Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 60

Export CSV
CVE-2026-35103

HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by an open redirect vulnerability on the role assignment pending page (RoleAssignPending component). The redirect to the login page used a URL taken from build configuration (NEXT_PUBLIC_LOGIN_URL) without validating the redirect destination. This may be used in phishing attacks, potentially resulting in unintended behavior or security impact under certain conditions.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Aion
CVE-2026-35104

HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by an open redirect vulnerability on the user registration page (Signup component). The redirect performed after registration used the value of the 'redirect' query parameter without validation, so a crafted registration link could send a user to an untrusted external site. This may be used in phishing attacks, potentially resulting in unintended behavior or security impact under certain conditions.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Aion
CVE-2026-21833

HCL AION is susceptible to a Missing "Content-Security-Policy" header Vulnerability (CVE-2026-21833)

HCL AION is affected by a vulnerability in which the Content-Security-Policy (CSP) HTTP response header is not configured. CSP helps prevent attacks such as Cross-Site Scripting (XSS) by restricting the sources from which scripts, styles, and other resources can be loaded. The absence of this header may reduce the effectiveness of browser-based security controls, potentially resulting in unintended behavior or negative security impacts under certain conditions.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Aion
CVE-2025-52640

HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a vulnerability where the shared storage used by product components is architected without sufficient access separation. Processes sharing the storage may be able to access or modify files beyond their intended scope, potentially resulting in unintended behavior or security impact under certain conditions.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Aion
CVE-2025-62314

HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a vulnerability where certain endpoints lack sufficient anti-automation controls. Automated or scripted requests may be submitted without adequate rate limiting or challenge mechanisms, potentially resulting in unintended behavior or security impact under certain conditions.

CVSS 3.1 · 5.6 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Aion
CVE-2025-62318

HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a vulnerability where JavaScript responses containing data could be referenced by external pages, potentially allowing sensitive information to be captured by an attacker-controlled page (JavaScript hijacking) under certain conditions.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Aion
CVE-2025-62315

HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a vulnerability where certain input fields do not enforce sufficient server-side input validation. Unexpected or crafted input may be accepted by the application, potentially resulting in unintended behavior or security impact under certain conditions.

CVSS 3.1 · 3.4 Low EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Aion
CVE-2026-21832

HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a vulnerability where indirect prompt injection can lead to HTML injection in rendered output. Injected markup may be displayed to users, potentially resulting in unintended behavior or security impact under certain conditions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Aion
CVE-2025-52641

Internal Filesystem Exploration vulnerability

HCL AION is affected by a vulnerability where certain system behaviours may allow exploration of internal filesystem structures. Exposure of such information may provide insights into the underlying environment, which could potentially aid in further targeted actions or limited information disclosure.

CVSS 3.1 · 2.9 Low EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Aion
CVE-2025-52650

HCL AION is susceptible to Inline script execution allowed in CSP vulnerability

Inline script execution allowed in CSP vulnerability has been identified in HCL AION v2.0

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Aion
CVE-2025-52624

HCL AION is susceptible to Bypass of the script allow list configuration vulnerability

A vulnerability  Bypass of the script allowlist configuration in HCL AION.  An incorrectly configured Content-Security-Policy header may allow unauthorized scripts to execute, increasing the risk of cross-site scripting and other injection-based attacks.This issue affects AION: 2.0.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Aion
CVE-2025-52623

HCL AION is affected by an Autocomplete HTML Attribute Not Disabled for Password Field vulnerability

HCL AION is affected by an Autocomplete HTML Attribute Not Disabled for Password Field vulnerability. This can allow autocomplete on password fields may lead to unintended storage or disclosure of sensitive credentials, potentially increasing the risk of unauthorized access. This issue affects AION: 2.0.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Aion
CVE-2025-52634

HCL AION is susceptible to Spring Boot Actuator Endpoints Exposed

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in HCL AION This issue affects HCL AION: 2.0.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Aion
CVE-2025-52633

HCL AION is susceptible to Missing Content-Security-Policy

HCL AION is affected by a Permanent Cookie Containing Sensitive Session Information vulnerability. It is storing sensitive session data in persistent cookies may increase the risk of unauthorized access if the cookies are intercepted or compromised. This issue affects AION: 2.0.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Aion
CVE-2025-52632

HCL AION is susceptible to Missing Secure Attribute in Encrypted Session (SSL) Cookie vulnerability

A Missing Secure Attribute in Encrypted Session (SSL) Cookie vulnerability in HCL AION.This issue affects AION: 2.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Aion
CVE-2025-52631

HCL AION is affected by a Missing or Insecure HTTP Strict-Transport-Security (HSTS) Header vulnerability.

HCL AION is affected by a Missing or Insecure HTTP Strict-Transport-Security (HSTS) Header vulnerability. This can allow insecure connections, potentially exposing the application to man-in-the-middle and protocol downgrade attacks.. This issue affects AION: 2.0.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Aion
CVE-2025-52630

HCL AION is susceptible to Missing or insecure "X-Content-Type-Options" header vulnerability

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in HCL AION.This issue affects AION: 2.0.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Aion
CVE-2025-52629

HCL AION is susceptible to Missing Content-Security-Policy

HCL AION is susceptible to Missing Content-Security-Policy.  An The absence of a CSP header may increase the risk of cross-site scripting and other content injection attacks by allowing unsafe scripts or resources to execute..This issue affects AION: 2.0.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Aion
CVE-2025-52635

HCL AION is susceptible to Trusted types in scripts not enforced in CSP

A rusted types in scripts not enforced in CSP vulnerability has been identified in HCL AION.This issue affects AION: 2.0.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Aion
CVE-2025-52660

HCL AION is affected by an Host Header Injection vulnerability

HCL AION is affected by an Unrestricted File Upload vulnerability. This can allow malicious file uploads, potentially resulting in unauthorized code execution or system compromise.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Aion