# cve.now: Hclsoftware

The newest entries naming Hclsoftware as an affected vendor (up to 200), of 100 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-108018](https://cve.now/CVE-2026-108018.md): BigFix Mobile is affected by sensitive information disclosure (CVSS 6.3)
- [CVE-2026-65022](https://cve.now/CVE-2026-65022.md): BigFix Mobile is affected by a Cross-site scripting vulnerability (CVSS 6.3)
- [CVE-2026-108015](https://cve.now/CVE-2026-108015.md): eMudhra Compromised Certificate vulnerability impacts HCL Notes Client (CVSS 9.1)
- [CVE-2026-108014](https://cve.now/CVE-2026-108014.md): eMudhra Compromised Certificate vulnerability impacts HCL Domino Server (CVSS 9.1)
- [CVE-2026-67165](https://cve.now/CVE-2026-67165.md): HCL Connections is vulnerable to cross-site scripting (XSS) (CVSS 5.4)
- [CVE-2026-67075](https://cve.now/CVE-2026-67075.md): HCL Digital Experience is affected by improper input sanitation (CVSS 6.5)
- [CVE-2026-67071](https://cve.now/CVE-2026-67071.md): HCL DevOps Deploy / HCL Launch is susceptible to an Improper Removal of Sensitive Information Before Storage or Transfer (CVSS 6.5)
- [CVE-2026-21827](https://cve.now/CVE-2026-21827.md): HCL Connections is vulnerable to an information disclosure vulnerability (CVSS 3.1)
- [CVE-2025-62341](https://cve.now/CVE-2025-62341.md): HCL Connections is vulnerable to server-side request forgery (SSRF) (CVSS 3.7)
- [CVE-2026-21808](https://cve.now/CVE-2026-21808.md): HCL BigFix Quantum Risk Analyzer is affected by logging sensitive information (CVSS 4.1)
- [CVE-2026-21807](https://cve.now/CVE-2026-21807.md): HCL BigFix Quantum Risk Analyzer is affected by a stack-based buffer overflow (CVSS 3.9)
- [CVE-2026-21810](https://cve.now/CVE-2026-21810.md): HCL BigFix Quantum Risk Analyzer is affected by a hardcoded external resource reference and downloading code without integrity checking (CVSS 4.4)
- [CVE-2026-21809](https://cve.now/CVE-2026-21809.md): HCL BigFix Quantum Risk Analyzer is affected by generating error messages with sensitive information (CVSS 3.9)
- [CVE-2026-56547](https://cve.now/CVE-2026-56547.md): An input reflection vulnerability affects HCL Traveler (CVSS 3.5)
- [CVE-2025-68825](https://cve.now/CVE-2025-68825.md): HCL Hive is affected by incorrect default permissions (CVSS 7.5)
- [CVE-2026-21752](https://cve.now/CVE-2026-21752.md): HCL Hive is affected by a use of vulnerable third-party components (CVSS 7.5)
- [CVE-2026-21755](https://cve.now/CVE-2026-21755.md): HCL Hive is affected by a missing rate limit (CVSS 5.3)
- [CVE-2025-68833](https://cve.now/CVE-2025-68833.md): HCL Hive is affected by use of a cryptographic primitive with a risky implementation (CVSS 5.3)
- [CVE-2026-21751](https://cve.now/CVE-2026-21751.md): HCL Hive is affected by use of a cryptographic primitive with a risky implementation (CVSS 7.4)
- [CVE-2026-21756](https://cve.now/CVE-2026-21756.md): HCL Hive is affected by a broken access control vulnerability (CVSS 7.2)
- [CVE-2026-21759](https://cve.now/CVE-2026-21759.md): HCL Hive is affected by an information exposure vulnerability (CVSS 4.3)
- [CVE-2026-56619](https://cve.now/CVE-2026-56619.md): HCL BigFix Mobile is vulnerable to Reflected Cross-Site Scripting (Reflected XSS) (CVSS 5.4)
- [CVE-2026-56620](https://cve.now/CVE-2026-56620.md): HCL BigFix Mobile is vulnerable to information disclosure (CVSS 4.3)
- [CVE-2026-21766](https://cve.now/CVE-2026-21766.md): HCL Digital Experience and Digital Experience Compose insufficiently protects credentials (CVSS 5.4)
- [CVE-2026-56538](https://cve.now/CVE-2026-56538.md): HCL Connections is vulnerable to information disclosure (CVSS 3.5)
- [CVE-2026-56537](https://cve.now/CVE-2026-56537.md): HCL Connections is vulnerable to information disclosure (CVSS 3.5)
