CVE-2026-35110

MediumCVSS 5.4/10Last modified Nov 6, 2026

Description

HCL AION is affected by a vulnerability where encrypted (HTTPS) communication was not enforced for all requests. Data may be transmitted over unencrypted connections and intercepted by an attacker on the network, potentially resulting in unintended behavior or security impact under certain conditions.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L

Weakness enumeration

CWE-311

Affected software

Vendor	Product	Versions
HCL Software	HCL AION	V 2.6.0

References

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0135118

Timeline

Published: Nov 6, 2026
Last modified: Nov 6, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-351114.8HCL AION is affected by a vulnerability where the Cross-Origin-Resource-Policy (CORP) header was missing or insecure, allowing application r CVE-2026-351124.2HCL AION is affected by a vulnerability where the Cross-Origin-Embedder-Policy (COEP) header was missing or insecure, so embedded cross-orig CVE-2026-351134.8HCL AION is affected by a vulnerability where the Cross-Origin-Opener-Policy (COOP) header was missing or insecure, allowing cross-origin do CVE-2026-351143.7HCL AION is affected by a vulnerability where the X-Content-Type-Options header was missing or insecure, allowing browsers to MIME-sniff res CVE-2026-351153.7HCL AION is affected by a vulnerability where the HTTP Strict-Transport-Security (HSTS) header was missing or insecurely configured, so brow CVE-2026-35126.1The Writeprint Stylometry plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'p' GET parameter in all versions up CVE-2026-35136.4The TableOn – WordPress Posts Table Filterable plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tableon_button' sh CVE-2026-35147.5In version 3.6.19 of prefecthq/prefect, an authentication bypass vulnerability exists due to the improper handling of URL path exemptions fo CVE-2026-351407.2HCL DFXAnalytics is affected by a Missing Secure Attribute in Encrypted Session (SSL) Cookie vulnerability. The application fails to set the CVE-2026-351415.3HCL DFXAnalytics is affected by a Login Replay Attack vulnerability. The application allows a remote attacker to intercept, delay, or fraudu CVE-2026-351428.2HCL DFXAnalytics is affected by an Internal IP Address Disclosure vulnerability. The application includes internal IP address details within CVE-2026-351436.5HCL DFXAnalytics is affected by a Missing SameSite Attribute vulnerability. The application fails to set the "SameSite" attribute on session