CVE-2026-21834
HCL AION is affected by a vulnerability where the Content-Security-Policy (CSP) security response header was missing from application respon
CVSS
3.1
Low
EPSS
—
KEV
—
Exploit Today
0
0-100
Published: Nov 6, 2026 · Last modified: Nov 6, 2026 · CWE-1021
Not enough EPSS history yet.
HCL AION is affected by a vulnerability where the Content-Security-Policy (CSP) security response header was missing from application responses. Without this header, the browser does not restrict the sources of scripts and other content, increasing exposure to cross-site scripting and content-injection attacks, potentially resulting in unintended behavior or security impact under certain conditions.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1238503.5 LOW—
——0In JetBrains YouTrack before 2026.2.19422 cSS injection was possible in Mermaid diagrams via configuration directives7hCVE-2026-1233115.3 MED—
——0In JetBrains IntelliJ IDEA before 2026.3,
2026.2.4 command execution via a hidden run control in the Markdown preview was possible6hCVE-2026-181594.3 MED10.3%
——3A vulnerability in OpenText OpenText Directory Services (OTDS) on Windows and Linux allows Clickjacking.
This issue affects OpenText Directory Services (OTDS): from 10.5 through 26.2.6hCVE-2026-1085364.6 MED5.0%
——1IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to bypass security restrictions due to improper restriction of rendered UI layers or frames.2dCVE-2026-108049—36.5%
——11Clickjacking vulnerability in the Alosuite web application. The affected login interface can be embedded in a web page controlled by an attacker because it does not implement adequate user interface protection mechanisms, such as the X-Frame-Options header or an appropriate Content-Security-Policy (frame-ancestors) directive. By tricking a victim into interacting with a malicious web page, an attacker can trigger unwanted actions within the Alosuite application embedded in the frame, which could compromise the integrity of user interactions and facilitate further attacks against authenticated users.3dCVE-2026-1197154.3 MED12.0%
——4NocoDB before 2026.08.0 contains a clickjacking vulnerability that allows any origin to frame the authenticated interface because no X-Frame-Options or CSP frame-ancestors headers are sent. Attackers can overlay a signed-in user's session from a malicious page, tricking clicks that modify or delete records, change sharing settings, or invite collaborators.2d