-09T23:00:05.000000Z"}, {"uuid": "905e3059-fcfa-428f-9d28-f427ad0d4668", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46395", "type": "published-proof-of-concept", "source": "Telegram/avQcqITCN0CdPqbu_zPd1c2U29MoQRx_NSjCudrYTZic4II", "content": "", "creation_timestamp": "2026-06-09T23:00:05.000000Z"}, {"uuid": "7a24aabc-6c66-43fe-a5eb-4a31ca629e3e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46394", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/88073", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-46394-haxcms-git-command-injection\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a shreyas-challa\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a PHP\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-09 17:55:03\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC and writeup for CVE-2026-46394: OS command injection in HAXcms Git.php (CWE-78). Authorized security research only.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-12T10:00:03.523650Z"}, {"uuid": "c098783b-442d-413d-8a0a-6fce5e8a2500", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46395", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/88072", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-46395-haxcms-hmac-key-leak\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a shreyas-challa\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a JavaScript\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-09 17:55:02\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC and writeup for CVE-2026-46395: unauthenticated private key disclosure via broken HMAC in HAXcms Node.js (CWE-321/CWE-200). Authorized security research only.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-12T10:00:03.568779Z"}, {"uuid": "e49dbabe-c136-4bf7-b3c4-a5b31d8f9a6f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46394", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/88073", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-46394-haxcms-git-command-injection\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a shreyas-challa\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a PHP\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-09 17:55:03\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC and writeup for CVE-2026-46394: OS command injection in HAXcms Git.php (CWE-78). Authorized security research only.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-13T00:00:46.063175Z"}, {"uuid": "41432317-38c3-4cb0-bc7c-88ed5b5156e5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46395", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/88072", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-46395-haxcms-hmac-key-leak\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a shreyas-challa\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a JavaScript\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-09 17:55:02\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC and writeup for CVE-2026-46395: unauthenticated private key disclosure via broken HMAC in HAXcms Node.js (CWE-321/CWE-200). Authorized security research only.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-13T00:00:46.103700Z"}, {"uuid": "06255db4-f82a-4176-af6b-d7a7e8f4ac31", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46391", "type": "seen", "source": "https://t.me/GithubRedTeam/89695", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-46391\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a bradyjmcl\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Go\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-19 21:52:26\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nProof of concept exploit for CVE-2026-46391\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-13T22:00:22.492740Z"}, {"uuid": "7ddd77b7-2850-45e4-a4bc-62b5e1d5f931", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46391", "type": "seen", "source": "https://t.me/GithubRedTeam/89695", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-46391\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a bradyjmcl\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Go\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-19 21:52:26\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nProof of concept exploit for CVE-2026-46391\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-14T00:00:38.298791Z"}, {"uuid": "01af3134-9d32-48e1-891e-e2d31578ed80", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46391", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/89695", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-46391\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a bradyjmcl\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Go\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-19 21:52:26\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nProof of concept exploit for CVE-2026-46391\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-15T00:00:18.191634Z"}]}