HCLSoftware
- Total products in the ecosystem
- 39
- Total vulnerabilities (90 days)
- 64
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
Verify to analyze this security profile
As of 09/20/2026, HCLSoftware recorded 64 security vulnerabilities in the last 90 days across 20 products, including 6 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, Aftermarket EPC had the most security vulnerabilities in the HCLSoftware ecosystem, with 14 vulnerabilities—approximately 21.88% of the provider's total vulnerabilities during this period.
| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-67071HCL DevOps Deploy / HCL Launch is susceptible to an Improper Removal of Sensitive Information Before Storage or Transfer | Exploitation statusNot known exploited | FixNot confirmed | Affected productHCL DevOps Deploy / HCL Launch | Published09/17/2026 | SeverityMedium |
CVE-2026-21827HCL Connections is vulnerable to an information disclosure vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productConnections | Published08/31/2026 | SeverityLow |
CVE-2025-62341HCL Connections is vulnerable to server-side request forgery (SSRF) | Exploitation statusNot known exploited | FixNot confirmed | Affected productConnections | Published08/26/2026 | SeverityLow |
CVE-2026-21808HCL BigFix Quantum Risk Analyzer is affected by logging sensitive information | Exploitation statusNot known exploited | FixNot confirmed | Affected productBigFix Quantum Risk Analyzer | Published08/26/2026 | SeverityMedium |
CVE-2026-21807HCL BigFix Quantum Risk Analyzer is affected by a stack-based buffer overflow | Exploitation statusNot known exploited | FixNot confirmed | Affected productBigFix Quantum Risk Analyzer | Published08/26/2026 | SeverityLow |
CVE-2026-21810HCL BigFix Quantum Risk Analyzer is affected by a hardcoded external resource reference and downloading code without integrity checking | Exploitation statusNot known exploited | FixNot confirmed | Affected productBigFix Quantum Risk Analyzer | Published08/26/2026 | SeverityMedium |
CVE-2026-21809HCL BigFix Quantum Risk Analyzer is affected by generating error messages with sensitive information | Exploitation statusNot known exploited | FixNot confirmed | Affected productBigFix Quantum Risk Analyzer | Published08/26/2026 | SeverityLow |
CVE-2026-56547An input reflection vulnerability affects HCL Traveler | Exploitation statusNot known exploited | FixNot confirmed | Affected productTraveler | Published08/26/2026 | SeverityLow |
CVE-2025-68825HCL Hive is affected by incorrect default permissions | Exploitation statusNot known exploited | FixNot confirmed | Affected productHCL Hive | Published08/24/2026 | SeverityHigh |
CVE-2026-21752HCL Hive is affected by a use of vulnerable third-party components | Exploitation statusNot known exploited | FixNot confirmed | Affected productHCL Hive | Published08/24/2026 | SeverityHigh |
CVE-2026-21755HCL Hive is affected by a missing rate limit | Exploitation statusNot known exploited | FixNot confirmed | Affected productHCL Hive | Published08/24/2026 | SeverityMedium |
CVE-2025-68833HCL Hive is affected by use of a cryptographic primitive with a risky implementation | Exploitation statusNot known exploited | FixNot confirmed | Affected productHCL Hive | Published08/24/2026 | SeverityMedium |
CVE-2026-21751HCL Hive is affected by use of a cryptographic primitive with a risky implementation | Exploitation statusNot known exploited | FixNot confirmed | Affected productHCL Hive | Published08/24/2026 | SeverityHigh |
CVE-2026-21756HCL Hive is affected by a broken access control vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productHCL Hive | Published08/24/2026 | SeverityHigh |
CVE-2026-21759HCL Hive is affected by an information exposure vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productHCL Hive | Published08/24/2026 | SeverityMedium |
CVE-2026-56619HCL BigFix Mobile is vulnerable to Reflected Cross-Site Scripting (Reflected XSS) | Exploitation statusNot known exploited | FixNot confirmed | Affected productHCL BigFix Mobile | Published08/10/2026 | SeverityMedium |
