Vulnerability in Haxtheweb Haxcms-php

CVE-2026-46398

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 25.0.0 and prior to version 26.0.0, the haxcms_refresh_token cookie is set without the Secure flag. This allows it to be transmitted over unencrypted…

EPSS: 0.002 (8.1th percentile) — read the EPSS interpretation.