39
CVEs
0
Critical
8
High
0
KEV
0
PoC
6
Unpatched C/H
12.8%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
8
MEDIUM
17
LOW
14
Monthly CVE Trend
Affected Products (27)
Hcl Hive
7
Mycloud
7
Connections
6
Intelliops Event Management
4
Traveler
3
Traveler For Microsoft Outlook
3
Hcl Devops Deploy Hcl Launch
3
Bigfix Service Management Sm
2
Hcl Bigfix Mobile
2
Bigfix Quantum Risk Analyzer
2
Dfxserver
2
Bigfix Webui
2
Dx Compose
1
Digital Experience Dx Compose
1
Dfxanalytics
1
Unica Marketing Operations Plan
1
Commerce
1
Hcl Devops Deploy
1
Open Redirect
1
Velocity
1
Dfmpro For Catia
1
Brute Force
1
Digital Experience
1
Hcl Traveler For Microsoft Outlook Htmo
1
Cors Misconfiguration
1
Verse For Android
1
Bigfix Scm Reporting
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-21824 | Privilege escalation in HCL Commerce (versions 7 through 9.1.19) allows an authenticated low-privileged user to elevate their rights and perform unauthorized administrative operations, disclose other users' personal data, and cause denial of service. The flaw is network-reachable with low attack complexity and requires only existing low-level credentials, yielding high confidentiality, integrity, and availability impact (CVSS 8.8). No public exploit identified at time of analysis; the issue was self-reported by HCL and is not listed in CISA KEV. | HIGH | 8.8 | 0.2% | 44 |
No patch
|
| CVE-2023-37524 | HCL Traveler for Microsoft Outlook (HTMO) is susceptible to vulnerabilities due to .NET Framework 4.5 being out of service. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. | HIGH | 7.8 | 0.1% | 39 |
|
| CVE-2024-23581 | The HCL Traveler for Microsoft Outlook libraries are being flagged as potentially malicious software or an unrecognized application. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. | HIGH | 7.8 | 0.1% | 39 |
|
| CVE-2026-21752 | Unauthorized system access in HCL Hive results from the product bundling third-party components that contain publicly documented security flaws. All tracked versions (CPE: cpe:2.3:a:hclsoftware:hcl_hive:*:*:*:*:*:*:*:*) are potentially affected, and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms that remote, unauthenticated attackers can reach the vulnerability without user interaction. The Authentication Bypass tag indicates the inherited component flaw enables circumvention of access controls with high confidentiality impact; no active exploitation has been confirmed by CISA KEV at time of analysis. | HIGH | 7.5 | 0.3% | 38 |
No patch
|
| CVE-2025-68825 | Incorrect default permissions in HCL Hive 1.0 expose containerized deployments to unauthorized lateral movement, container breakout, and interception of sensitive inter-service communications by network-accessible attackers requiring no authentication. The flaw (CWE-276) means the platform ships with overly permissive defaults - not a misconfiguration by the operator - making any default deployment potentially vulnerable without additional hardening. No public exploit code exists at time of analysis, and the vulnerability has not been added to the CISA KEV catalog, but the combination of a network-accessible vector, no authentication requirement, and high confidentiality impact warrants prompt remediation. | HIGH | 7.5 | 0.2% | 38 |
No patch
|
| CVE-2026-56458 | Sensitive-information disclosure in HCL DevOps Deploy (formerly UrbanCode Deploy) versions 8.1 through 8.1.2.6 and 8.2 through 8.2.1.0 stems from an overly permissive Cross-Origin Resource Sharing (CORS) policy that fails to restrict allowed origins to trusted domains. Because the application accepts or reflects arbitrary origins, an attacker-controlled web page can issue cross-origin credentialed requests against an authenticated user's session to read protected data and invoke privileged actions. There is no public exploit identified at time of analysis, EPSS is low (0.23%, 13th percentile), and CISA SSVC rates exploitation as none. | HIGH | 7.5 | 0.2% | 38 |
No patch
|
| CVE-2026-21751 | HCL Hive employs a risky cryptographic primitive (CWE-1240) that creates systemic trust failure across the platform: if any single internal component is compromised, an attacker can exploit the weak cryptographic construction to achieve unauthorized lateral movement or harvest credentials at scale. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) indicates the flaw is reachable over the network without authentication, though high attack complexity caps opportunistic risk. No public exploit code or active exploitation has been identified at time of analysis. | HIGH | 7.4 | 0.2% | 37 |
No patch
|
