Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 582

Export CSV
CVE-2025-52659

HCL AION is affected by a Cacheable HTTP Response vulnerability

HCL AION version 2 is affected by a Cacheable HTTP Response vulnerability. This may lead to unintended storage of sensitive or dynamic content, potentially resulting in unauthorized access or information disclosure.

CVSS 3.1 · 2.8 Low EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Aion
CVE-2025-52649

HCL AION is affected by a vulnerability where certain identifiers may be predictable in nature

HCL AION is affected by a vulnerability where certain identifiers may be predictable in nature. Predictable identifiers may allow an attacker to infer or guess system-generated values, potentially leading to limited information disclosure or unintended access under specific conditions.

CVSS 3.1 · 1.8 Low EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Aion
CVE-2025-52645

HCL AION is affected by a vulnerability where model packaging and distribution mechanisms may not include sufficient authenticity verification.

HCL AION is affected by a vulnerability where model packaging and distribution mechanisms may not include sufficient authenticity verification. This may allow the possibility of unverified or modified model artifacts being used, potentially leading to integrity concerns or unintended behaviour.

CVSS 3.1 · 1.9 Low EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Aion
CVE-2025-52643

HCL AION is affected by a vulnerability where untrusted file parsing operations are not executed within a properly isolated sandbox environment

HCL AION is affected by a vulnerability where untrusted file parsing operations are not executed within a properly isolated sandbox environment. This may expose the application to potential security risks, including unintended behaviour or integrity impact when processing specially crafted files.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Aion
CVE-2025-52636

HCL AION is affected by a improper handling of uploads files Size

HCL AION is affected by a vulnerability related to the handling of upload size limits. Improper control or validation of upload sizes may allow excessive resource consumption, which could potentially lead to service degradation or denial-of-service conditions under certain scenarios.

CVSS 3.1 · 1.8 Low EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Aion
CVE-2025-52628

HCL AION is susceptible to Missing SameSite vulnerability

HCL AION is affected by a Cookie with Insecure, Improper, or Missing SameSite vulnerability. This can allow cookies to be sent in cross-site requests, potentially increasing exposure to cross-site request forgery and related security risks. This issue affects AION: 2.0.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Aion
CVE-2025-52627

HCL AION is susceptible to Incorrect Permission Assignment for Critical Resource

Root File System Not Mounted as Read-Only configuration vulnerability. This can allow unintended modifications to critical system files, potentially increasing the risk of system compromise or unauthorized changes.This issue affects AION: 2.0.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Aion
CVE-2025-52626

HCL AION is susceptible to Potential Command Injection vulnerability

A Potential Command Injection vulnerability in HCL AION.  An This can allow unintended command execution, potentially leading to unauthorized actions on the underlying system.This issue affects AION: 2.0

CVSS 3.1 · 4.5 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Aion
CVE-2025-52625

HCL AION is susceptible to Cacheable SSL Page Found vulnerability

A vulnerability  Cacheable SSL Page Found vulnerability has been identified in HCL AION.  Cached data may expose credentials, system identifiers, or internal file paths to attackers with access to the device or browser This issue affects AION: 2.0.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Aion
CVE-2025-31958

HCL BigFix Service Management (SM) is susceptible to HTTP Request Smuggling

HCL BigFix Service Management is susceptible to HTTP Request Smuggling.  HTTP request smuggling vulnerabilities arise when websites route HTTP requests through web servers with inconsistent HTTP parsing. HTTP Smuggling exploits inconsistencies in request parsing between front-end and back-end servers, allowing attackers to bypass security controls and perform attacks like cache poisoning or request hijacking.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Bigfix Service Management
CVE-2025-31981

HCL BigFix Service Management (SM) Discovery is vulnerable to unenforced encryption

HCL BigFix Service Management (SM) Discovery is vulnerable to unenforced encryption due to port 80 (HTTP) being open, allowing unencrypted access.  An attacker with access to the network traffic can sniff packets from the connection and uncover the data.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Bigfix Service Management
CVE-2025-31991

HCL DevOps Velocity is susceptible to brute-force attacks

Rate Limiting for attempting a user login is not being properly enforced, making HCL DevOps Velocity susceptible to brute-force attacks past the unsuccessful login attempt limit.  This vulnerability is fixed in 5.1.7.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Hclsoftware Hcltech
Products
Velocity Devops Velocity
CVE-2026-21765

HCL BigFix Platform is affected by insecure permissions on private cryptographic keys

HCL BigFix Platform is affected by insecure permissions on private cryptographic keys.  The private cryptographic keys located on a Windows host machine might be subject to overly permissive file system permissions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Bigfix Platform
CVE-2026-21767

HCL BigFix Platform is affected by insufficient authentication

HCL BigFix Platform is affected by insufficient authentication.  The application might allow users to access sensitive areas of the application without proper authentication.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Bigfix Platform
CVE-2026-21786

HCL Sametime for iOS is affected by sensitive information disclosure

HCL Sametime for iOS is impacted by a sensitive information disclosure. Hostnames information is written in application logs and certain URLs.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Hclsoftware Hcltech
Products
Sametime For Ios Sametime
CVE-2025-0248

HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability,

HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability caused by improper validation of user-supplied input. A remote, unauthenticated attacker can specially craft a URL to execute script in a victim's Web browser within the security context of the hosting Web site and/or steal the victim's cookie-based authentication credentials.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Hcl Inotes
CVE-2025-62346

HCL Glovius Cloud is susceptible to a Cross-Site Request Forgery (CSRF) vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability was identified in HCL Glovius Cloud. An attacker can force a user's web browser to execute an unwanted, malicious action on a trusted site where the user is authenticated, specifically on one endpoint.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Glovius Cloud
CVE-2024-30129

HCL Nomad server on Domino is affected by a host header injection vulnerability

The HTTP host header can be manipulated and cause the application to behave in unexpected ways. Any changes made to the header would cause the request to be sent to a completely different domain/IP address.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Hcl Nomad
CVE-2024-42197

HCL Workload Scheduler is vulnerable to plain text storage of a password

HCL Workload Scheduler stores user credentials in plain text which can be read by a local user.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Workload Scheduler