CVE-2026-35146

MediumCVSS 6.3/10Last modified Oct 24, 2026

Description

HCL DFXServer is affected by an Unencrypted Communication vulnerability. The application permits users to establish connections over unencrypted channels via the HTTP protocol, which could allow a remote attacker to intercept network traffic and expose sensitive data transmitted between the user and the application.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-326

Affected software

Vendor	Product	Versions
HCLSoftware	DFXServer	version 2.5 and below

References

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0131782Vendor Advisory

Timeline

Published: Jul 16, 2026
Last modified: Oct 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-351478.2HCL DFXServer is affected by a Broken Authentication vulnerability via direct API access. The application fails to verify the user's authent CVE-2026-351486.3HCL DFXServer is affected by a Missing Access Control vulnerability. This vulnerability states that certain endpoints are accessible without CVE-2026-351498.2HCL DFXServer is affected by an Authentication Bypass vulnerability via server response manipulation. An unauthorized user without valid cre CVE-2026-35158.5A vulnerability in the `GitHubRepository` block of the `prefect-github` integration in Prefect version 3.6.18 allows an attacker to inject a CVE-2026-351528.8A SQL Injection vulnerability exists in Apache Fineract's Report Execution API (runreports endpoint) in versions up to and including 1.14.0.CVE-2026-351536.7Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2 CVE-2026-351546.7Dell PowerProtect Data Domain appliances, versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3 CVE-2026-351557.1Dell iDRAC10, versions 1.20.70.50 and 1.30.05.10, contains an Insufficiently Protected Credentials vulnerability. A race condition vulnerabi CVE-2026-351579.8Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains an improper neutralization of formula ele CVE-2026-351595.3Dell Client Platform BIOS contains an Authentication Bypass by Primary Weakness vulnerability. An unauthenticated attacker with physical acc CVE-2026-35166.4The Contact List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_cl_map_iframe' parameter in all versions up to,CVE-2026-351605.0Dell SmartFabric OS10 Software, versions prior to 10.5.6.14, contains an Improper Neutralization of Special Elements used in an OS Command (