CVE-2026-21826

MediumCVSS 6.1/10Last modified Jul 23, 2026

Description

HCL Digital Experience and HCL Digital Experience Compose could be susceptible to Host header injection.  An attacker can manipulate the Host header and cause the application to behave in unexpected ways.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-601

Affected software

VendorProductVersions
HCLSoftwareDigital Experience & DX Compose9.5

References

Timeline

Published
Jun 5, 2026
Last modified
Jul 23, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-218273.1HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive information they are nCVE-2026-21839.8A security vulnerability has been detected in Great Developers Certificate Generation System up to 97171bb0e5e22e52eacf4e4fa81773e5f3cffb73.CVE-2026-218303.7HCL BigFix AEX product is affected by a vulnerability in the aws-sdk package.. It may cause AWS API requests to be sent to unintended or nonCVE-2026-218324.3HCL AION is affected by a vulnerability where indirect prompt injection can lead to HTML injection in rendered output. Injected markup may bCVE-2026-218333.7HCL AION is affected by a vulnerability in which the Content-Security-Policy (CSP) HTTP response header is not configured. CSP helps preventCVE-2026-218343.1HCL AION is affected by a vulnerability where the Content-Security-Policy (CSP) security response header was missing from application responCVE-2026-218366.5The HCL DominoIQ RAG feature is affected by a Broken Access Control vulnerability.  Under certain circumstances, document level access restrCVE-2026-218378.8HCL Digital Experience is affected by an OS command injection vulnerability in the Digital Asset Management API.  An attacker may execute arCVE-2026-21849.8A vulnerability was detected in Great Developers Certificate Generation System up to 97171bb0e5e22e52eacf4e4fa81773e5f3cffb73. This vulnerabCVE-2026-218403.1HCL BigFix Platform is affected by a user enumeration vulnerability which might allow an attacker, through careful system control and responCVE-2026-218485.0HCL BigFix Service Management is affected by a Security Misconfiguration vulnerability, which could allow an authenticated attacker to exploCVE-2026-218493.7HCL AION is affected by a missing encryption vulnerability in the WebSocket connection set up by the GenAI web interface. The connection use