CVE-2026-56620HCL BigFix Mobile is vulnerable to information disclosure | Exploitation statusNot known exploited | FixNot confirmed | Affected productHCL BigFix Mobile | Published08/10/2026 | SeverityMedium |
CVE-2026-21766HCL Digital Experience and Digital Experience Compose insufficiently protects credentials | Exploitation statusNot known exploited | FixNot confirmed | Affected productHCL Digital Experience and Digital Experience Compose | Published08/05/2026 | SeverityMedium |
CVE-2026-56538HCL Connections is vulnerable to information disclosure | Exploitation statusNot known exploited | FixNot confirmed | Affected productConnections | Published07/27/2026 | SeverityLow |
CVE-2026-56537HCL Connections is vulnerable to information disclosure | Exploitation statusNot known exploited | FixNot confirmed | Affected productConnections | Published07/27/2026 | SeverityLow |
CVE-2026-56583HCL MyCloud was affected with Concurrent Login Vulnerability. | Exploitation statusNot known exploited | FixNot confirmed | Affected productMyCloud | Published07/21/2026 | SeverityLow |
CVE-2026-56582HCL MyCloud was affected with SSL/TLS Protocol Affected with LUCKY13 Vulnerability. | Exploitation statusNot known exploited | FixNot confirmed | Affected productMyCloud | Published07/21/2026 | SeverityLow |
CVE-2026-56581HCL MyCloud was affected with Cookie Attribute Path Not Set | Exploitation statusNot known exploited | FixNot confirmed | Affected productMyCloud | Published07/21/2026 | SeverityLow |
CVE-2026-56580HCL MyCloud was affected by Using Components with Known Vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productMyCloud | Published07/21/2026 | SeverityLow |
CVE-2026-56579HCL MyCloud was affected with Exposure of Sensitive Information to an Unauthorized Actor. | Exploitation statusNot known exploited | FixNot confirmed | Affected productMyCloud | Published07/21/2026 | SeverityLow |
CVE-2026-56578HCL MyCloud was affected by Server Version Disclosure | Exploitation statusNot known exploited | FixNot confirmed | Affected productMyCloud | Published07/21/2026 | SeverityLow |
CVE-2026-56577HCL MyCloud affected by Weak Password Policy | Exploitation statusNot known exploited | FixNot confirmed | Affected productMyCloud | Published07/21/2026 | SeverityLow |
CVE-2026-56586HCL IEM was affected with X-Content-Type-Options Header Missing | Exploitation statusNot known exploited | FixNot confirmed | Affected productIntelliOps Event Management | Published07/21/2026 | SeverityLow |
CVE-2026-56585HCL IEM was affected with the Anti Clickjacking XFrame Options Header Missing | Exploitation statusNot known exploited | FixNot confirmed | Affected productIntelliOps Event Management | Published07/21/2026 | SeverityLow |
CVE-2026-56587HCL IEM was affected with Strict transport security not enforced | Exploitation statusNot known exploited | FixNot confirmed | Affected productIntelliOps Event Management | Published07/21/2026 | SeverityLow |
CVE-2026-56584HCL IEM was affected with the Information disclosure nginx server | Exploitation statusNot known exploited | FixNot confirmed | Affected productIntelliOps Event Management | Published07/21/2026 | SeverityLow |
CVE-2023-37507An information disclosure vulnerability affects HCL DevOps Plan | Exploitation statusNot known exploited | FixNot confirmed | Affected productDevOps Plan | Published07/21/2026 | SeverityMedium |
CVE-2023-37508HCL DevOps Plan is susceptible to a Cross-Site Scripting (XSS) vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productDevOps Plan | Published07/21/2026 | SeverityLow |
CVE-2026-21824A privilege escalation vulnerability affects HCL Commerce | Exploitation statusNot known exploited | FixNot confirmed | Affected productCommerce | Published07/20/2026 | SeverityHigh |
CVE-2025-59866 | Exploitation statusNot known exploited | FixNot confirmed | Affected productDFMPro for CATIA | Published07/17/2026 | SeverityLow |