| CVE-2026-21756 | Broken access control in HCL Hive 1.0 allows a high-privileged network attacker to bypass code verification gates and introduce unverified, malicious, or broken code directly into production environments. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) reflects full confidentiality, integrity, and availability impact against the vulnerable system, contingent on high-privilege access. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis. | HIGH | 7.2 | 0.3% | 36 |
No patch
|
| CVE-2026-56460 | Sensitive configuration data and credentials are exposed in API responses within HCL DevOps Deploy / HCL Launch, affecting all maintained version branches from 7.3 through 8.2.1.0. Any authenticated user with low-privilege access can retrieve secrets through standard API interactions, creating a stepping-stone for lateral movement or privilege escalation across connected deployment targets. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but real-world risk is elevated because CI/CD platforms routinely store high-value credentials for downstream infrastructure. | MEDIUM | 6.5 | 0.4% | 33 |
No patch
|
| CVE-2026-56577 | Weak password policy enforcement in HCL MyCloud exposes authenticated accounts to brute-force and credential-stuffing attacks, potentially enabling unauthorized account takeover. The flaw is classified under CWE-521 (Weak Password Requirements), meaning the platform fails to enforce sufficient password strength constraints on users. Despite tags indicating Information Disclosure risk, no public exploit code or active exploitation has been identified at time of analysis, and the vendor-assigned CVSS score of 3.1 reflects a Low severity rating. | MEDIUM | 6.5 | 0.2% | 33 |
No patch
|
| CVE-2026-21770 | DLL hijacking in HCL Traveler for Microsoft Outlook (HTMO) permits a local, high-privileged attacker to replace or plant a malicious DLL in a directory searched by the application at load time, enabling arbitrary code execution within the HTMO process context. The CVSS vector (AV:L/AC:L/PR:H/UI:R) confirms the attack is constrained to local access with elevated privileges and requires a user to trigger application load, substantially limiting real-world exploitability despite the full C/I/A:H impact ratings. No public exploit code and no CISA KEV listing have been identified at time of analysis. | MEDIUM | 6.5 | 0.1% | 33 |
|
| CVE-2026-35146 | HCL DFXServer permits client connections over plaintext HTTP, exposing all transmitted data to interception by any attacker with a man-in-the-middle position on the network path. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) confirms remote exploitation without authentication, contingent on a user initiating an HTTP session. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the risk is structurally inherent to any deployment where HTTP remains permitted alongside or instead of HTTPS. | MEDIUM | 6.3 | 0.1% | 32 |
No patch
|
| CVE-2026-21768 | HTML injection in HCL Verse for Android's rich text email composition component enables malicious content execution on the local device. The compose-rich-editor library (v1.0.0-rc14) bundled with HCL Verse for Android fails to sanitize HTML input, allowing crafted content to execute in the composition context. With High confidentiality and integrity impact signals in the CVSS vector, successful exploitation could expose sensitive email data or allow unauthorized modification of content; no public exploit code has been identified at time of analysis. | MEDIUM | 6.3 | 0.1% | 32 |
No patch
|
| CVE-2026-56459 | Sensitive information disclosure in HCL DevOps Deploy / HCL Launch exposes credentials or operational data stored in application log files to any local user who can read those files. Affected across four major release branches (7.3, 8.0, 8.1, and 8.2), the vulnerability stems from CWE-532, where the application writes sensitive material into logs without adequate sanitization or access restriction. No public exploit code has been identified at time of analysis, and the flaw is not listed in the CISA KEV catalog, but the high confidentiality impact (C:H) and zero-privilege local access condition elevate real-world concern in multi-tenant or shared-host deployments. | MEDIUM | 5.5 | 0.2% | 28 |
No patch
|
| CVE-2025-59868 | Sensitive application data exposure in HCL Traveler for Microsoft Outlook (HTMO) allows a local low-privileged attacker to read sensitive information - likely credentials, tokens, or session data written to application log files (CWE-532) - potentially enabling follow-on attacks against connected systems. The CVSS vector confirms local access with low privileges is sufficient to achieve high confidentiality impact, with no integrity or availability consequences. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis. | MEDIUM | 5.5 | 0.1% | 28 |
|