CVE-2026-35142

HighCVSS 8.2/10Last modified Oct 24, 2026

Description

HCL DFXAnalytics is affected by an Internal IP Address Disclosure vulnerability. The application includes internal IP address details within its generated server responses, which could allow a remote attacker to gather sensitive network topology information and use it to map the internal infrastructure for further targeted attacks.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
HCL Software	DFXAnalytics	version 3.0 and below

References

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0131787Vendor Advisory

Timeline

Published: Jul 16, 2026
Last modified: Oct 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-351436.5HCL DFXAnalytics is affected by a Missing SameSite Attribute vulnerability. The application fails to set the "SameSite" attribute on session CVE-2026-351453.1HCL DFXAnalytics is affected by a Missing HTTP Strict-Transport-Security Header vulnerability. The application fails to implement the HTTP S CVE-2026-351466.3HCL DFXServer is affected by an Unencrypted Communication vulnerability. The application permits users to establish connections over unencry CVE-2026-351478.2HCL DFXServer is affected by a Broken Authentication vulnerability via direct API access. The application fails to verify the user's authent CVE-2026-351486.3HCL DFXServer is affected by a Missing Access Control vulnerability. This vulnerability states that certain endpoints are accessible without CVE-2026-351498.2HCL DFXServer is affected by an Authentication Bypass vulnerability via server response manipulation. An unauthorized user without valid cre CVE-2026-35158.5A vulnerability in the `GitHubRepository` block of the `prefect-github` integration in Prefect version 3.6.18 allows an attacker to inject a CVE-2026-351528.8A SQL Injection vulnerability exists in Apache Fineract's Report Execution API (runreports endpoint) in versions up to and including 1.14.0.CVE-2026-351536.7Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2 CVE-2026-351546.7Dell PowerProtect Data Domain appliances, versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3 CVE-2026-351557.1Dell iDRAC10, versions 1.20.70.50 and 1.30.05.10, contains an Insufficiently Protected Credentials vulnerability. A race condition vulnerabi CVE-2026-351579.8Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains an improper neutralization of formula ele