13
CVEs
0
Critical
0
High
0
KEV
0
PoC
0
Unpatched C/H
0.0%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
0
MEDIUM
8
LOW
5
Monthly CVE Trend
Affected Products (12)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2025-62299 | Privilege escalation in HCL IntelliOps Event Management (IEM) allows an authenticated, high-privileged attacker to access resources beyond their original authorization boundary, achieving confidentiality impact against protected data. The vulnerability is classified as CWE-272 (Least Privilege Violation) with a Changed scope in CVSS, indicating the attacker can reach resources outside their normal privilege domain within the application. No public exploit code or active exploitation has been identified at time of analysis; the EPSS signal was not provided. | MEDIUM | 6.6 | 0.2% | 33 |
No patch
|
| CVE-2025-62342 | Session tokens in HCL IntelliOps Event Management (IEM) versions 1.3 and 1.4 persist as valid on the server after a user logs out or an account is deleted, allowing an attacker who has previously captured a legitimate session token to replay it and maintain unauthorized access beyond the intended session lifecycle. The root cause is CWE-613 (Insufficient Session Expiration), where server-side session records are not destroyed upon logout or account removal. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 6.4 Medium score reflects meaningful constraints on exploitation including high attack complexity and required user interaction. | MEDIUM | 6.4 | 0.2% | 32 |
No patch
|
| CVE-2025-62300 | Race condition (CWE-362) in HCL IntelliOps Event Management (IEM) exposes a timing window that a remote, unauthenticated attacker can exploit to modify shared resources, producing high integrity impact. The CVSS 3.1 score of 5.9 reflects the offsetting effect of high attack complexity (AC:H), which limits opportunistic exploitation to adversaries capable of precise timing control. No active exploitation has been confirmed by CISA KEV, and no public exploit code is known at time of analysis. | MEDIUM | 5.9 | 0.1% | 30 |
No patch
|
| CVE-2025-62307 | Insufficient audit logging in HCL IntelliOps Event Management (IEM) allows authenticated network users to probe privilege boundaries and conduct reconnaissance without generating detectable log entries. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms any low-privileged authenticated user can exploit this over the network with no complexity barrier. No public exploit code or active exploitation has been identified; this is a vendor-self-reported issue with no EPSS data or KEV listing. | MEDIUM | 5.4 | 0.2% | 27 |
No patch
|
| CVE-2026-21754 | Missing HttpOnly cookie flags in HCL Hive expose session tokens and sensitive credentials to client-side script access, enabling session hijacking when combined with cross-site scripting. The CVE description cites broader infrastructure weaknesses - lateral movement, container breakout, and internal communications exposure - suggesting CWE-1004 is one root cause within a cluster of related configuration flaws. No public exploit has been identified at time of analysis, and no KEV listing exists, but the network-accessible attack surface with no privilege requirement (beyond user interaction) makes this relevant for any internet-exposed Hive deployment. | MEDIUM | 5.4 | 0.1% | 27 |
No patch
|
| CVE-2025-62306 | Insufficient audit logging in HCL IntelliOps Event Management (IEM) allows an authenticated low-privilege network user to perform workflow actions that are not captured in security logs, breaking observability for incident response teams. All versions of IEM are affected per the wildcard CPE, and the CVSS Scope:Changed metric indicates the logging gap propagates impact to downstream audit platforms or SIEMs that depend on IEM event data. No public exploit code exists and CISA has not listed this in the KEV catalog; the primary risk is forensic and compliance-oriented rather than direct system compromise. | MEDIUM | 5.0 | 0.2% | 25 |
No patch
|
| CVE-2026-21784 | Missing or insecure Cross-Origin Resource Sharing (CORS) headers in HCL IntelliOps Event Management (IEM) expose the application to unauthorized cross-origin browser interactions. The CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N vector indicates that a highly privileged IEM user must be socially engineered into visiting a malicious page while authenticated, allowing an attacker's script to read IEM responses or issue limited requests on the victim's behalf. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis. | MEDIUM | 4.8 | 0.1% | 24 |
No patch
|
| CVE-2026-21753 | HCL Hive's software supply chain governance weaknesses expose the application to risk from vulnerable, unmaintained, or malicious third-party dependencies incorporated into its build or runtime environment. The flaw (CWE-1104) reflects insufficient vetting of upstream components, meaning existing dependencies may carry unpatched CVEs or could serve as an introduction vector for malicious code. With a CVSS of 4.2 (AV:N/AC:H/PR:N/UI:R), exploitation is constrained by high attack complexity and user interaction requirements; no public exploit and no CISA KEV listing were identified at time of analysis. | MEDIUM | 4.2 | 0.1% | 21 |
No patch
|
| CVE-2026-21758 | HCL Hive exposes sensitive host environment information through a network-accessible information disclosure flaw, enabling unauthenticated remote attackers - under high attack complexity conditions - to collect reconnaissance data about the underlying system. The CVSS 3.7 (Low) score reflects both the constrained confidentiality impact and the high exploitation complexity. No public exploit code or active exploitation has been identified at time of analysis. | LOW | 3.7 | 0.2% | 19 |
No patch
|
| CVE-2025-52657 | HCL MyXalytics is susceptible to a low-severity denial-of-service condition via unrestricted character input in user-facing fields. Authenticated users can submit arbitrarily long strings into application inputs, potentially degrading system performance or availability due to absent input-length controls. No public exploit code exists and no active exploitation has been observed; the vendor CVSS score of 3.5 (Low) reflects limited real-world impact. | LOW | 3.5 | 0.2% | 18 |
No patch
|
| CVE-2025-52651 | Improper input validation in HCL MyXalytics allows an authenticated low-privileged user to submit malicious or unexpected data through the application, causing unintended system behavior or minor integrity-affecting outcomes. The CVSS vector (PR:L/UI:R/I:L) indicates exploitation requires both an authenticated session and user interaction, with impact limited to low-level integrity modification and no confidentiality exposure. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog. | LOW | 3.5 | 0.1% | 18 |
No patch
|
| CVE-2025-52652 | Content spoofing in HCL MyXalytics (CWE-451) enables an authenticated, low-privileged attacker to inject manipulated content into the application's user interface, causing it to appear as though the content originates from a trusted source. The vulnerability requires victim interaction - a user must view the attacker-influenced page - and carries a CVSS 3.5 (Low) base score, reflecting its constrained impact on integrity only with no confidentiality or availability effects. No public exploit code or active exploitation has been identified; the primary real-world concern is phishing and social engineering facilitated through the spoofed interface. | LOW | 3.5 | 0.1% | 18 |
No patch
|
| CVE-2025-62343 | Session invalidation failure in HCL IntelliOps Event Management (IEM) v1.3 and v1.4 allows session tokens to persist as valid after an admin explicitly logs out or an administrator deletes the session. An attacker who has previously captured a valid session token - through network interception, XSS, or other means - can replay that token post-logout to retain unauthorized access to admin-level functionality. No public exploit code has been identified at time of analysis, and EPSS/KEV data are not available for this CVE. | LOW | 3.1 | 0.2% | 16 |
No patch
|