Hclsoftware vulnerabilities, page 3
96 vulnerabilities
Known vulnerabilities in Hclsoftware products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 39 products.
CVE-2026-21840hclsoftwarehcl bigfix platform
EPSS score0.24%
HCL BigFix Platform is affected by a user enumeration vulnerability which might allow an attacker, through careful system control and response time monitoring, to perform some level of user enumeration for the BigFix service.CVE-2026-21768hclsoftwareverse for androidEPSS score0.16%
The compose-rich-editor library (v1.0.0-rc14) used in HCL Verse for Android's rich text email composition fails to properly validate all HTML input thereby allowing malicious content to be executed in certain situations.CVE-2026-21789hclsoftwareconnectionsEPSS score0.12%
HCL Connections contains a broken access control vulnerability that may allow unauthorized user to update data in certain scenarios.CVE-2026-21756hclsoftwarehcl hiveEPSS score0.32%
HCL Hive is affected by a broken access control vulnerability which could allow an attacker or unauthorized user to introduce unverified, malicious, or broken code directly into production environments.CVE-2026-21766hclsoftwarehcl digital experience and digital experience composeEPSS score0.29%
The default login portlet in HCL Digital Experience and Digital Experience Compose insufficiently protects credentials. Under certain very specific use cases and specific configurations, sensitive information may be written to web server logs. This only affects applications using the default login portlet.CVE-2026-21836hclsoftwaredominoiqEPSS score0.26%
The HCL DominoIQ RAG feature is affected by a Broken Access Control vulnerability. Under certain circumstances, document level access restrictions will be ignored when determining what data to return from an AI query. This could enable an authenticated attacker to view sensitive data.CVE-2026-21751hclsoftwarehcl hiveEPSS score0.16%
HCL Hive is affected by a cryptographic primitive with a risky implementation which could allow an attacker unauthorized lateral compromise or widespread credential leakage if a single internal component is breached.CVE-2026-21808hclsoftwarebigfix quantum risk analyzerEPSS score0.10%
HCL BigFix Quantum Risk Analyzer generates highly detailed logging information by default which increases the risk of sensitive data leakage and can provide an attacker with internal application logic and architectural details.CVE-2026-21788hclsoftwareconnections+1EPSS score0.17%
HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user which leads to executing malicious script code. This may allow the attacker steal cookie-based authentication credentials and comprise user's account then launch other attacks.CVE-2026-21821hclsoftwarebigfix scm reportingEPSS score0.21%
The HCL BigFix SCM Reporting site contains an outdated and unsupported version of the jQuery 1.x library. Since jQuery 1.x has reached end-of-life and no longer receives security updates, it may expose the application to publicly known security weaknesses and increase the risk of client-side attacks such as Cross-Site Scripting (XSS) or manipulation through vulnerable third-party components.CVE-2026-21827hclsoftwareconnectionsEPSS score0.15%
HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitled to, caused by improper handling of request data they are not entitled to, caused by improper handling of request data.CVE-2026-21809hclsoftwarebigfix quantum risk analyzerEPSS score0.09%
HCL BigFix Quantum Risk Analyzer has a certain validation process that provides overly descriptive error messages when it encounters malformed input which can allow an attacker to conduct more efficient reconnaissance and fine-tune automated fuzzing tools to produce valid input.CVE-2026-21765hclsoftwarebigfix platform+1EPSS score0.10%
HCL BigFix Platform is affected by insecure permissions on private cryptographic keys. The private cryptographic keys located on a Windows host machine might be subject to overly permissive file system permissions.CVE-2026-21810hclsoftwarebigfix quantum risk analyzerEPSS score0.07%
HCL BigFix Quantum Risk Analyzer is affected by a hardcoded external resource reference and a lack of binary integrity which could allow an attacker to obtain sensitive information or modify the binary.CVE-2026-21752hclsoftwarehcl hiveEPSS score0.27%
HCL Hive is affected by a use of vulnerable third-party components which could allow an attacker unauthorized access or compromise of the system by exploiting publicly documented security flaws.CVE-2026-21790hclsoftwaretravelerEPSS score0.15%
HCL Traveler is susceptible to a weak default HTTP header validation vulnerability, which could allow an attacker to bypass additional authentication checks.CVE-2026-21786hclsoftwaresametime for ios+1EPSS score0.10%
HCL Sametime for iOS is impacted by a sensitive information disclosure. Hostnames information is written in application logs and certain URLs.CVE-2026-21759hclsoftwarehcl hiveEPSS score0.22%
HCL Hive is affected by an information exposure vulnerability where Swagger documentation was found exposed publicly. Although no sensitive information (e.g., credentials, PII) was discovered, exposing API documentation to unauthenticated users can increase the overall attack surface.CVE-2026-21826hclsoftwaredigital experience & dx compose+2EPSS score0.14%
HCL Digital Experience and HCL Digital Experience Compose could be susceptible to Host header injection. An attacker can manipulate the Host header and cause the application to behave in unexpected ways.CVE-2026-21755hclsoftwarehcl hiveEPSS score0.21%
HCL Hive is affected by a missing rate limit which could allow an attacker unauthorized access via brute-force or credential stuffing attacks, or cause a denial of service.