- [CVE-2026-56583](https://cve.now/CVE-2026-56583.md): HCL MyCloud was affected with Concurrent Login Vulnerability. (CVSS 3.1)
- [CVE-2026-56582](https://cve.now/CVE-2026-56582.md): HCL MyCloud was affected with SSL/TLS Protocol Affected with LUCKY13 Vulnerability. (CVSS 3.1)
- [CVE-2026-56581](https://cve.now/CVE-2026-56581.md): HCL MyCloud was affected with Cookie Attribute Path Not Set (CVSS 2.6)
- [CVE-2026-56580](https://cve.now/CVE-2026-56580.md): HCL MyCloud was affected by Using Components with Known Vulnerability (CVSS 2.2)
- [CVE-2026-56579](https://cve.now/CVE-2026-56579.md): HCL MyCloud was affected with Exposure of Sensitive Information to an Unauthorized Actor. (CVSS 3.1)
- [CVE-2026-56578](https://cve.now/CVE-2026-56578.md): HCL MyCloud was affected by Server Version Disclosure (CVSS 2.2)
- [CVE-2026-56577](https://cve.now/CVE-2026-56577.md): HCL MyCloud affected by Weak Password Policy (CVSS 3.1)
- [CVE-2026-56586](https://cve.now/CVE-2026-56586.md): HCL IEM was affected with X-Content-Type-Options Header Missing (CVSS 3.1)
- [CVE-2026-56585](https://cve.now/CVE-2026-56585.md): HCL IEM was affected with the Anti Clickjacking XFrame Options Header Missing (CVSS 3.1)
- [CVE-2026-56587](https://cve.now/CVE-2026-56587.md): HCL IEM was affected with Strict transport security not enforced (CVSS 3.7)
- [CVE-2026-56584](https://cve.now/CVE-2026-56584.md): HCL IEM was affected with the Information disclosure nginx server (CVSS 3.7)
- [CVE-2023-37507](https://cve.now/CVE-2023-37507.md): An information disclosure vulnerability affects HCL DevOps Plan (CVSS 6.9)
- [CVE-2023-37508](https://cve.now/CVE-2023-37508.md): HCL DevOps Plan is susceptible to a Cross-Site Scripting (XSS) vulnerability (CVSS 2.3)
- [CVE-2026-21824](https://cve.now/CVE-2026-21824.md): A privilege escalation vulnerability affects HCL Commerce (CVSS 8.8)
- [CVE-2025-59866](https://cve.now/CVE-2025-59866.md): The HCL DFMPro, DFXAnalytics and DFXServer installers are affected by ‘Insecure file permissions Leading to Privilege Escalation’ vulnerabil (CVSS 3.3)
- [CVE-2026-21764](https://cve.now/CVE-2026-21764.md): Insufficient Input Validation in DevOps Loop (CVSS 3.1)
- [CVE-2026-21762](https://cve.now/CVE-2026-21762.md): Missing HTTP Security Headers in DevOps Loop (CVSS 3.7)
- [CVE-2026-21761](https://cve.now/CVE-2026-21761.md): CORS Misconfiguration in DevOps Loop (CVSS 4.2)
- [CVE-2026-21760](https://cve.now/CVE-2026-21760.md): Unauthorized Access to Admin Functionality via Forced Browsing (CVSS 4.6)
- [CVE-2024-23572](https://cve.now/CVE-2024-23572.md): HCL Aftermarket EPC is vulnerable to attack as cookie appears to contain a session token, which may increase the risk associated with this i (CVSS 4.2)
- [CVE-2024-23570](https://cve.now/CVE-2024-23570.md): HCL Aftermarket EPC is affected by clickjacking vulnerability Cross-Frame Scripting is an attack technique where an attacker loads a vulnera (CVSS 4.3)
- [CVE-2024-23578](https://cve.now/CVE-2024-23578.md): HCL Aftermarket EPC is vulnerable to attack as the application implements an HTML5 cross-origin resource sharing (CORS) policy for this requ (CVSS 4.2)
- [CVE-2024-23569](https://cve.now/CVE-2024-23569.md): HCL Aftermarket EPC is vulnerable to attack since the server is not configured with “X-XSS-Protection" header (CVSS 4.3)
- [CVE-2024-23577](https://cve.now/CVE-2024-23577.md): HCL Aftermarket EPC is vulnerable since the application does not have a validation for HOST header and accepts arbitrary hosts when requeste (CVSS 4.3)
- [CVE-2024-23574](https://cve.now/CVE-2024-23574.md): HCL Aftermarket EPC is vulnerable to attack since It was found that a malicious actor can use brute-force techniques to either guess or conf (CVSS 5.3)
