EUVD-2026-118311

HCL AION is affected by a vulnerability where the application trusted the value of the HTTP Host header supplied in requests without validation. An attacker could manipulate this header to influence links, redirects or responses generated by the application, potentially resulting in unintended...

CVE-2026-66981 HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a vulnerability where the application trusted the value of the HTTP Host header supplied in requests without validation. An attacker could manipulate this header to influence links, redirects or responses generated by the application, potentially resulting in unintended...

CVE-2026-66981

HCL AION is affected by a security vulnerability where the application trusts the value of the HTTP Host header in requests without proper validation. An attacker could manipulate this header to influence redirects, links, or the responses generated by the application, potentially leading to unin...

CVE-2026-123339

Improper trust of forwarded headers in RouterListener::onKernelFinishRequest in Symfony HttpKernel versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11 allows a remote attacker to control the host, scheme, and port of absolute URLs generated for the rest of...

CVE-2026-112340

Wazuh dashboard plugins from 4.9.0 before 4.14.9 contain an authorization bypass vulnerability that allows authenticated dashboard users to override the Manager API Authorization header via the /api/request proxy endpoint. Attackers can supply nested body.headers.Authorization values that replace...

EUVD-2026-118283

Wazuh dashboard plugins from 4.9.0 before 4.14.9 contain an authorization bypass vulnerability that allows authenticated dashboard users to override the Manager API Authorization header via the /api/request proxy endpoint. Attackers can supply nested body.headers.Authorization values that replace...

CVE-2026-112340 Wazuh 4.9.0 before 4.14.9 Authorization Header Override via /api/request

Wazuh dashboard plugins from 4.9.0 before 4.14.9 contain an authorization bypass vulnerability that allows authenticated dashboard users to override the Manager API Authorization header via the /api/request proxy endpoint. Attackers can supply nested body.headers.Authorization values that replace...

CVE-2026-112340 Wazuh 4.9.0 before 4.14.9 Authorization Header Override via /api/request

Wazuh dashboard plugins from 4.9.0 before 4.14.9 contain an authorization bypass vulnerability that allows authenticated dashboard users to override the Manager API Authorization header via the /api/request proxy endpoint. Attackers can supply nested body.headers.Authorization values that replace...

CVE-2026-112340

Wazuh dashboard plugins versions 4.9.0 before 4.14.9 are affected by an authorization bypass vulnerability. The flaw exists in the /api/request proxy endpoint, where authenticated dashboard users can override the Manager API Authorization header. By supplying nested body.headers.Authorization val...

CVE-2026-21850

HCL AION is affected by a vulnerability where user-controlled input could be included in HTTP response headers without proper neutralization of CR/LF characters. This may allow an attacker to inject headers or split responses, potentially resulting in unintended behavior or security impact under...

EUVD-2026-118263

HCL AION is affected by a vulnerability where user-controlled input could be included in HTTP response headers without proper neutralization of CR/LF characters. This may allow an attacker to inject headers or split responses, potentially resulting in unintended behavior or security impact under...

CVE-2026-21850

HCL AION is affected by a vulnerability involving the improper neutralization of CR/LF characters in HTTP response headers. An attacker could provide user-controlled input that is included in these headers without proper sanitization, potentially enabling header injection or response splitting . ...

CVE-2026-21850 HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a vulnerability where user-controlled input could be included in HTTP response headers without proper neutralization of CR/LF characters. This may allow an attacker to inject headers or split responses, potentially resulting in unintended behavior or security impact under...

CVE-2026-35115

HCL AION is affected by a vulnerability where the HTTP Strict-Transport-Security HSTS header was missing or insecurely configured, so browsers were not instructed to always use HTTPS. This may allow connections to be downgraded or intercepted, potentially resulting in unintended behavior or...

EUVD-2026-118246

HCL AION is affected by a vulnerability where the Cross-Origin-Resource-Policy CORP header was missing or insecure, allowing application resources to be loaded by other origins. This may expose resources to cross-origin data leakage, potentially resulting in unintended behavior or security impact...

EUVD-2026-118244

HCL AION is affected by a vulnerability where the HTTP Strict-Transport-Security HSTS header was missing or insecurely configured, so browsers were not instructed to always use HTTPS. This may allow connections to be downgraded or intercepted, potentially resulting in unintended behavior or...

CVE-2026-35115 HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a vulnerability where the HTTP Strict-Transport-Security HSTS header was missing or insecurely configured, so browsers were not instructed to always use HTTPS. This may allow connections to be downgraded or intercepted, potentially resulting in unintended behavior or...

CVE-2026-35115

HCL AION is affected by a vulnerability involving a missing or insecurely configured HTTP Strict-Transport-Security (HSTS) header. Because browsers are not explicitly instructed to always use HTTPS, connections may be downgraded or intercepted, potentially leading to unintended behavior or securi...

io.netty/netty-codec-http2: HTTP/1 authority-form CONNECT is translated to malformed HTTP/2 CONNECT with Host-controlled :authority

A flaw was found in Netty's HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header instead of the CONNECT authority-form request-target for the tunnel authority. A remote attacker can exploit this by supplying a different Host header, leadi...

io.netty/netty: Netty: Information disclosure via CORS Vary header overwrite

A flaw was found in Netty, an asynchronous, event-driven network application framework. The CorsHandler component incorrectly replaces application Vary headers, such as Authorization or Cookie, with Origin. This allows a caching proxy or Content Delivery Network CDN to reuse authenticated respons...