Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 38

Export CSV
CVE-2026-35148

HCL DFXServer is affected by a Missing Access Control vulnerability

HCL DFXServer is affected by a Missing Access Control vulnerability. This vulnerability states that certain endpoints are accessible without any form of authentication in another browser. This allows any network user to invoke these APIs and interact with the application without verification of their identity or authorization level.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Hclsoftware Hcltech
Products
Dfxserver Dfx Server
CVE-2026-35149

HCL DFXServer is affected by an Authentication Bypass vulnerability via server response manipulation.

HCL DFXServer is affected by an Authentication Bypass vulnerability via server response manipulation. An unauthorized user without valid credentials can exploit this flaw by intercepting and altering the server's authentication responses, allowing them to gain unauthorized access to the application without verification.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Hclsoftware Hcltech
Products
Dfxserver Dfx Server
CVE-2026-35147

HCL DFXServer is affected by a Broken Authentication vulnerability via direct API access.

HCL DFXServer is affected by a Broken Authentication vulnerability via direct API access. The application fails to verify the user's authentication status when accessing specific API endpoints, allowing an unauthenticated attacker to interact with the APIs and perform unauthorized actions without valid credentials.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Hclsoftware Hcltech
Products
Dfxserver Dfx Server
CVE-2023-37508

HCL DevOps Plan is susceptible to a Cross-Site Scripting (XSS) vulnerability

HCL DevOps Plan is potentially susceptible to Cross-Site Scripting (XSS) which could allow an attacker to exploit this vulnerability if certain browser weaknesses are present.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Hclsoftware Hcltech
Products
Devops Plan Devops Plan
CVE-2023-37507

An information disclosure vulnerability affects HCL DevOps Plan

HCL DevOps Plan is susceptible to an information disclosure that can allow an attacker to focus their attacks based upon the information revealed.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Hclsoftware Hcltech
Products
Devops Plan Devops Plan
CVE-2026-56577

HCL MyCloud affected by Weak Password Policy

HCL MyCloud was affected with Weak Password Policy. It may increase the risk of account compromise through brute-force or credential-based attacks.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Hclsoftware Hcltech
Products
Mycloud Dryice Mycloud
CVE-2026-56578

HCL MyCloud was affected by Server Version Disclosure

HCL MyCloud was affected by Server Version Disclosure. It may help attackers identify and exploit known vulnerabilities affecting the disclosed software versions.

CVSS 3.1 · 2.2 Low EPSS < 1% KEV · Not listed
Vendors
Hclsoftware Hcltech
Products
Mycloud Dryice Mycloud
CVE-2026-56579

HCL MyCloud was affected with Exposure of Sensitive Information to an Unauthorized Actor.

HCL MyCloud was affected with License Key Revealed in HTTP Response. It may enable attackers to misuse the exposed information and compromise the application's security.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Hclsoftware Hcltech
Products
Mycloud Dryice Mycloud
CVE-2026-56580

HCL MyCloud was affected by Using Components with Known Vulnerability

HCL MyCloud was affected by Using Components with Known Vulnerability ( IIS Server ). It may allow attackers to exploit publicly disclosed weaknesses and compromise the system.

CVSS 3.1 · 2.2 Low EPSS < 1% KEV · Not listed
Vendors
Hclsoftware Hcltech
Products
Mycloud Dryice Mycloud
CVE-2026-56581

HCL MyCloud was affected with Cookie Attribute Path Not Set

HCL MyCloud was affected with Cookie Attribute Path Not Set. It may increase the risk of unauthorized access to session data or authentication tokens.

CVSS 3.1 · 2.6 Low EPSS < 1% KEV · Not listed
Vendors
Hclsoftware Hcltech
Products
Mycloud Dryice Mycloud
CVE-2026-56582

HCL MyCloud was affected with SSL/TLS Protocol Affected with LUCKY13 Vulnerability.

HCL MyCloud was affected by the SSL/TLS LUCKY13 Vulnerability. An attacker may exploit this vulnerability to decrypt sensitive information through a TLS/SSL padding oracle attack.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Hclsoftware Hcltech
Products
Mycloud Dryice Mycloud
CVE-2026-56583

HCL MyCloud was affected with Concurrent Login Vulnerability.

HCL MyCloud was affected with Concurrent Login Vulnerability. It may increase the risk of unauthorized access, session hijacking, and account misuse.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Hclsoftware Hcltech
Products
Mycloud Dryice Mycloud
CVE-2026-21768

HCL Verse for Android is susceptible to an injection vulnerability

The compose-rich-editor library (v1.0.0-rc14) used in HCL Verse for Android's rich text email composition fails to properly validate all HTML input thereby allowing malicious content to be executed in certain situations.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Hclsoftware
Products
Verse For Android
CVE-2026-21836

HCL DominoIQ is affected by broken access control

The HCL DominoIQ RAG feature is affected by a Broken Access Control vulnerability.  Under certain circumstances, document level access restrictions will be ignored when determining what data to return from an AI query.  This could enable an authenticated attacker to view sensitive data.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Hclsoftware
Products
Dominoiq
CVE-2026-21821

HCL BigFix SCM Reporting is affected by vulnerabilities in jQuery

The HCL BigFix SCM Reporting site contains an outdated and unsupported version of the jQuery 1.x library. Since jQuery 1.x has reached end-of-life and no longer receives security updates, it may expose the application to publicly known security weaknesses and increase the risk of client-side attacks such as Cross-Site Scripting (XSS) or manipulation through vulnerable third-party components.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Hclsoftware
Products
Bigfix Scm Reporting
CVE-2025-31991

HCL DevOps Velocity is susceptible to brute-force attacks

Rate Limiting for attempting a user login is not being properly enforced, making HCL DevOps Velocity susceptible to brute-force attacks past the unsuccessful login attempt limit.  This vulnerability is fixed in 5.1.7.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Hclsoftware Hcltech
Products
Velocity Devops Velocity
CVE-2026-21786

HCL Sametime for iOS is affected by sensitive information disclosure

HCL Sametime for iOS is impacted by a sensitive information disclosure. Hostnames information is written in application logs and certain URLs.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Hclsoftware Hcltech
Products
Sametime For Ios Sametime
CVE-2025-31990

HCL DevOps Velocity is susceptible to a Denial of Service vulnerability

Rate limiting for certain API calls is not being enforced, making HCL Velocity vulnerable to Denial of Service (DoS) attacks. An attacker could flood the system with a large number of requests, overwhelming its resources and causing it to become unresponsive to legitimate users. This vulnerability is fixed in 5.1.7.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Hclsoftware
Products
Hcl Devops Velocity