Monthly
HCL Hive's software supply chain governance weaknesses expose the application to risk from vulnerable, unmaintained, or malicious third-party dependencies incorporated into its build or runtime environment. The flaw (CWE-1104) reflects insufficient vetting of upstream components, meaning existing dependencies may carry unpatched CVEs or could serve as an introduction vector for malicious code. With a CVSS of 4.2 (AV:N/AC:H/PR:N/UI:R), exploitation is constrained by high attack complexity and user interaction requirements; no public exploit and no CISA KEV listing were identified at time of analysis.
Privilege escalation vulnerabilities in HP Easy Start for macOS, versions prior to 2.16.7.260722, allow a local low-privileged user to gain elevated system access. Classified under CWE-1104 (Use of Unmaintained Third-Party Components), the root cause likely involves outdated bundled libraries within the printer setup utility. HP has released version 2.16.7.260722 as the remediation; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthorized system access in HCL Hive results from the product bundling third-party components that contain publicly documented security flaws. All tracked versions (CPE: cpe:2.3:a:hclsoftware:hcl_hive:*:*:*:*:*:*:*:*) are potentially affected, and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms that remote, unauthenticated attackers can reach the vulnerability without user interaction. The Authentication Bypass tag indicates the inherited component flaw enables circumvention of access controls with high confidentiality impact; no active exploitation has been confirmed by CISA KEV at time of analysis.
Stack overflow vulnerability in Perl module TOML::XS versions prior to 0.06 stems from an uncontrolled recursion flaw in the bundled, unmaintained tomlc99 library. An unauthenticated remote attacker can cause denial of service or potentially achieve arbitrary code execution by sending a deeply nested TOML document to any application using from_toml to parse untrusted input. No active exploitation or public exploit code has been identified, but the flaw is easily reachable over the network.
Full takeover of Oracle Platform Security for Java (OPSS) is possible in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0, where a low-privileged attacker with network access can compromise the component via crafted SOAP requests. Oracle rates this CVSS 8.8 with high confidentiality, integrity, and availability impact, meaning successful exploitation yields complete control of the OPSS component rather than mere data exposure. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
HCL MyCloud ships a bundled IIS Server component containing publicly disclosed vulnerabilities, classified under CWE-1104 (Use of Unmaintained Third-Party Components). The CVSS 2.2 score (AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N) reflects an extremely constrained attack surface: only a highly privileged attacker navigating high complexity can achieve limited confidentiality disclosure. No public exploit code or active exploitation has been identified at time of analysis.
Use of an unmaintained third-party component in the Perl module Image::EPEG (through version 0.15) exposes users to any latent flaws in the bundled Epeg 0.9.0 JPEG thumbnailing library, which was last updated in 2004 and is no longer supported. Reported by CPANSec (CWE-1104), the core issue is that any JPEG-decoding vulnerability in this two-decade-old embedded library will never receive an upstream fix. There is no public exploit identified at time of analysis, EPSS exploitation probability is low (0.17%), and the assigned CVSS of 9.8 appears to reflect worst-case memory-corruption potential in image parsing rather than a specific demonstrated flaw.
HCL Traveler for Microsoft Outlook (HTMO) is susceptible to vulnerabilities due to .NET Framework 4.5 being out of service. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
The HCL Traveler for Microsoft Outlook libraries are being flagged as potentially malicious software or an unrecognized application. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
Use of an end-of-life jQuery 1.x library in HCL BigFix SCM Reporting 11.0.5 exposes the management console to client-side attacks, including DOM-based XSS, inherited from publicly known unpatched flaws in the dependency. With no public exploit identified at time of analysis and a very low EPSS score (0.04%), the CVSS 8.3 rating reflects high theoretical impact rather than confirmed in-the-wild abuse, though successful exploitation requires user interaction with a crafted resource.
HCL Hive's software supply chain governance weaknesses expose the application to risk from vulnerable, unmaintained, or malicious third-party dependencies incorporated into its build or runtime environment. The flaw (CWE-1104) reflects insufficient vetting of upstream components, meaning existing dependencies may carry unpatched CVEs or could serve as an introduction vector for malicious code. With a CVSS of 4.2 (AV:N/AC:H/PR:N/UI:R), exploitation is constrained by high attack complexity and user interaction requirements; no public exploit and no CISA KEV listing were identified at time of analysis.
Privilege escalation vulnerabilities in HP Easy Start for macOS, versions prior to 2.16.7.260722, allow a local low-privileged user to gain elevated system access. Classified under CWE-1104 (Use of Unmaintained Third-Party Components), the root cause likely involves outdated bundled libraries within the printer setup utility. HP has released version 2.16.7.260722 as the remediation; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthorized system access in HCL Hive results from the product bundling third-party components that contain publicly documented security flaws. All tracked versions (CPE: cpe:2.3:a:hclsoftware:hcl_hive:*:*:*:*:*:*:*:*) are potentially affected, and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms that remote, unauthenticated attackers can reach the vulnerability without user interaction. The Authentication Bypass tag indicates the inherited component flaw enables circumvention of access controls with high confidentiality impact; no active exploitation has been confirmed by CISA KEV at time of analysis.
Stack overflow vulnerability in Perl module TOML::XS versions prior to 0.06 stems from an uncontrolled recursion flaw in the bundled, unmaintained tomlc99 library. An unauthenticated remote attacker can cause denial of service or potentially achieve arbitrary code execution by sending a deeply nested TOML document to any application using from_toml to parse untrusted input. No active exploitation or public exploit code has been identified, but the flaw is easily reachable over the network.
Full takeover of Oracle Platform Security for Java (OPSS) is possible in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0, where a low-privileged attacker with network access can compromise the component via crafted SOAP requests. Oracle rates this CVSS 8.8 with high confidentiality, integrity, and availability impact, meaning successful exploitation yields complete control of the OPSS component rather than mere data exposure. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
HCL MyCloud ships a bundled IIS Server component containing publicly disclosed vulnerabilities, classified under CWE-1104 (Use of Unmaintained Third-Party Components). The CVSS 2.2 score (AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N) reflects an extremely constrained attack surface: only a highly privileged attacker navigating high complexity can achieve limited confidentiality disclosure. No public exploit code or active exploitation has been identified at time of analysis.
Use of an unmaintained third-party component in the Perl module Image::EPEG (through version 0.15) exposes users to any latent flaws in the bundled Epeg 0.9.0 JPEG thumbnailing library, which was last updated in 2004 and is no longer supported. Reported by CPANSec (CWE-1104), the core issue is that any JPEG-decoding vulnerability in this two-decade-old embedded library will never receive an upstream fix. There is no public exploit identified at time of analysis, EPSS exploitation probability is low (0.17%), and the assigned CVSS of 9.8 appears to reflect worst-case memory-corruption potential in image parsing rather than a specific demonstrated flaw.
HCL Traveler for Microsoft Outlook (HTMO) is susceptible to vulnerabilities due to .NET Framework 4.5 being out of service. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
The HCL Traveler for Microsoft Outlook libraries are being flagged as potentially malicious software or an unrecognized application. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
Use of an end-of-life jQuery 1.x library in HCL BigFix SCM Reporting 11.0.5 exposes the management console to client-side attacks, including DOM-based XSS, inherited from publicly known unpatched flaws in the dependency. With no public exploit identified at time of analysis and a very low EPSS score (0.04%), the CVSS 8.3 rating reflects high theoretical impact rather than confirmed in-the-wild abuse, though successful exploitation requires user interaction with a crafted resource.