CVE-2026-56587

HCL IEM was affected with Strict transport security not enforced

HCL IEM was affected with Strict transport security not enforced. It may enable attackers to perform SSL stripping or man-in-the-middle attacks and compromise secure communications.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Intelliops Event Management

CVE-2026-56585

HCL IEM was affected with the Anti Clickjacking XFrame Options Header Missing

HCL IEM was affected with the Anti Clickjacking XFrame Options Header Missing. It may allow attackers to embed the application in malicious pages and induce unauthorized user actions.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Intelliops Event Management

CVE-2026-56586

HCL IEM was affected with X-Content-Type-Options Header Missing

HCL IEM was affected with X-Content-Type-Options Header Missing. It may enable attackers to perform SSL stripping or man-in-the-middle attacks and intercept sensitive data.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Intelliops Event Management

CVE-2026-35146

HCL DFXServer is affected by an Unencrypted Communication vulnerability.

HCL DFXServer is affected by an Unencrypted Communication vulnerability. The application permits users to establish connections over unencrypted channels via the HTTP protocol, which could allow a remote attacker to intercept network traffic and expose sensitive data transmitted between the user and the application.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Hclsoftware Hcltech

Products

Dfxserver Dfx Server

CVE-2026-35148

HCL DFXServer is affected by a Missing Access Control vulnerability

HCL DFXServer is affected by a Missing Access Control vulnerability. This vulnerability states that certain endpoints are accessible without any form of authentication in another browser. This allows any network user to invoke these APIs and interact with the application without verification of their identity or authorization level.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Hclsoftware Hcltech

Products

Dfxserver Dfx Server

CVE-2026-35149

HCL DFXServer is affected by an Authentication Bypass vulnerability via server response manipulation.

HCL DFXServer is affected by an Authentication Bypass vulnerability via server response manipulation. An unauthorized user without valid credentials can exploit this flaw by intercepting and altering the server's authentication responses, allowing them to gain unauthorized access to the application without verification.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Hclsoftware Hcltech

Products

Dfxserver Dfx Server

CVE-2026-35147

HCL DFXServer is affected by a Broken Authentication vulnerability via direct API access.

HCL DFXServer is affected by a Broken Authentication vulnerability via direct API access. The application fails to verify the user's authentication status when accessing specific API endpoints, allowing an unauthenticated attacker to interact with the APIs and perform unauthorized actions without valid credentials.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Hclsoftware Hcltech

Products

Dfxserver Dfx Server

CVE-2026-21824

A privilege escalation vulnerability affects HCL Commerce

HCL Commerce contains an privilege escalation vulnerability that could allow denial of service, disclosure of user personal data, and performing of unauthorized administrative operations.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Commerce

CVE-2023-37508

HCL DevOps Plan is susceptible to a Cross-Site Scripting (XSS) vulnerability

HCL DevOps Plan is potentially susceptible to Cross-Site Scripting (XSS) which could allow an attacker to exploit this vulnerability if certain browser weaknesses are present.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Hclsoftware Hcltech

Products

Devops Plan Devops Plan

CVE-2023-37507

An information disclosure vulnerability affects HCL DevOps Plan

HCL DevOps Plan is susceptible to an information disclosure that can allow an attacker to focus their attacks based upon the information revealed.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Hclsoftware Hcltech

Products

Devops Plan Devops Plan

CVE-2026-56577

HCL MyCloud affected by Weak Password Policy

HCL MyCloud was affected with Weak Password Policy. It may increase the risk of account compromise through brute-force or credential-based attacks.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Hclsoftware Hcltech

Products

Mycloud Dryice Mycloud

CVE-2026-56578

HCL MyCloud was affected by Server Version Disclosure

HCL MyCloud was affected by Server Version Disclosure. It may help attackers identify and exploit known vulnerabilities affecting the disclosed software versions.

CVSS 3.1 · 2.2 Low EPSS < 1% KEV · Not listed

Vendors

Hclsoftware Hcltech

Products

Mycloud Dryice Mycloud

CVE-2026-56579

HCL MyCloud was affected with Exposure of Sensitive Information to an Unauthorized Actor.

HCL MyCloud was affected with License Key Revealed in HTTP Response. It may enable attackers to misuse the exposed information and compromise the application's security.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Hclsoftware Hcltech

Products

Mycloud Dryice Mycloud

CVE-2026-56580

HCL MyCloud was affected by Using Components with Known Vulnerability

HCL MyCloud was affected by Using Components with Known Vulnerability ( IIS Server ). It may allow attackers to exploit publicly disclosed weaknesses and compromise the system.

CVSS 3.1 · 2.2 Low EPSS < 1% KEV · Not listed

Vendors

Hclsoftware Hcltech

Products

Mycloud Dryice Mycloud

CVE-2026-56581

HCL MyCloud was affected with Cookie Attribute Path Not Set

HCL MyCloud was affected with Cookie Attribute Path Not Set. It may increase the risk of unauthorized access to session data or authentication tokens.

CVSS 3.1 · 2.6 Low EPSS < 1% KEV · Not listed

Vendors

Hclsoftware Hcltech

Products

Mycloud Dryice Mycloud

CVE-2026-56582

HCL MyCloud was affected with SSL/TLS Protocol Affected with LUCKY13 Vulnerability.

HCL MyCloud was affected by the SSL/TLS LUCKY13 Vulnerability. An attacker may exploit this vulnerability to decrypt sensitive information through a TLS/SSL padding oracle attack.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Hclsoftware Hcltech

Products

Mycloud Dryice Mycloud

CVE-2026-56583

HCL MyCloud was affected with Concurrent Login Vulnerability.

HCL MyCloud was affected with Concurrent Login Vulnerability. It may increase the risk of unauthorized access, session hijacking, and account misuse.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Hclsoftware Hcltech

Products

Mycloud Dryice Mycloud

CVE-2026-56460

HCL DevOps Deploy / HCL Launch is susceptible to an Insertion of Sensitive Information Into Sent Data vulnerability

HCL DevOps Deploy / HCL Launch could disclose sensitive configurations and secrets to authenticated users in API responses that could be used in further attacks against the system.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech Hcltechsw

Products

Devops Deploy Launch Hcl Devops Deploy and 1 more

CVE-2026-56457

HCL DevOps Deploy / HCL Launch is susceptible to an exposure of sensitive information

HCL DevOps Deploy / HCL Launch is susceptible to an exposure of sensitive information vulnerability in output logs. This exposure could allow an attacker with access to the logs to potentially obtain sensitive values related to that step.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech Hcltechsw

Products

Devops Deploy Hcl Devops Deploy Hcl Launch

CVE-2024-23581

HCL Traveler for Microsoft Outlook (HTMO) is susceptible to an application modification vulnerability

The HCL Traveler for Microsoft Outlook libraries are being flagged as potentially malicious software or an unrecognized application.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Traveler For Microsoft Outlook