Home / CVEs
CVE Database
Published vulnerabilities with severity, known exploitation and official sources.
CVE-2026-21833
Low · 3.7
CWE-1032 Oct 1, 2026
HCL AION is susceptible to a Missing "Content-Security-Policy" header Vulnerability (CVE-2026-21833)
HCL AION is affected by a vulnerability in which the Content-Security-Policy (CSP) HTTP response header is not configured. CSP helps prevent attacks such as Cross-Site Scripting (XSS) by restricting the sources from which scripts, styles, and other resources can be loaded. The absence of this header may reduce the effectiveness of browser-based security controls, potentially resulting in unintended behavior or negative security impacts under certain conditions.
CVE-2025-52629
Medium · 6.1
CWE-1032 Feb 3, 2026
HCL AION is susceptible to Missing Content-Security-Policy
HCL AION is susceptible to Missing Content-Security-Policy.
An The absence of a CSP header may increase the risk of cross-site scripting and other content injection attacks by allowing unsafe scripts or resources to execute..This issue affects AION: 2.0.
CVE-2025-52635
Critical · 9.8
CWE-1032 Oct 10, 2025
HCL AION is susceptible to Trusted types in scripts not enforced in CSP
A
rusted types in scripts not enforced in CSP vulnerability has been identified
in HCL AION.This issue affects AION: 2.0.
CVE-2025-52650
Medium · 6.1
CWE-1032 Oct 10, 2025
HCL AION is susceptible to Inline script execution allowed in CSP vulnerability
Inline script execution allowed in CSP vulnerability has been identified in HCL AION v2.0