Hcl Software Hcl Aion
21 CVEs affecting Hcl Software Hcl Aion. Latest disclosed: 2026-11-06. Critical: 0, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-66981 | Medium | 6.5 | 2026-11-06 | HCL AION is affected by a vulnerability where the application trusted the value of the HTTP Host header supplied in requests without validation. An attacker co… |
CVE-2026-21850 | Medium | 6.5 | 2026-11-06 | HCL AION is affected by a vulnerability where user-controlled input could be included in HTTP response headers without proper neutralization of CR/LF character… |
CVE-2026-35110 | Medium | 5.4 | 2026-11-06 | HCL AION is affected by a vulnerability where encrypted (HTTPS) communication was not enforced for all requests. Data may be transmitted over unencrypted conne… |
CVE-2026-66987 | Medium | 5.3 | 2026-11-06 | HCL AION is affected by a vulnerability where the account lockout mechanism did not sufficiently restrict repeated failed login attempts, allowing an attacker… |
CVE-2026-35113 | Medium | 4.8 | 2026-11-06 | HCL AION is affected by a vulnerability where the Cross-Origin-Opener-Policy (COOP) header was missing or insecure, allowing cross-origin documents to share a… |
CVE-2026-35111 | Medium | 4.8 | 2026-11-06 | HCL AION is affected by a vulnerability where the Cross-Origin-Resource-Policy (CORP) header was missing or insecure, allowing application resources to be load… |
CVE-2026-35107 | Medium | 4.7 | 2026-11-06 | HCL AION is affected by an open redirect vulnerability in the user menu of the GenAI web interface (UserMenu component). The redirect to the login page on logo… |
CVE-2026-35106 | Medium | 4.7 | 2026-11-06 | HCL AION is affected by an open redirect vulnerability in the session-handling logic of the GenAI web interface (UserContext component, line 89). A second redi… |
CVE-2026-35105 | Medium | 4.7 | 2026-11-06 | HCL AION is affected by an open redirect vulnerability in the session-handling logic of the GenAI web interface (UserContext component, line 78). The redirect… |
CVE-2026-35104 | Medium | 4.7 | 2026-11-06 | HCL AION is affected by an open redirect vulnerability on the user registration page (Signup component). The redirect performed after registration used the val… |
CVE-2026-35103 | Medium | 4.7 | 2026-11-06 | HCL AION is affected by an open redirect vulnerability on the role assignment pending page (RoleAssignPending component). The redirect to the login page used a… |
CVE-2026-35102 | Medium | 4.7 | 2026-11-06 | HCL AION is affected by an open redirect vulnerability in the navigation bar of the GenAI web interface (Navbar component). The switch-version action redirecte… |
CVE-2026-35112 | Medium | 4.2 | 2026-11-06 | HCL AION is affected by a vulnerability where the Cross-Origin-Embedder-Policy (COEP) header was missing or insecure, so embedded cross-origin resources were n… |
CVE-2026-5345 | Low | 3.7 | 2026-11-06 | HCL AION is affected by a missing encryption vulnerability in a second WebSocket connection defined in the GenAI web interface. The connection used the unencry… |
CVE-2026-35109 | Low | 3.7 | 2026-11-06 | HCL AION is affected by a vulnerability where pages served over HTTPS could be cached by the browser or intermediate proxies. Sensitive information in cached r… |
CVE-2026-21849 | Low | 3.7 | 2026-11-06 | HCL AION is affected by a missing encryption vulnerability in the WebSocket connection set up by the GenAI web interface. The connection used the unencrypted W… |
CVE-2026-35114 | Low | 3.7 | 2026-11-06 | HCL AION is affected by a vulnerability where the X-Content-Type-Options header was missing or insecure, allowing browsers to MIME-sniff responses. This may ca… |
CVE-2026-66986 | Low | 3.3 | 2026-11-06 | HCL AION is affected by a vulnerability where user sessions did not expire after a sufficient period of inactivity. An unattended authenticated session could b… |
CVE-2026-66982 | Low | 3.3 | 2026-11-06 | HCL AION is affected by a vulnerability where browser autocomplete was enabled on sensitive login form fields, allowing the browser to store and suggest previo… |
CVE-2026-66984 | Low | 3.1 | 2026-11-06 | HCL AION is affected by a vulnerability where certain application responses revealed internal server file system paths. This information could help an attacker… |