CVE-2026-35141

MediumCVSS 5.3/10Last modified Oct 24, 2026

Description

HCL DFXAnalytics is affected by a Login Replay Attack vulnerability. The application allows a remote attacker to intercept, delay, or fraudulently retransmit valid authentication data to achieve unauthorized access. To mitigate this risk, the application must implement a mechanism to include timestamps with every message, ensuring that messages exceeding a specific age threshold are automatically rejected by the recipient system.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

Affected software

No affected versions have been published.

Timeline

Published
Jul 16, 2026
Last modified
Oct 24, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-351428.2HCL DFXAnalytics is affected by an Internal IP Address Disclosure vulnerability. The application includes internal IP address details withinCVE-2026-351436.5HCL DFXAnalytics is affected by a Missing SameSite Attribute vulnerability. The application fails to set the "SameSite" attribute on sessionCVE-2026-351453.1HCL DFXAnalytics is affected by a Missing HTTP Strict-Transport-Security Header vulnerability. The application fails to implement the HTTP SCVE-2026-351466.3HCL DFXServer is affected by an Unencrypted Communication vulnerability. The application permits users to establish connections over unencryCVE-2026-351478.2HCL DFXServer is affected by a Broken Authentication vulnerability via direct API access. The application fails to verify the user's authentCVE-2026-351486.3HCL DFXServer is affected by a Missing Access Control vulnerability. This vulnerability states that certain endpoints are accessible withoutCVE-2026-351498.2HCL DFXServer is affected by an Authentication Bypass vulnerability via server response manipulation. An unauthorized user without valid creCVE-2026-35158.5A vulnerability in the `GitHubRepository` block of the `prefect-github` integration in Prefect version 3.6.18 allows an attacker to inject aCVE-2026-351528.8A SQL Injection vulnerability exists in Apache Fineract's Report Execution API (runreports endpoint) in versions up to and including 1.14.0.CVE-2026-351536.7Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2CVE-2026-351546.7Dell PowerProtect Data Domain appliances, versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3CVE-2026-351557.1Dell iDRAC10, versions 1.20.70.50 and 1.30.05.10, contains an Insufficiently Protected Credentials vulnerability. A race condition vulnerabi
CVE-2026-35141: Medium severity, CVSS 5.3 | Vulnix