# @haxtheweb/video-player (npm) vulnerabilities 2 known vulnerabilities (2 critical), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Weekly downloads: 84 - Dependents: 35 - Registry: https://www.npmjs.com/package/@haxtheweb/video-player ## Advisories (2) ### [CVE-2026-46496](https://cve.now/CVE-2026-46496): HAX CMS: Stored XSS via '\' component allows arbitrary JavaScript execution and token theft - Severity: Critical 9.3 - Published: Jun 5, 2026 - Affected: fixed in 26.0.0. ### [CVE-2026-46396](https://cve.now/CVE-2026-46396): HAX CMS has a stored XSS via \ that allows access to sensitive client-side data and account takeover - Severity: Critical 9.3 - Published: Jun 5, 2026 - Affected: fixed in 26.0.0. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/@haxtheweb/video-player Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.