CVE-2026-5345

HCL AION is affected by a missing encryption vulnerability in a second WebSocket connection defined in the GenAI web interface. The connection used the unencrypted WebSocket protocol ws://test instead of an encrypted wss:// channel. This may allow data exchanged over the connection to be...

CVE-2026-21849

HCL AION is affected by a missing encryption vulnerability in the WebSocket connection set up by the GenAI web interface. The connection used the unencrypted WebSocket protocol ws://localhost:8000 instead of an encrypted wss:// channel. This may allow data exchanged over the connection to be...

EUVD-2026-118262

HCL AION is affected by a missing encryption vulnerability in a second WebSocket connection defined in the GenAI web interface. The connection used the unencrypted WebSocket protocol ws://test instead of an encrypted wss:// channel. This may allow data exchanged over the connection to be...

CVE-2026-5345 HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a missing encryption vulnerability in a second WebSocket connection defined in the GenAI web interface. The connection used the unencrypted WebSocket protocol ws://test instead of an encrypted wss:// channel. This may allow data exchanged over the connection to be...

CVE-2026-5345

The HCL AION platform is affected by a missing encryption vulnerability (CWE-311) within the GenAI web interface . The vulnerability stems from a second WebSocket connection using the unencrypted ws://test protocol instead of the secure wss:// channel. This flaw could allow an attacker on the net...

CVE-2026-21849

HCL AION is affected by a missing encryption vulnerability within the GenAI web interface . The application uses an unencrypted WebSocket protocol (ws://localhost:8000 ) instead of a secure wss:// channel. This configuration could allow an attacker on the network to intercept or read data exchang...

EUVD-2026-118261

HCL AION is affected by a missing encryption vulnerability in the WebSocket connection set up by the GenAI web interface. The connection used the unencrypted WebSocket protocol ws://localhost:8000 instead of an encrypted wss:// channel. This may allow data exchanged over the connection to be...

CVE-2026-21849 HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a missing encryption vulnerability in the WebSocket connection set up by the GenAI web interface. The connection used the unencrypted WebSocket protocol ws://localhost:8000 instead of an encrypted wss:// channel. This may allow data exchanged over the connection to be...

CVE-2026-87830

A flaw was found in Apache WSS4J. In the streaming security policy validator, specific XML Path Language XPath expressions can fail to resolve against actual message structures. A remote attacker can exploit this issue to bypass security policy checks by sending message elements that lack require...

CVE-2026-5345: HCL Software HCL AION: HCL AION is affected by a missing encryption vulnerability in a second WebSocket connection defined in the GenAI web…

HCL AION is affected by a missing encryption vulnerability in a second WebSocket connection defined in the GenAI web interface. The connection used the unencrypted WebSocket protocol ws://test instead of an encrypted wss:// channel. This may allow data exchanged over the connection to be...

CVE-2026-21849: HCL Software HCL AION: HCL AION is affected by a missing encryption vulnerability in the WebSocket connection set up by the GenAI web interface

HCL AION is affected by a missing encryption vulnerability in the WebSocket connection set up by the GenAI web interface. The connection used the unencrypted WebSocket protocol ws://localhost:8000 instead of an encrypted wss:// channel. This may allow data exchanged over the connection to be...

CVE-2026-116198

Snipe-IT before 8.7.0 contains a missing encryption vulnerability in Api\AssetsController::store that writes plaintext into encrypted-flagged custom-field columns when callers lack assets.view.encryptedcustomfields. Authenticated API users without that permission can create assets whose sensitive...

CVE-2026-116198 Snipe-IT before 8.7.0 Missing Encryption via Api AssetsController store

Snipe-IT before 8.7.0 contains a missing encryption vulnerability in Api\AssetsController::store that writes plaintext into encrypted-flagged custom-field columns when callers lack assets.view.encryptedcustomfields. Authenticated API users without that permission can create assets whose sensitive...

CVE-2026-116198

Versions of Snipe-IT before 8.7.0 are vulnerable to a missing encryption flaw in the Api echtAssetsController::store method. The root cause is that the application fails to encrypt data when callers lack the assets.view.encrypted_custom_fields permission. Consequently, authenticated API users wit...

CVE-2026-116198 Snipe-IT before 8.7.0 Missing Encryption via Api AssetsController store

Snipe-IT before 8.7.0 contains a missing encryption vulnerability in Api\AssetsController::store that writes plaintext into encrypted-flagged custom-field columns when callers lack assets.view.encryptedcustomfields. Authenticated API users without that permission can create assets whose sensitive...

EUVD-2026-109456

Snipe-IT before 8.7.0 contains a missing encryption vulnerability in Api\AssetsController::store that writes plaintext into encrypted-flagged custom-field columns when callers lack assets.view.encryptedcustomfields. Authenticated API users without that permission can create assets whose sensitive...

CVE-2026-116198 Snipe-IT before 8.7.0 Missing Encryption via Api AssetsController store

Snipe-IT before 8.7.0 contains a missing encryption vulnerability in Api\AssetsController::store that writes plaintext into encrypted-flagged custom-field columns when callers lack assets.view.encryptedcustomfields. Authenticated API users without that permission can create assets whose sensitive...

PT-2026-123039

Snipe-IT before 8.7.0 contains a missing encryption vulnerability in ApiAssetsController::store that writes plaintext into encrypted-flagged custom-field columns when callers lack assets.view.encrypted custom fields. Authenticated API users without that permission can create assets whose sensitiv...

CVE-2026-115247

A security vulnerability has been detected in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This vulnerability affects unknown code of the file patientregistration.php. The manipulation of the argument patpswd/docpswd leads to missing encryption of...

CVE-2026-115247 subhajitkhan online-clinic-management-system patientregistration.php missing encryption

A security vulnerability has been detected in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This vulnerability affects unknown code of the file patientregistration.php. The manipulation of the argument patpswd/docpswd leads to missing encryption of...