CVE-2026-21764Insufficient Input Validation in DevOps Loop | Exploitation statusNot known exploited | FixNot confirmed | Affected productDevOps Loop | Published07/17/2026 | SeverityLow |
CVE-2026-21762Missing HTTP Security Headers in DevOps Loop | Exploitation statusNot known exploited | FixNot confirmed | Affected productDevOps Loop | Published07/17/2026 | SeverityLow |
CVE-2026-21761CORS Misconfiguration in DevOps Loop | Exploitation statusNot known exploited | FixNot confirmed | Affected productDevOps Loop | Published07/17/2026 | SeverityMedium |
CVE-2026-21760Unauthorized Access to Admin Functionality via Forced Browsing | Exploitation statusNot known exploited | FixNot confirmed | Affected productDevOps Loop | Published07/17/2026 | SeverityMedium |
CVE-2024-23572 | Exploitation statusNot known exploited | FixNot confirmed | Affected productAftermarket EPC | Published07/17/2026 | SeverityMedium |
CVE-2024-23570 | Exploitation statusNot known exploited | FixNot confirmed | Affected productAftermarket EPC | Published07/17/2026 | SeverityMedium |
CVE-2024-23578 | Exploitation statusNot known exploited | FixNot confirmed | Affected productAftermarket EPC | Published07/17/2026 | SeverityMedium |
CVE-2024-23569 | Exploitation statusNot known exploited | FixNot confirmed | Affected productAftermarket EPC | Published07/17/2026 | SeverityMedium |
CVE-2024-23577 | Exploitation statusNot known exploited | FixNot confirmed | Affected productAftermarket EPC | Published07/17/2026 | SeverityMedium |
CVE-2024-23574 | Exploitation statusNot known exploited | FixNot confirmed | Affected productAftermarket EPC | Published07/17/2026 | SeverityMedium |
CVE-2024-42214 | Exploitation statusNot known exploited | FixNot confirmed | Affected productAftermarket EPC | Published07/17/2026 | SeverityMedium |
CVE-2024-23575 | Exploitation statusNot known exploited | FixNot confirmed | Affected productAftermarket EPC | Published07/17/2026 | SeverityMedium |
CVE-2024-23571 | Exploitation statusNot known exploited | FixNot confirmed | Affected productAftermarket EPC | Published07/17/2026 | SeverityMedium |
CVE-2024-23573 | Exploitation statusNot known exploited | FixNot confirmed | Affected productAftermarket EPC | Published07/17/2026 | SeverityLow |
CVE-2024-23568 | Exploitation statusNot known exploited | FixNot confirmed | Affected productAftermarket EPC | Published07/17/2026 | SeverityMedium |
CVE-2024-23565 | Exploitation statusNot known exploited | FixNot confirmed | Affected productAftermarket EPC | Published07/17/2026 | SeverityMedium |
CVE-2024-23566 | Exploitation statusNot known exploited | FixNot confirmed | Affected productAftermarket EPC | Published07/17/2026 | SeverityMedium |
CVE-2024-23567 | Exploitation statusNot known exploited | FixNot confirmed | Affected productAftermarket EPC | Published07/17/2026 | SeverityMedium |
CVE-2026-21770HCL Traveler for Microsoft Outlook (HTMO) is susceptible to DLL hijacking | Exploitation statusNot known exploited | FixNot confirmed | Affected productHCL Traveler for Microsoft Outlook (HTMO) | Published07/17/2026 | SeverityMedium |
CVE-2026-35146HCL DFXServer is affected by an Unencrypted Communication vulnerability. | Exploitation statusNot known exploited | FixNot confirmed | Affected productDFXServer | Published07/16/2026 | SeverityMedium |
CVE-2026-21840HCL BigFix Platform is affected by a user enumeration vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productHCL BigFix Platform | Published07/14/2026 | SeverityLow |
CVE-2026-56460HCL DevOps Deploy / HCL Launch is susceptible to an Insertion of Sensitive Information Into Sent Data vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productHCL DevOps Deploy / HCL Launch | Published07/09/2026 | SeverityMedium |
CVE-2026-56458HCL DevOps Deploy is susceptible to a Permissive Cross-domain Security Policy with Untrusted Domains | Exploitation statusNot known exploited | FixNot confirmed | Affected productHCL DevOps Deploy | Published07/09/2026 | SeverityMedium |
