Export limit exceeded: 425850 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 582

Export CSV
CVE-2026-21811

Multiple security vulnerabilities affect HCL AppScan Azure Boards Plugin (CVE-2026-12143 and CVE-2026-13149)

HCL AppScan Azure Boards Plugin is potentially affected by an Information Disclosure vulnerability involving secrets accessible in plaintext during pipeline execution. Depending on the pipeline configuration, these secrets could be exposed through task outputs, debug logs, environment variable dumps, or build agent scripts, despite being masked in the user interface.

CVSS 3.1 · 3.8 Low EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Appscan Integration With Azure Boards For Asoc & A360
CVE-2026-56458

HCL DevOps Deploy is susceptible to a Permissive Cross-domain Security Policy with Untrusted Domains

HCL DevOps Deploy uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is not being limited to only trusted domains.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech Hcltechsw
Products
Devops Deploy Hcl Devops Deploy
CVE-2026-56459

HCL DevOps Deploy / HCL Launch is susceptible to sensitive information disclosure

HCL DevOps Deploy / HCL Launch is susceptible to sensitive information disclosure.  The application stores potentially sensitive information in log files that could be read by a local user.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech Hcltechsw
Products
Devops Deploy Launch Hcl Devops Deploy and 1 more
CVE-2026-21762

Missing HTTP Security Headers in DevOps Loop

HCL DevOps Loop is affected by missing HTTP security headers. Missing security headers may reduce browser protections against common web-based attacks such as clickjacking, MIME-type sniffing, and cross-site scripting.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Devops Loop
CVE-2026-21812

Multiple security vulnerabilities affect HCL AppScan Azure Boards Plugin (CVE-2026-12143 and CVE-2026-13149)

HCL AppScan Azure Boards Plugin is affected by a Cleartext Transmission of Sensitive Information vulnerability when configured to communicate with the AppScan server over HTTP. This could allow an attacker to intercept credentials or authentication tokens during transmission. The plugin has been updated to display a warning when HTTP is used and recommend HTTPS for secure communication.

CVSS 3.1 · 2.2 Low EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Appscan Integration With Azure Boards For Asoc & A360
CVE-2026-67165

HCL Connections is vulnerable to cross-site scripting (XSS)

HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user which leads to executing malicious script code. This may allow the attacker steal cookie-based authentication credentials and comprise user's account then launch other attacks.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Connections
CVE-2026-56590

HCL BigFix Service Management is affected by multiple security vulnerabilities.

HCL BigFix Service Management is affected by an Unrestricted File Upload vulnerability due to improper file validation controls, which could allow an unauthenticated attacker to upload and execute malicious payloads, resulting in a complete server compromise.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Bigfix Service Management
CVE-2026-21848

HCL BigFix Service Management is affected by multiple security vulnerabilities.

HCL BigFix Service Management is affected by a Security Misconfiguration vulnerability, which could allow an authenticated attacker to exploit improper access controls, enabling the unauthorized viewing of restricted data elements across tenant boundaries.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Bigfix Service Management
CVE-2026-56592

HCL BigFix Service Management is affected by multiple security vulnerabilities.

HCL BigFix Service Management is affected by an Improper Authentication validation vulnerability related to inadequate account lockouts, which could allow an unauthenticated attacker to execute sustained brute-force attacks against the login interface, resulting in unauthorized system access.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Bigfix Service Management
CVE-2026-56595

HCL BigFix Service Management is affected by multiple security vulnerabilities.

HCL BigFix Service Management is affected by a CORS Misconfiguration vulnerability due to improperly validated origin headers, which could allow an attacker to craft a malicious web page that interacts with the vulnerable application, enabling unauthorized access to protected resources and restricted APIs on behalf of a victim.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Bigfix Service Management
CVE-2026-56597

HCL BigFix Service Management is affected by multiple security vulnerabilities.

HCL BigFix Service Management is affected by a Sensitive Information Leakage vulnerability, which could allow an unauthenticated attacker to extract internal IP addresses from the application's responses, enabling them to map the underlying network topology and identify potential internal targets.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Bigfix Service Management
CVE-2026-21806

HCL BigFix Service Management was affected with Admin Session Concurrency vulnerability (CVE-2026-21806)

HCL BigFix Service Management is affected by an Administrative Session Concurrency vulnerability. The application allows multiple simultaneous authenticated sessions for the same administrative account, which could enable an unauthorized attacker to predict or hijack valid session identifiers. Successful exploitation allows an attacker to compromise affected administrative sessions and execute actions with full privileged user permissions.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Bigfix Service Management
CVE-2026-56596

HCL BigFix Service Management is affected by multiple security vulnerabilities.

HCL BigFix Service Management is affected by an Improper Input Validation vulnerability, which could allow an attacker to supply unexpected or malformed data, enabling processing errors, business logic bypasses, and unintended application behavior.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Bigfix Service Management
CVE-2022-27545

HCL BigFix Web Reports authorized users may perform HTML injection.

BigFix Web Reports authorized users may perform HTML injection for the email administrative configuration page.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Bigfix Platform
CVE-2022-27544

HCL BigFix Web Reports authorized users may see sensitive information in clear text

BigFix Web Reports authorized users may see SMTP credentials in clear text.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Bigfix Platform
CVE-2026-67100

HCL BigFix Service Management is affected by multiple security vulnerabilities.

HCL BigFix Service Management is affected by SQL Injection flaw and a Cross-Tenant Data Exposure flaw vulnerabilities. which could allow an authenticated attacker to inject database commands to extract sensitive system details, as well as manipulate request values to gain unauthorized access to full personal profile data and PII across different organizations.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Bigfix Service Management
CVE-2026-67101

HCL BigFix Service Management is affected by multiple security vulnerabilities.

HCL BigFix Service Management is affected by a Server-Side Request Forgery (SSRF) vulnerability in its search functionality, which could allow an attacker to force the application server to send requests to internal systems that are not accessible from the internet.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Bigfix Service Management
CVE-2026-67102

HCL BigFix Service Management is affected by multiple security vulnerabilities.

HCL BigFix Service Management is affected by a high-severity Broken Access Control vulnerability, which could allow a low-privileged user to gain unauthorized access to administrative screens and functions reserved for higher-privileged roles.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Bigfix Service Management
CVE-2026-67103

HCL BigFix Service Management is affected by multiple security vulnerabilities.

HCL BigFix Service Management is affected by Cross-Site Scripting (XSS) vulnerability, which could allow an attacker to inject unsanitized malicious scripts that execute in a victim's browser, enabling session hijacking, account takeover, and unauthorized actions on behalf of affected users.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Bigfix Service Management
CVE-2025-31980

HCL BigFix Service Management is affected by multiple security vulnerabilities.

HCL BigFix Service Management is affected by an Improper Input Validation vulnerability, which could allow an attacker to inject unvalidated, malformed data into the application, enabling potential injection attacks or errors in downstream processing systems.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Bigfix Service Management