11
CVEs
0
Critical
4
High
0
KEV
0
PoC
4
Unpatched C/H
9.1%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
4
MEDIUM
4
LOW
3
Monthly CVE Trend
Affected Products (27)
Hcl Hive
7
Mycloud
7
Connections
6
Intelliops Event Management
4
Traveler
3
Traveler For Microsoft Outlook
3
Hcl Devops Deploy Hcl Launch
3
Bigfix Service Management Sm
2
Hcl Bigfix Mobile
2
Bigfix Quantum Risk Analyzer
2
Dfxserver
2
Bigfix Webui
2
Dx Compose
1
Digital Experience Dx Compose
1
Dfxanalytics
1
Unica Marketing Operations Plan
1
Commerce
1
Hcl Devops Deploy
1
Open Redirect
1
Velocity
1
Dfmpro For Catia
1
Brute Force
1
Digital Experience
1
Hcl Traveler For Microsoft Outlook Htmo
1
Cors Misconfiguration
1
Verse For Android
1
Bigfix Scm Reporting
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-21752 | Unauthorized system access in HCL Hive results from the product bundling third-party components that contain publicly documented security flaws. All tracked versions (CPE: cpe:2.3:a:hclsoftware:hcl_hive:*:*:*:*:*:*:*:*) are potentially affected, and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms that remote, unauthenticated attackers can reach the vulnerability without user interaction. The Authentication Bypass tag indicates the inherited component flaw enables circumvention of access controls with high confidentiality impact; no active exploitation has been confirmed by CISA KEV at time of analysis. | HIGH | 7.5 | 0.3% | 38 |
No patch
|
| CVE-2025-68825 | Incorrect default permissions in HCL Hive 1.0 expose containerized deployments to unauthorized lateral movement, container breakout, and interception of sensitive inter-service communications by network-accessible attackers requiring no authentication. The flaw (CWE-276) means the platform ships with overly permissive defaults - not a misconfiguration by the operator - making any default deployment potentially vulnerable without additional hardening. No public exploit code exists at time of analysis, and the vulnerability has not been added to the CISA KEV catalog, but the combination of a network-accessible vector, no authentication requirement, and high confidentiality impact warrants prompt remediation. | HIGH | 7.5 | 0.2% | 38 |
No patch
|
| CVE-2026-21751 | HCL Hive employs a risky cryptographic primitive (CWE-1240) that creates systemic trust failure across the platform: if any single internal component is compromised, an attacker can exploit the weak cryptographic construction to achieve unauthorized lateral movement or harvest credentials at scale. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) indicates the flaw is reachable over the network without authentication, though high attack complexity caps opportunistic risk. No public exploit code or active exploitation has been identified at time of analysis. | HIGH | 7.4 | 0.2% | 37 |
No patch
|
| CVE-2026-21756 | Broken access control in HCL Hive 1.0 allows a high-privileged network attacker to bypass code verification gates and introduce unverified, malicious, or broken code directly into production environments. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) reflects full confidentiality, integrity, and availability impact against the vulnerable system, contingent on high-privilege access. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis. | HIGH | 7.2 | 0.3% | 36 |
No patch
|
| CVE-2026-21755 | HCL Hive 1.0 exposes its authentication endpoint without rate limiting, enabling unauthenticated remote attackers to conduct brute-force or credential stuffing attacks that can lead to unauthorized account access, or to flood the endpoint causing a denial of service. Classified under CWE-307 (Improper Restriction of Excessive Authentication Attempts), the flaw requires no privileges or user interaction and is network-accessible against default deployments. No public exploit code or active exploitation has been identified at time of analysis, but the attack class is trivially automated with widely available tooling. | MEDIUM | 5.3 | 0.2% | 27 |
No patch
|
| CVE-2025-68833 | Insufficient access control granularity in HCL Hive's Keycloak IAM instance exposes protected resources to unauthenticated or unauthorized network attackers. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates this is remotely exploitable without credentials or user interaction against the IAM layer, resulting in unauthorized read access to confidential resources. No public exploit code or CISA KEV listing has been identified at time of analysis, and a vendor knowledge base article (KB0131731) has been published. | MEDIUM | 5.3 | 0.2% | 27 |
No patch
|
| CVE-2026-21810 | HCL BigFix Quantum Risk Analyzer contains a hardcoded external resource reference combined with absent binary integrity verification, exposing the product to binary substitution attacks and potential sensitive information disclosure. The affected CPE covers all versions of the product under hclsoftware. A locally privileged attacker could exploit the missing integrity check (CWE-494) to substitute a malicious binary fetched from the hardcoded external reference, achieving high-integrity impact. No public exploit code exists and CISA KEV does not list this vulnerability at time of analysis. | MEDIUM | 4.4 | 0.1% | 22 |
No patch
|
| CVE-2026-21759 | HCL Hive exposes its Swagger API documentation publicly to unauthenticated users, revealing API endpoint structures, HTTP methods, request/response schemas, and operational surface without access controls. While no credentials or PII are directly disclosed per the vendor's assessment, the exposed documentation materially reduces the reconnaissance effort required for follow-on attacks against the API. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog, placing it in the lower-priority tier despite its network-accessible nature. | MEDIUM | 4.3 | 0.2% | 22 |
No patch
|
| CVE-2026-21809 | HCL BigFix Quantum Risk Analyzer leaks internal system details through overly verbose error messages returned during input validation, enabling attackers with local high-privileged access to conduct more efficient reconnaissance against the platform. By submitting malformed inputs and observing descriptive error responses, an adversary can map internal validation logic and fine-tune automated fuzzing tools to generate valid payloads for follow-on exploitation. No public exploit code exists and no active exploitation is confirmed (not listed in CISA KEV); with CVSS 3.9 and a vector requiring local high-privilege access with high complexity, real-world risk is low and confined to already-privileged insiders or post-compromise actors. | LOW | 3.9 | 0.1% | 20 |
No patch
|
| CVE-2026-56547 | HCL Traveler's Apple profile generation page reflects user-submitted Logon Name and Mail Address values into generated Apple device synchronization profiles without verifying those values against the authenticated user's entry in the HCL Domino directory. An authenticated, low-privileged user can therefore embed arbitrary directory values into a generated Apple profile. Practical impact is severely constrained: the resulting profile is incomplete without additional credentials and, per vendor description, can only be used to configure the attacker's own Apple device - making this an authenticated, self-targeting input validation gap rather than a lateral-movement primitive. No public exploit code exists and the CVE is not listed in CISA KEV. | LOW | 3.5 | 0.2% | 18 |
|
| CVE-2026-21827 | HCL Connections exposes sensitive information to unauthorized users through improper handling of request data, classified under CWE-359 (Exposure of Private Personal Information to an Unauthorized Actor). The vulnerability affects all tracked versions per the wildcard CPE and is exploitable over the network, though high attack complexity (AC:H) and required user interaction (UI:R) substantially constrain real-world exploitability. No public exploit code or active exploitation has been identified at the time of analysis, and the CVSS score of 3.1 reflects the limited confidentiality impact and constrained attack prerequisites. | LOW | 3.1 | 0.2% | 16 |
No patch
|