CVE-2026-56459HCL DevOps Deploy / HCL Launch is susceptible to sensitive information disclosure | Exploitation statusNot known exploited | FixNot confirmed | Affected productHCL DevOps Deploy / HCL Launch | Published07/09/2026 | SeverityMedium |
CVE-2026-56457HCL DevOps Deploy / HCL Launch is susceptible to an exposure of sensitive information | Exploitation statusNot known exploited | FixNot confirmed | Affected productHCL DevOps Deploy / HCL Launch | Published06/29/2026 | SeverityMedium |
CVE-2025-59868HCL Traveler for Microsoft Outlook (HTMO) is susceptible to sensitive data exposure | Exploitation statusNot known exploited | FixNot confirmed | Affected productTraveler for Microsoft Outlook | Published06/27/2026 | SeverityMedium |
CVE-2023-37524HCL Traveler for Microsoft Outlook (HTMO) is susceptible to vulnerabilities due to .NET Framework 4.5 being out of service | Exploitation statusNot known exploited | FixNot confirmed | Affected productTraveler for Microsoft Outlook | Published06/27/2026 | SeverityHigh |
CVE-2024-23581HCL Traveler for Microsoft Outlook (HTMO) is susceptible to an application modification vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productTraveler for Microsoft Outlook | Published06/26/2026 | SeverityMedium |
CVE-2025-15619HCL Connections is vulnerable to broken access control | Exploitation statusNot known exploited | FixNot confirmed | Affected productConnections | Published06/23/2026 | SeverityLow |
CVE-2026-21768HCL Verse for Android is susceptible to an injection vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productVerse for Android | Published06/19/2026 | SeverityMedium |
CVE-2026-21825HCL Digital Experience Compose is affected by a reflected cross-site scripting (XSS) vulnerability in the search center | Exploitation statusNot known exploited | FixNot confirmed | Affected productDX Compose | Published06/05/2026 | SeverityMedium |
CVE-2026-21826HCL Digital Experience and HCL Digital Experience Compose could be susceptible to Host header injection | Exploitation statusNot known exploited | FixNot confirmed | Affected productDigital Experience & DX Compose | Published06/05/2026 | SeverityMedium |
CVE-2026-21837HCL Digital Experience is affected by an OS command injection vulnerability in the Digital Asset Management API | Exploitation statusNot known exploited | FixNot confirmed | Affected productDigital Experience | Published06/05/2026 | SeverityHigh |
CVE-2025-62338HCL BigFix Cloud Lifecycle Management is affected by lack of input validation | Exploitation statusNot known exploited | FixNot confirmed | Affected productBigFix Cloud Lifecycle Management | Published06/04/2026 | SeverityLow |
CVE-2026-21785HCL BigFix Remote Control Server WebUI is affected by a misconfigured Content Security Policy | Exploitation statusNot known exploited | FixNot confirmed | Affected productBigFix Remote Control Server | Published05/27/2026 | SeverityMedium |
CVE-2026-21836HCL DominoIQ is affected by broken access control | Exploitation statusNot known exploited | FixNot confirmed | Affected productDominoIQ | Published05/20/2026 | SeverityMedium |
CVE-2026-21789HCL Connections is vulnerable to broken access control | Exploitation statusNot known exploited | FixNot confirmed | Affected productConnections | Published05/18/2026 | SeverityMedium |
CVE-2026-21821HCL BigFix SCM Reporting is affected by vulnerabilities in jQuery | Exploitation statusNot known exploited | FixNot confirmed | Affected productBigFix SCM Reporting | Published05/13/2026 | SeverityHigh |
CVE-2025-15634HCL BigFix WebUI is affected by a missing authorization vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productBigFix WebUI | Published05/09/2026 | SeverityMedium |
CVE-2025-15633HCL BigFix WebUI is affected by an improper authorization vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productBigFix WebUI | Published05/09/2026 | SeverityMedium |
CVE-2025-31981HCL BigFix Service Management (SM) Discovery is vulnerable to unenforced encryption | Exploitation statusNot known exploited | FixNot confirmed | Affected productBigFix Service Management (SM) | Published04/21/2026 | SeverityMedium |
