CVE-2026-21826
MEDIUMDescription
HCL Digital Experience and HCL Digital Experience Compose could be susceptible to Host header injection. An attacker can manipulate the Host header and cause the application to behave in unexpected ways.
Is your site exposed to CVE-2026-21826?
Run a free security scan — no signup, results in seconds.
CVSS v3.1 Score
EPSS — Exploit Prediction
EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.
Weakness Type (CWE)
Affected Products
| Vendor | Product |
|---|---|
| hcltech | digital_experience_compose |
| hcltech | digital_experience_compose |
| hcltech | digital_experience_compose |
| hcltech | digital_experience_compose |
| hcltech | digital_experience_compose |
| hcltech | digital_experience_compose |
| hcltech | digital_experience_compose |
| hcltech | digital_experience_compose |
| hcltech | digital_experience_compose |
| hcltech | digital_experience_compose |
| hcltech | digital_experience_compose |
| hcltech | digital_experience_compose |
| hcltech | digital_experience |
| hcltech | digital_experience |
| hcltech | digital_experience |
| hcltech | digital_experience |
| hcltech | digital_experience |
| hcltech | digital_experience |
| hcltech | digital_experience |
| hcltech | digital_experience |
| hcltech | digital_experience |
| hcltech | digital_experience |
| hcltech | digital_experience |
| hcltech | digital_experience |
| hcltech | digital_experience |
| hcltech | digital_experience |
| hcltech | digital_experience |
| hcltech | digital_experience |
| hcltech | digital_experience |
| hcltech | digital_experience |
| hcltech | digital_experience |
| hcltech | digital_experience |
| hcltech | digital_experience |
| hcltech | digital_experience |
| hcltech | digital_experience |
| hcltech | digital_experience |
| hcltech | digital_experience |
| hcltech | digital_experience |
| hcltech | digital_experience |
| hcltech | digital_experience |
| hcltech | digital_experience |
| hcltech | digital_experience |
| hcltech | digital_experience |
| hcltech | digital_experience |
| hcltech | digital_experience |
| hcltech | digital_experience |
| hcltech | digital_experience |
| hcltech | digital_experience |
| hcltech | digital_experience |
| hcltech | digital_experience |
| hcltech | digital_experience |
| hcltech | digital_experience |
| hcltech | digital_experience |
| hcltech | digital_experience |
| hcltech | digital_experience |
| hcltech | digital_experience |
| hcltech | digital_experience |
| hcltech | digital_experience |
| hcltech | digital_experience |
| hcltech | digital_experience |
| hcltech | digital_experience |
| hcltech | digital_experience |
| hcltech | digital_experience |
| hcltech | digital_experience |
| hcltech | digital_experience |
| hcltech | digital_experience |
| hcltech | digital_experience |
References
Advisories & Patches
Frequently Asked Questions
What is CVE-2026-21826? +
How severe is CVE-2026-21826? +
What products are affected by CVE-2026-21826? +
How do I check if I'm vulnerable to CVE-2026-21826? +
Related Vulnerabilities
SickChill is an automatic video library manager for TV shows. A user-controlled `login` endpoint's `next_` parameter takes arbitrary content. Prior …
next-intl provides internationalization for Next.js. Applications using the `next-intl` middleware prior to version 4.9.1with `localePrefix: 'as-needed'` could construct URLs where …
Kargo manages and automates the promotion of software artifacts. Prior to versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2, Kargo is vulnerable …
Open redirection vulnerability in the authentication system allows an attacker to use manipulated values in the X-Forwarded-Host header to alter …
Open redirection vulnerability due to insufficient validation of the X-Forwarded-Host HTTP header. An attacker could create manipulated links that, when …
smartbanner.js is a customizable smart app banner for iOS and Android. Prior to version 1.14.1, clicking on smartbanner `View` link …