Live › vulnerability › CVE-2026-21812
Go to dashboardThe HCL AppScan Azure Boards plugin sends data to the AppScan server over plain HTTP when configured that way. An attacker on the network path could intercept credentials or authentication tokens.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that run the HCL AppScan Azure Boards plugin and point it at an AppScan server reached over plain HTTP. Installations already using HTTPS to the AppScan server are not exposed by this flaw; the sources do not name the affected plugin versions.
No product ranges from the sources yet.
http:// rather than https://https:// and update the plugin to the version that displays the HTTP warning (version unknown)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
HCL AppScan Azure Boards Plugin is affected by a Cleartext Transmission of Sensitive Information vulnerability when configured to communicate with the AppScan server over HTTP. This could allow an attacker to intercept credentials or authentication tokens during transmission. The plugin has been updated to display a warning when HTTP is used and recommend HTTPS for secure communication.
This page as .md · .json · in your agent: get_signal("CVE-2026-21812")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.