pkg:npm/@haxtheweb/video-player
2 total CVEs
✅ Check your installed version
All known vulnerabilities
—CVE-2026-46396Stored XSS via <iframe> in HAX CMS allows access to sensitive client-side data and account takeover from 0, < 26.0.0
—CVE-2026-46496HAX CMS: Stored XSS via '<video-player>' component allows arbitrary JavaScript execution and token theft from 0, < 26.0.0