Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 582

Export CSV
CVE-2026-67172

HCL BigFix Service Management is affected by multiple security vulnerabilities.

HCL BigFix Service Management is affected by an Information Disclosure vulnerability the application returns sensitive information in error messages when invalid inputs are sent to certain API endpoints . This information could enable an attacker to facilitate further attacks.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Bigfix Service Management
CVE-2026-67171

HCL BigFix Service Management is affected by multiple security vulnerabilities.

HCL BigFix Service Management is affected by an Information Disclosure vulnerability because an exposed API endpoint exposes sensitive internal database information. This information could enable an attacker to facilitate targeted database attacks.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Bigfix Service Management
CVE-2026-56599

HCL BigFix Service Management is affected by multiple security vulnerabilities.

HCL BigFix Service Management is affected by an Insecure Cookie Attribute Configuration vulnerability, which could allow an attacker to exploit missing security attributes such as SameSite, HttpOnly, Secure, and restrictive Paths, enabling Cross-Site Request Forgery (CSRF), session hijacking via Cross-Site Scripting (XSS), and unauthorized access.

CVSS 3.1 · 2.2 Low EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Bigfix Service Management
CVE-2026-56589

HCL BigFix Service Management is affected by multiple security vulnerabilities.

HCL BigFix Service Management is affected by a Stored Cross-Site Scripting (XSS) vulnerability, which could allow an attacker to inject and store malicious scripts within the application that execute when a victim views the affected page, enabling session hijacking and the theft of sensitive data.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Bigfix Service Management
CVE-2026-67106

HCL BigFix Service Management is affected by multiple security vulnerabilities.

HCL BigFix Service Management is affected by an Information Disclosure vulnerability because two exposed API endpoints return sensitive data. This information could enable an attacker to launch further, more serious attacks.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Bigfix Service Management
CVE-2026-67105

HCL BigFix Service Management is affected by multiple security vulnerabilities.

HCL BigFix Service Management is affected by an Insecure Communication vulnerability, which could allow an attacker with internal network access to intercept unencrypted HTTP traffic between backend services, enabling the extraction of sensitive data and potential man-in-the-middle (MitM) attacks.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Bigfix Service Management
CVE-2026-67104

HCL BigFix Service Management is affected by multiple security vulnerabilities.

HCL BigFix Service Management is affected by an Information Disclosure vulnerability, which could allow an unauthenticated attacker to analyze publicly accessible JavaScript files, enabling the discovery of hidden administrative API endpoints for further targeted exploitation.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Bigfix Service Management
CVE-2026-21833

HCL AION is susceptible to a Missing "Content-Security-Policy" header Vulnerability (CVE-2026-21833)

HCL AION is affected by a vulnerability in which the Content-Security-Policy (CSP) HTTP response header is not configured. CSP helps prevent attacks such as Cross-Site Scripting (XSS) by restricting the sources from which scripts, styles, and other resources can be loaded. The absence of this header may reduce the effectiveness of browser-based security controls, potentially resulting in unintended behavior or negative security impacts under certain conditions.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Aion
CVE-2026-66247

Insecure Cross-Origin Resource Sharing Policy Enabling Credentialed Access

iControl is affected by an insecure Cross-Origin Resource Sharing (CORS) policy vulnerability, which could allow a malicious website to execute cross-origin requests with included credentials, enabling an attacker to access and exfiltrate sensitive data within the context of the victim's active session.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Icontrol
CVE-2026-67075

HCL Digital Experience is affected by improper input sanitation

HCL Digital Experience is affected by improper input sanitation.  This can result in HTML injection which could be leveraged in content spoofing from a trusted domain. Apply HCL Digital Experience 9.5 CF238 or later to address this.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Digital Experience
CVE-2026-66246

HCL iControl is affected by multiple security vulnerabilities

iControl is affected by a Broken Access Control vulnerability, which could allow an attacker to exploit missing authentication checks or insecure direct object references (IDOR), enabling privilege escalation and the unauthorized modification or deletion of sensitive application data.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Icontrol
CVE-2025-32000

Insufficient Input Sanitization is addressed in HCL Sametime 12.0.4. It is recommended to upgrade to the latest version.

HCL Sametime is vulnerable to insufficient input sanitization. The application did not appropriately sanitize user input. When user input is implicitly or explicitly trusted without sufficient sanitization, malicious actors can leverage this vulnerability.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Hcl Sametime
CVE-2026-67071

HCL DevOps Deploy / HCL Launch is susceptible to an Improper Removal of Sensitive Information Before Storage or Transfer

HCL DevOps Deploy / HCL Launch is susceptible to an information disclosure vulnerability when processing redacted property values. If a deployment is configured with a secure property that starts with certain non-ASCII characters, the redaction engine may fail to mask subsequent ASCII secure values embedded inside insecure properties.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Hcl Devops Deploy Hcl Launch
CVE-2025-52651

HCL MyXalytics is affected by multiple security vulnerabilities.

HCL MyXalytics was affected by Improper Input validation Vulnerability. It allow malicious or unexpected data to cause unintended system behaviour or security issues.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Myxalytics
CVE-2025-52652

HCL MyXalytics is affected by multiple security vulnerabilities.

HCL MyXalytics was affected by Content Spoofing Vulnerability. It may allow an attacker to manipulate displayed content, making it appear as though it originates from a trusted source, potentially leading to phishing or data theft.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Myxalytics
CVE-2025-52657

HCL MyXalytics is affected by multiple security vulnerabilities.

HCL MyXalytics was affected by Potential DOS Vulnerability. It allows users to input data without any restriction on the number of characters which can impact system performance or availability.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Myxalytics
CVE-2026-21827

HCL Connections is vulnerable to an information disclosure vulnerability

HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitled to, caused by improper handling of request data they are not entitled to, caused by improper handling of request data.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Connections
CVE-2025-62341

HCL Connections is vulnerable to server-side request forgery (SSRF)

HCL Connections is vulnerable to server-side request forgery (SSRF) when an internal server is compromised possibly allowing an attacker to send unauthorized requests in certain scenarios leading to information disclosure or security bypass.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Connections
CVE-2025-62343

HCL IntelliOps Event Management is affected by multiple security vulnerabilities.

HCL IntelliOps Event Management (IEM) is affected by an Admin Session Concurrency Vulnerability. it may allows user sessions to remain active after logout or session deletion.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Hcl Iem
CVE-2026-21752

HCL Hive is affected by a use of vulnerable third-party components

HCL Hive is affected by a use of vulnerable third-party components which could allow an attacker unauthorized access or compromise of the system by exploiting publicly documented security flaws.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Hive