- [CVE-2024-42214](https://cve.now/CVE-2024-42214.md): HCL Aftermarket EPC is vulnerable to attack since HTTP OPTIONS method is enabled on this web server. (CVSS 5.3)
- [CVE-2024-23575](https://cve.now/CVE-2024-23575.md): HCL Aftermarket EPC is vulnerable to attack since the application returns detailed error messages that leak information about the processing (CVSS 5.3)
- [CVE-2024-23571](https://cve.now/CVE-2024-23571.md): HCL Aftermarket EPC is vulnerable to attack since the application does not have an appropriate caching policy specifying the extent to which (CVSS 4.3)
- [CVE-2024-23573](https://cve.now/CVE-2024-23573.md): HCL Aftermarket EPC is vulnerable to attack since the Application is vulnerable to Lucky 13. (CVSS 3.7)
- [CVE-2024-23568](https://cve.now/CVE-2024-23568.md): HCL Aftermarket EPC is vulnerable to attacks since the server software version used by the application is revealed by the web server. (CVSS 5.3)
- [CVE-2024-23565](https://cve.now/CVE-2024-23565.md): HCL Aftermarket EPC is vulnerable to email flooding as the application does not have a proper mail limitation mechanism at Forget Password f (CVSS 5.3)
- [CVE-2024-23566](https://cve.now/CVE-2024-23566.md): HCL Aftermarket EPC is vulnerable to brute force attacks since application doesn’t have captcha implemented. (CVSS 6.5)
- [CVE-2024-23567](https://cve.now/CVE-2024-23567.md): HCL Aftermarket EPC is affected by Sensitive Information in GET method & in URL which allows application to pass sensitive data via URL para (CVSS 4.3)
- [CVE-2026-21770](https://cve.now/CVE-2026-21770.md): HCL Traveler for Microsoft Outlook (HTMO) is susceptible to DLL hijacking (CVSS 6.5)
- [CVE-2026-35146](https://cve.now/CVE-2026-35146.md): HCL DFXServer is affected by an Unencrypted Communication vulnerability. (CVSS 6.3)
- [CVE-2026-21840](https://cve.now/CVE-2026-21840.md): HCL BigFix Platform is affected by a user enumeration vulnerability (CVSS 3.1)
- [CVE-2026-56460](https://cve.now/CVE-2026-56460.md): HCL DevOps Deploy / HCL Launch is susceptible to an Insertion of Sensitive Information Into Sent Data vulnerability (CVSS 6.5)
- [CVE-2026-56458](https://cve.now/CVE-2026-56458.md): HCL DevOps Deploy is susceptible to a Permissive Cross-domain Security Policy with Untrusted Domains (CVSS 5.4)
- [CVE-2026-56459](https://cve.now/CVE-2026-56459.md): HCL DevOps Deploy / HCL Launch is susceptible to sensitive information disclosure (CVSS 6.2)
- [CVE-2026-56457](https://cve.now/CVE-2026-56457.md): HCL DevOps Deploy / HCL Launch is susceptible to an exposure of sensitive information (CVSS 4.3)
- [CVE-2025-59868](https://cve.now/CVE-2025-59868.md): HCL Traveler for Microsoft Outlook (HTMO) is susceptible to sensitive data exposure (CVSS 5.5)
- [CVE-2023-37524](https://cve.now/CVE-2023-37524.md): HCL Traveler for Microsoft Outlook (HTMO) is susceptible to vulnerabilities due to .NET Framework 4.5 being out of service (CVSS 7.7)
- [CVE-2024-23581](https://cve.now/CVE-2024-23581.md): HCL Traveler for Microsoft Outlook (HTMO) is susceptible to an application modification vulnerability (CVSS 6.7)
- [CVE-2025-15619](https://cve.now/CVE-2025-15619.md): HCL Connections is vulnerable to broken access control (CVSS 3.5)
- [CVE-2026-21768](https://cve.now/CVE-2026-21768.md): HCL Verse for Android is susceptible to an injection vulnerability (CVSS 6.3)
- [CVE-2026-21825](https://cve.now/CVE-2026-21825.md): HCL Digital Experience Compose is affected by a reflected cross-site scripting (XSS) vulnerability in the search center (CVSS 6.1)
- [CVE-2026-21826](https://cve.now/CVE-2026-21826.md): HCL Digital Experience and HCL Digital Experience Compose could be susceptible to Host header injection (CVSS 6.1)
- [CVE-2026-21837](https://cve.now/CVE-2026-21837.md): HCL Digital Experience is affected by an OS command injection vulnerability in the Digital Asset Management API (CVSS 8.7)