CVE-2025-31958HCL BigFix Service Management (SM) is susceptible to HTTP Request Smuggling | Exploitation statusNot known exploited | FixNot confirmed | Affected productBigFix Service Management (SM) | Published04/21/2026 | SeverityLow |
CVE-2025-31991HCL DevOps Velocity is susceptible to brute-force attacks | Exploitation statusNot known exploited | FixYes | Affected productVelocity | Published04/13/2026 | SeverityMedium |
CVE-2026-21767HCL BigFix Platform is affected by insufficient authentication | Exploitation statusNot known exploited | FixNot confirmed | Affected productBigFix Platform | Published04/01/2026 | SeverityMedium |
CVE-2026-21765HCL BigFix Platform is affected by insecure permissions on private cryptographic keys | Exploitation statusNot known exploited | FixNot confirmed | Affected productBigFix Platform | Published04/01/2026 | SeverityHigh |
CVE-2026-21790HCL Traveler is susceptible to a weak default HTTP header validation vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productTraveler | Published03/24/2026 | SeverityMedium |
CVE-2026-21783HCL Traveler is affected by sensitive information disclosure | Exploitation statusNot known exploited | FixNot confirmed | Affected productTraveler | Published03/24/2026 | SeverityMedium |
CVE-2026-21788HCL Connections is vulnerable to cross-site scripting (XSS) | Exploitation statusNot known exploited | FixNot confirmed | Affected productConnections | Published03/19/2026 | SeverityMedium |
CVE-2024-42210HCL Unica Marketing Operations v12.1.8 and lower is affected by a Stored cross-site scripting (XSS) vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productUnica Marketing Operations (Plan) | Published03/19/2026 | SeverityHigh |
CVE-2025-62328HCL Nomad server on Domino is affected by a missing default frame-ancestors directive | Exploitation statusNot known exploited | FixNot confirmed | Affected productNomad server on Domino | Published03/11/2026 | SeverityLow |
CVE-2026-21786HCL Sametime for iOS is affected by sensitive information disclosure | Exploitation statusNot known exploited | FixNot confirmed | Affected productSametime for iOS | Published03/05/2026 | SeverityLow |
CVE-2025-62326HCL Digital Experience is susceptible to stored cross-site scripting (XSS) | Exploitation statusNot known exploited | FixNot confirmed | Affected productDigital Experience | Published02/20/2026 | SeverityMedium |
CVE-2025-52603HCL Connections is vulnerable to information disclosure | Exploitation statusNot known exploited | FixNot confirmed | Affected productConnections | Published02/20/2026 | SeverityLow |
CVE-2025-31990HCL DevOps Velocity is susceptible to a Denial of Service vulnerability | Exploitation statusNot known exploited | FixYes | Affected productHCL DevOps Velocity | Published02/07/2026 | SeverityMedium |
CVE-2023-37525HCL BigFix Compliance is vulnerable to a sensitive information disclosure | Exploitation statusNot known exploited | FixNot confirmed | Affected productBigFix Compliance | Published01/28/2026 | SeverityMedium |
CVE-2025-62327HCL DevOps Deploy is susceptible to insufficiently protected credentials | Exploitation statusNot known exploited | FixNot confirmed | Affected productDevOps Deploy | Published01/07/2026 | SeverityMedium |
CVE-2025-31964HCL BigFix IVR is impacted by an improper service binding configuration | Exploitation statusNot known exploited | FixNot confirmed | Affected productBigFix IVR | Published01/07/2026 | SeverityLow |
CVE-2025-31963HCL BigFix IVR is impacted by improper authentication and missing CSRF protection | Exploitation statusNot known exploited | FixNot confirmed | Affected productBigFix IVR | Published01/07/2026 | SeverityLow |
CVE-2025-31962HCL BigFix IVR is impacted by an insufficient session expiration vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productBigFix IVR | Published01/07/2026 | SeverityLow |
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan
.svg){kind=icon}
.svg){kind=icon}
.svg){kind=icon}
