HCLSoftware vulnerabilities | LiveThreat CVE Feed

CVE	Product	CVSS	EPSS	Published	Summary
CVE-2026-108015 New	NC Notes Client HCLSoftware	9.1	–	Oct 27	eMudhra Compromised Certificate vulnerability impacts HCL Notes Client
CVE-2026-108014 New	DS Domino Server HCLSoftware	9.1	–	Oct 27	eMudhra Compromised Certificate vulnerability impacts HCL Domino Server
CVE-2026-67165	CO Connections HCLSoftware	5.4	0%	Oct 13	HCL Connections is vulnerable to cross-site scripting (XSS)
CVE-2026-67075	DE Digital Experience HCLSoftware	6.5	0%	Oct 1	HCL Digital Experience is affected by improper input sanitation
CVE-2026-67071	HD HCL DevOps Deploy / HCL Launch HCLSoftware	6.5	0%	Sep 17	HCL DevOps Deploy / HCL Launch is susceptible to an Improper Removal of Sensitive Information Before Storage or Transfer
CVE-2026-21827	CO Connections HCLSoftware	3.1	0%	Aug 31	HCL Connections is vulnerable to an information disclosure vulnerability
CVE-2025-62341	CO Connections HCLSoftware	3.7	0%	Aug 26	HCL Connections is vulnerable to server-side request forgery (SSRF)
CVE-2026-21808	BQ BigFix Quantum Risk Analyzer HCLSoftware	4.1	0%	Aug 26	HCL BigFix Quantum Risk Analyzer is affected by logging sensitive information
CVE-2026-21807	BQ BigFix Quantum Risk Analyzer HCLSoftware	3.9	0%	Aug 26	HCL BigFix Quantum Risk Analyzer is affected by a stack-based buffer overflow
CVE-2026-21810	BQ BigFix Quantum Risk Analyzer HCLSoftware	4.4	0%	Aug 26	HCL BigFix Quantum Risk Analyzer is affected by a hardcoded external resource reference and downloading code without integrity checking
CVE-2026-21809	BQ BigFix Quantum Risk Analyzer HCLSoftware	3.9	0%	Aug 26	HCL BigFix Quantum Risk Analyzer is affected by generating error messages with sensitive information
CVE-2026-56547	TR Traveler HCLSoftware	3.5	0%	Aug 26	An input reflection vulnerability affects HCL Traveler
CVE-2025-68825	HH HCL Hive HCLSoftware	7.5	0%	Aug 24	HCL Hive is affected by incorrect default permissions
CVE-2026-21752	HH HCL Hive HCLSoftware	7.5	0%	Aug 24	HCL Hive is affected by a use of vulnerable third-party components
CVE-2026-21755	HH HCL Hive HCLSoftware	5.3	0%	Aug 24	HCL Hive is affected by a missing rate limit
CVE-2025-68833	HH HCL Hive HCLSoftware	5.3	0%	Aug 24	HCL Hive is affected by use of a cryptographic primitive with a risky implementation
CVE-2026-21751	HH HCL Hive HCLSoftware	7.4	0%	Aug 24	HCL Hive is affected by use of a cryptographic primitive with a risky implementation
CVE-2026-21756	HH HCL Hive HCLSoftware	7.2	0%	Aug 24	HCL Hive is affected by a broken access control vulnerability
CVE-2026-21759	HH HCL Hive HCLSoftware	4.3	0%	Aug 24	HCL Hive is affected by an information exposure vulnerability
CVE-2026-56619	HB HCL BigFix Mobile HCLSoftware	5.4	0%	Aug 10	HCL BigFix Mobile is vulnerable to Reflected Cross-Site Scripting (Reflected XSS)
CVE-2026-56620	HB HCL BigFix Mobile HCLSoftware	4.3	0%	Aug 10	HCL BigFix Mobile is vulnerable to information disclosure
CVE-2026-21766	HD HCL Digital Experience and Digital Experience Compose HCLSoftware	5.4	0%	Aug 5	HCL Digital Experience and Digital Experience Compose insufficiently protects credentials
CVE-2026-56538	CO Connections HCLSoftware	3.5	0%	Jul 27	HCL Connections is vulnerable to information disclosure
CVE-2026-56537	CO Connections HCLSoftware	3.5	0%	Jul 27	HCL Connections is vulnerable to information disclosure
CVE-2026-56583	MY MyCloud HCLSoftware	3.1	0%	Jul 21	HCL MyCloud was affected with Concurrent Login Vulnerability.
CVE-2026-56582	MY MyCloud HCLSoftware	3.1	0%	Jul 21	HCL MyCloud was affected with SSL/TLS Protocol Affected with LUCKY13 Vulnerability.
CVE-2026-56581	MY MyCloud HCLSoftware	2.6	0%	Jul 21	HCL MyCloud was affected with Cookie Attribute Path Not Set
CVE-2026-56580	MY MyCloud HCLSoftware	2.2	0%	Jul 21	HCL MyCloud was affected by Using Components with Known Vulnerability
CVE-2026-56579	MY MyCloud HCLSoftware	3.1	0%	Jul 21	HCL MyCloud was affected with Exposure of Sensitive Information to an Unauthorized Actor.