- [CVE-2025-62338](https://cve.now/CVE-2025-62338.md): HCL BigFix Cloud Lifecycle Management is affected by lack of input validation (CVSS 3.3)
- [CVE-2026-21785](https://cve.now/CVE-2026-21785.md): HCL BigFix Remote Control Server WebUI is affected by a misconfigured Content Security Policy (CVSS 4.0)
- [CVE-2026-21836](https://cve.now/CVE-2026-21836.md): HCL DominoIQ is affected by broken access control (CVSS 6.5)
- [CVE-2026-21789](https://cve.now/CVE-2026-21789.md): HCL Connections is vulnerable to broken access control (CVSS 4.6)
- [CVE-2026-21821](https://cve.now/CVE-2026-21821.md): HCL BigFix SCM Reporting is affected by vulnerabilities in jQuery (CVSS 8.3)
- [CVE-2025-15634](https://cve.now/CVE-2025-15634.md): HCL BigFix WebUI is affected by a missing authorization vulnerability (CVSS 5.3)
- [CVE-2025-15633](https://cve.now/CVE-2025-15633.md): HCL BigFix WebUI is affected by an improper authorization vulnerability (CVSS 5.3)
- [CVE-2025-31981](https://cve.now/CVE-2025-31981.md): HCL BigFix Service Management (SM) Discovery is vulnerable to unenforced encryption (CVSS 5.3)
- [CVE-2025-31958](https://cve.now/CVE-2025-31958.md): HCL BigFix Service Management (SM) is susceptible to HTTP Request Smuggling (CVSS 3.7)
- [CVE-2025-31991](https://cve.now/CVE-2025-31991.md): HCL DevOps Velocity is susceptible to brute-force attacks (CVSS 6.8)
- [CVE-2026-21767](https://cve.now/CVE-2026-21767.md): HCL BigFix Platform is affected by insufficient authentication (CVSS 4.0)
- [CVE-2026-21765](https://cve.now/CVE-2026-21765.md): HCL BigFix Platform is affected by insecure permissions on private cryptographic keys (CVSS 8.8)
- [CVE-2026-21790](https://cve.now/CVE-2026-21790.md): HCL Traveler is susceptible to a weak default HTTP header validation vulnerability (CVSS 6.3)
- [CVE-2026-21783](https://cve.now/CVE-2026-21783.md): HCL Traveler is affected by sensitive information disclosure (CVSS 4.3)
- [CVE-2026-21788](https://cve.now/CVE-2026-21788.md): HCL Connections is vulnerable to cross-site scripting (XSS) (CVSS 5.4)
- [CVE-2024-42210](https://cve.now/CVE-2024-42210.md): HCL Unica Marketing Operations v12.1.8 and lower is affected by a Stored cross-site scripting (XSS) vulnerability (CVSS 7.6)
- [CVE-2025-62328](https://cve.now/CVE-2025-62328.md): HCL Nomad server on Domino is affected by a missing default frame-ancestors directive (CVSS 3.7)
- [CVE-2026-21786](https://cve.now/CVE-2026-21786.md): HCL Sametime for iOS is affected by sensitive information disclosure (CVSS 3.3)
- [CVE-2025-62326](https://cve.now/CVE-2025-62326.md): HCL Digital Experience is susceptible to stored cross-site scripting (XSS) (CVSS 6.1)
- [CVE-2025-52603](https://cve.now/CVE-2025-52603.md): HCL Connections is vulnerable to information disclosure (CVSS 3.5)
- [CVE-2025-31990](https://cve.now/CVE-2025-31990.md): HCL DevOps Velocity is susceptible to a Denial of Service vulnerability (CVSS 6.8)
- [CVE-2023-37525](https://cve.now/CVE-2023-37525.md): HCL BigFix Compliance is vulnerable to a sensitive information disclosure (CVSS 5.3)
- [CVE-2025-62327](https://cve.now/CVE-2025-62327.md): HCL DevOps Deploy is susceptible to insufficiently protected credentials (CVSS 4.9)
- [CVE-2025-31964](https://cve.now/CVE-2025-31964.md): HCL BigFix IVR is impacted by an improper service binding configuration (CVSS 2.2)
- [CVE-2025-31963](https://cve.now/CVE-2025-31963.md): HCL BigFix IVR is impacted by improper authentication and missing CSRF protection (CVSS 2.9)
- [CVE-2025-31962](https://cve.now/CVE-2025-31962.md): HCL BigFix IVR is impacted by an insufficient session expiration vulnerability (CVSS 2.0)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/hclsoftware
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.