CVE-2025-62308
HCL AION is affected by a vulnerability where sensitive backend infrastructure details may be exposed. Exposure of such information could re
CVSS
5.1
Medium
EPSS
0.1%
p1
KEV
—
Exploit Today
0
0-100
Published: May 14, 2026 · Last modified: Oct 7, 2026 · CWE-201
0.1%EPSS · 30 days0.1%
2026-10-042026-10-31
HCL AION is affected by a vulnerability where sensitive backend infrastructure details may be exposed. Exposure of such information could reveal internal system architecture or configuration details, which may potentially assist in further analysis or targeted actions under certain conditions
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1168617.5 HIG26.9%
——8Unauthenticated Sensitive Data Exposure in Flexible Chat <= 1.1.0 versions.3dCVE-2026-1159476.5 MED12.4%
——4Unauthenticated Sensitive Data Exposure in HUSKY <= 1.4.6 versions.3dCVE-2026-1195645.3 MED21.8%
——7Plausible Analytics Community Edition through 3.2.1 contains an information exposure vulnerability that allows site editors to obtain pending invitation and ownership-transfer IDs from the settings/people page. Attackers can register with the invitee's email using the exposed ID and accept it, gaining the invited role or taking site ownership.3dCVE-2026-1072684.3 MED22.2%
——7Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Two Factor Authentication - TFA / Passwordless Login allows Forceful Browsing. This issue affects Two Factor Authentication - TFA / Passwordless Login versions: from 0.0.0 to 5.4.1, from 5.5.0 to 5.5.2.3dCVE-2026-450498.3 HIG26.4%
——8Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the `Cross-Domain Single Sign-On` (`CDSSO`) servlet allows a logged-in user's raw OpenAM session token to be POSTed to an attacker-controlled URL. An attacker who induces an authenticated victim to visit a crafted URL can receive the session credential and potentially hijack the session. Deployments must have `CDSSO` enabled, as is common in multi-domain deployments, and exploitation is additionally gated on a non-default configuration being absent. This issue is fixed in version 16.1.1.3dCVE-2026-482005.3 MED20.8%
——6Insertion of Sensitive Information Into Sent Data vulnerability in Barn2 Plugins Document Library Lite document-library-lite allows Retrieve Embedded Sensitive Data.This issue affects Document Library Lite: from n/a through 1.3.0.4d