CVE-2026-56578	MY MyCloud HCLSoftware	2.2	0%	Jul 21	HCL MyCloud was affected by Server Version Disclosure
CVE-2026-56577	MY MyCloud HCLSoftware	6.5	0%	Jul 21	HCL MyCloud affected by Weak Password Policy
CVE-2026-56586	IE IntelliOps Event Management HCLSoftware	4.2	0%	Jul 21	HCL IEM was affected with X-Content-Type-Options Header Missing
CVE-2026-56585	IE IntelliOps Event Management HCLSoftware	4.3	0%	Jul 21	HCL IEM was affected with the Anti Clickjacking XFrame Options Header Missing
CVE-2026-56587	IE IntelliOps Event Management HCLSoftware	3.7	0%	Jul 21	HCL IEM was affected with Strict transport security not enforced
CVE-2026-56584	IE IntelliOps Event Management HCLSoftware	5.3	0%	Jul 21	HCL IEM was affected with the Information disclosure nginx server
CVE-2023-37507	DP DevOps Plan HCLSoftware	7.5	0%	Jul 21	An information disclosure vulnerability affects HCL DevOps Plan
CVE-2023-37508	DP DevOps Plan HCLSoftware	6.1	0%	Jul 21	HCL DevOps Plan is susceptible to a Cross-Site Scripting (XSS) vulnerability
CVE-2026-21824	CO Commerce HCLSoftware	8.8	0%	Jul 20	A privilege escalation vulnerability affects HCL Commerce
CVE-2025-59866	DF DFMPro for CATIA HCLSoftware	3.3	0%	Jul 17	The HCL DFMPro, DFXAnalytics and DFXServer installers are affected by ‘Insecure file permissions Leading to Privilege Escalation’ vulnerability, which enables any logged-in…
CVE-2026-21764	DL DevOps Loop HCLSoftware	4.3	0%	Jul 17	Insufficient Input Validation in DevOps Loop
CVE-2026-21762	DL DevOps Loop HCLSoftware	5.3	0%	Jul 17	Missing HTTP Security Headers in DevOps Loop
CVE-2026-21761	DL DevOps Loop HCLSoftware	5.4	0%	Jul 17	CORS Misconfiguration in DevOps Loop
CVE-2026-21760	DL DevOps Loop HCLSoftware	4.6	0%	Jul 17	Unauthorized Access to Admin Functionality via Forced Browsing
CVE-2024-23572	AE Aftermarket EPC HCLSoftware	4.2	0%	Jul 17	HCL Aftermarket EPC is vulnerable to attack as cookie appears to contain a session token, which may increase the risk associated with this issue
CVE-2024-23570	AE Aftermarket EPC HCLSoftware	4.3	0%	Jul 17	HCL Aftermarket EPC is affected by clickjacking vulnerability Cross-Frame Scripting is an attack technique where an attacker loads a vulnerable application in an iFrame on his…
CVE-2024-23578	AE Aftermarket EPC HCLSoftware	4.2	0%	Jul 17	HCL Aftermarket EPC is vulnerable to attack as the application implements an HTML5 cross-origin resource sharing (CORS) policy for this request that allows access from any domain…
CVE-2024-23569	AE Aftermarket EPC HCLSoftware	4.3	0%	Jul 17	HCL Aftermarket EPC is vulnerable to attack since the server is not configured with “X-XSS-Protection" header
CVE-2024-23577	AE Aftermarket EPC HCLSoftware	4.3	0%	Jul 17	HCL Aftermarket EPC is vulnerable since the application does not have a validation for HOST header and accepts arbitrary hosts when requested in http protocol
CVE-2024-23574	AE Aftermarket EPC HCLSoftware	5.3	0%	Jul 17	HCL Aftermarket EPC is vulnerable to attack since It was found that a malicious actor can use brute-force techniques to either guess or confirm valid users in the system
CVE-2024-42214	AE Aftermarket EPC HCLSoftware	5.3	0%	Jul 17	HCL Aftermarket EPC is vulnerable to attack since HTTP OPTIONS method is enabled on this web server
CVE-2024-23575	AE Aftermarket EPC HCLSoftware	5.3	0%	Jul 17	HCL Aftermarket EPC is vulnerable to attack since the application returns detailed error messages that leak information about the processing on the server
CVE-2024-23571	AE Aftermarket EPC HCLSoftware	4.3	0%	Jul 17	HCL Aftermarket EPC is vulnerable to attack since the application does not have an appropriate caching policy specifying the extent to which the page and its form fields should be…
CVE-2024-23573	AE Aftermarket EPC HCLSoftware	3.7	0%	Jul 17	HCL Aftermarket EPC is vulnerable to attack since the Application is vulnerable to Lucky 13
CVE-2024-23568	AE Aftermarket EPC HCLSoftware	5.3	0%	Jul 17	HCL Aftermarket EPC is vulnerable to attacks since the server software version used by the application is revealed by the web server
CVE-2024-23565	AE Aftermarket EPC HCLSoftware	5.3	0%	Jul 17	HCL Aftermarket EPC is vulnerable to email flooding as the application does not have a proper mail limitation mechanism at Forget Password functionality
CVE-2024-23566	AE Aftermarket EPC HCLSoftware	6.5	0%	Jul 17	HCL Aftermarket EPC is vulnerable to brute force attacks since application doesn’t have captcha implemented
CVE-2024-23567	AE Aftermarket EPC HCLSoftware	4.3	0%	Jul 17	HCL Aftermarket EPC is affected by Sensitive Information in GET method & in URL which allows application to pass sensitive data via URL parameters during normal usage
CVE-2026-21770	HT HCL Traveler for Microsoft Outlook (HTMO) HCLSoftware	6.5	0%	Jul 17	HCL Traveler for Microsoft Outlook (HTMO) is susceptible to DLL hijacking
CVE-2026-35146	DF DFXServer HCLSoftware	6.3	0%	Jul 16	HCL DFXServer is affected by an Unencrypted Communication vulnerability.
CVE-2026-21840	HB HCL BigFix Platform HCLSoftware	3.1	0%	Jul 14	HCL BigFix Platform is affected by a user enumeration vulnerability