CVE-2026-35146

MediumCVSS 6.3/10Last modified Oct 24, 2026

Description

HCL DFXServer is affected by an Unencrypted Communication vulnerability. The application permits users to establish connections over unencrypted channels via the HTTP protocol, which could allow a remote attacker to intercept network traffic and expose sensitive data transmitted between the user and the application.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-326

Affected software

No affected versions have been published.

Timeline

Published
Jul 16, 2026
Last modified
Oct 24, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-351478.2HCL DFXServer is affected by a Broken Authentication vulnerability via direct API access. The application fails to verify the user's authentCVE-2026-351486.3HCL DFXServer is affected by a Missing Access Control vulnerability. This vulnerability states that certain endpoints are accessible withoutCVE-2026-351498.2HCL DFXServer is affected by an Authentication Bypass vulnerability via server response manipulation. An unauthorized user without valid creCVE-2026-35158.5A vulnerability in the `GitHubRepository` block of the `prefect-github` integration in Prefect version 3.6.18 allows an attacker to inject aCVE-2026-351528.8A SQL Injection vulnerability exists in Apache Fineract's Report Execution API (runreports endpoint) in versions up to and including 1.14.0.CVE-2026-351536.7Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2CVE-2026-351546.7Dell PowerProtect Data Domain appliances, versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3CVE-2026-351557.1Dell iDRAC10, versions 1.20.70.50 and 1.30.05.10, contains an Insufficiently Protected Credentials vulnerability. A race condition vulnerabiCVE-2026-351579.8Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains an improper neutralization of formula eleCVE-2026-351595.3Dell Client Platform BIOS contains an Authentication Bypass by Primary Weakness vulnerability. An unauthenticated attacker with physical accCVE-2026-35166.4The Contact List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_cl_map_iframe' parameter in all versions up to,CVE-2026-351605.0Dell SmartFabric OS10 Software, versions prior to 10.5.6.14, contains an Improper Neutralization of Special Elements used in an OS Command (