Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 60

Export CSV
CVE-2026-66982

HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a vulnerability where browser autocomplete was enabled on sensitive login form fields, allowing the browser to store and suggest previously entered values. A malicious user with access to the same browser or system could retrieve saved credentials, potentially resulting in unintended behavior or security impact under certain conditions.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Aion
CVE-2026-66987

HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a vulnerability where the account lockout mechanism did not sufficiently restrict repeated failed login attempts, allowing an attacker to make a large number of password guesses against a user account. This may increase the risk of account compromise through brute-force attacks, potentially resulting in unintended behavior or security impact under certain conditions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Aion
CVE-2026-66986

HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a vulnerability where user sessions did not expire after a sufficient period of inactivity. An unattended authenticated session could be used by another person with access to the same system to view information or perform actions on behalf of the user, potentially resulting in unintended behavior or security impact under certain conditions.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Aion
CVE-2026-66984

HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a vulnerability where certain application responses revealed internal server file system paths. This information could help an attacker understand the application structure and plan further attacks, potentially resulting in unintended behavior or security impact under certain conditions.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Aion
CVE-2026-66981

HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a vulnerability where the application trusted the value of the HTTP Host header supplied in requests without validation. An attacker could manipulate this header to influence links, redirects or responses generated by the application, potentially resulting in unintended behavior or security impact under certain conditions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Aion
CVE-2026-21834

HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a vulnerability where the Content-Security-Policy (CSP) security response header was missing from application responses. Without this header, the browser does not restrict the sources of scripts and other content, increasing exposure to cross-site scripting and content-injection attacks, potentially resulting in unintended behavior or security impact under certain conditions.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Aion
CVE-2026-35111

HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a vulnerability where the Cross-Origin-Resource-Policy (CORP) header was missing or insecure, allowing application resources to be loaded by other origins. This may expose resources to cross-origin data leakage, potentially resulting in unintended behavior or security impact under certain conditions.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Aion
CVE-2026-35106

HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by an open redirect vulnerability in the session-handling logic of the GenAI web interface (UserContext component, line 89). A second redirect to the login page in this component used a URL taken from build configuration (NEXT_PUBLIC_LOGIN_URL) without validating the redirect destination. This may be used in phishing attacks, potentially resulting in unintended behavior or security impact under certain conditions.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Aion
CVE-2026-35114

HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a vulnerability where the X-Content-Type-Options header was missing or insecure, allowing browsers to MIME-sniff responses. This may cause content to be interpreted as an unintended type, potentially resulting in unintended behavior or security impact under certain conditions.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Aion
CVE-2026-35103

HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by an open redirect vulnerability on the role assignment pending page (RoleAssignPending component). The redirect to the login page used a URL taken from build configuration (NEXT_PUBLIC_LOGIN_URL) without validating the redirect destination. This may be used in phishing attacks, potentially resulting in unintended behavior or security impact under certain conditions.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Aion
CVE-2026-21850

HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a vulnerability where user-controlled input could be included in HTTP response headers without proper neutralization of CR/LF characters. This may allow an attacker to inject headers or split responses, potentially resulting in unintended behavior or security impact under certain conditions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Aion
CVE-2026-21849

HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a missing encryption vulnerability in the WebSocket connection set up by the GenAI web interface. The connection used the unencrypted WebSocket protocol (ws://localhost:8000) instead of an encrypted (wss://) channel. This may allow data exchanged over the connection to be intercepted or read by an attacker on the network, potentially resulting in unintended behavior or security impact under certain conditions.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Aion
CVE-2026-35110

HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a vulnerability where encrypted (HTTPS) communication was not enforced for all requests. Data may be transmitted over unencrypted connections and intercepted by an attacker on the network, potentially resulting in unintended behavior or security impact under certain conditions.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Aion
CVE-2026-35105

HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by an open redirect vulnerability in the session-handling logic of the GenAI web interface (UserContext component, line 78). The redirect to the login page used a URL taken from build configuration (NEXT_PUBLIC_LOGIN_URL) without validating the redirect destination. This may be used in phishing attacks, potentially resulting in unintended behavior or security impact under certain conditions.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Aion
CVE-2026-35113

HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a vulnerability where the Cross-Origin-Opener-Policy (COOP) header was missing or insecure, allowing cross-origin documents to share a browsing context with the application. This may enable cross-window attacks, potentially resulting in unintended behavior or security impact under certain conditions.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Aion
CVE-2026-35107

HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by an open redirect vulnerability in the user menu of the GenAI web interface (UserMenu component). The redirect to the login page on logout used a URL taken from build configuration (NEXT_PUBLIC_LOGIN_URL) without validating the redirect destination. This may be used in phishing attacks, potentially resulting in unintended behavior or security impact under certain conditions.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Aion
CVE-2026-35112

HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a vulnerability where the Cross-Origin-Embedder-Policy (COEP) header was missing or insecure, so embedded cross-origin resources were not required to explicitly grant permission. This weakens cross-origin isolation, potentially resulting in unintended behavior or security impact under certain conditions.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Aion
CVE-2026-5345

HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a missing encryption vulnerability in a second WebSocket connection defined in the GenAI web interface. The connection used the unencrypted WebSocket protocol (ws://test) instead of an encrypted (wss://) channel. This may allow data exchanged over the connection to be intercepted or read by an attacker on the network, potentially resulting in unintended behavior or security impact under certain conditions.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Aion
CVE-2026-35104

HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by an open redirect vulnerability on the user registration page (Signup component). The redirect performed after registration used the value of the 'redirect' query parameter without validation, so a crafted registration link could send a user to an untrusted external site. This may be used in phishing attacks, potentially resulting in unintended behavior or security impact under certain conditions.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Aion
CVE-2026-35109

HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a vulnerability where pages served over HTTPS could be cached by the browser or intermediate proxies. Sensitive information in cached responses may be retrieved by an unauthorized user with access to the cache, potentially resulting in unintended behavior or security impact under certain conditions.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Aion