CVE-2026-35145

HCL DFXAnalytics is affected by a Missing HTTP Strict-Transport-Security Header vulnerability. The application fails to implement the HTTP Strict Transport Security (HSTS) policy within its responses, which could allow a remote attacker to downgrade the communication channel to an unencrypted connection (HTTP) and conduct man-in-the-middle (MitM) attacks. To remediate this, the application must include the "Strict-Transport-Security" header in all web application responses.

• CWE-200

• https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0131787Vendor Advisory

Published

Jul 16, 2026

Last Modified

Jul 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-3513The TableOn – WordPress Posts Table Filterable plugin for Wo…6.4
• CVE-2026-3514In version 3.6.19 of prefecthq/prefect, an authentication by…7.5
• CVE-2026-35140HCL DFXAnalytics is affected by a Missing Secure Attribute i…7.2
• CVE-2026-35141HCL DFXAnalytics is affected by a Login Replay Attack vulner…5.3
• CVE-2026-35142HCL DFXAnalytics is affected by an Internal IP Address Discl…8.2
• CVE-2026-35143HCL DFXAnalytics is affected by a Missing SameSite Attribute…6.5
• CVE-2026-35146HCL DFXServer is affected by an Unencrypted Communication vu…6.3
• CVE-2026-35147HCL DFXServer is affected by a Broken Authentication vulnera…8.2
• CVE-2026-35148HCL DFXServer is affected by a Missing Access Control vulner…6.3
• CVE-2026-35149HCL DFXServer is affected by an Authentication Bypass vulner…8.2
• CVE-2026-3515A vulnerability in the `GitHubRepository` block of the `pref…8.5
• CVE-2026-35152A SQL Injection vulnerability exists in Apache Fineract's Re…8.8