HCL Software vulnerabilities

CVE-2025-31957 Medium · 5.7 CWE-352 May 6, 2026

HCL BigFix Service Management (SM) is affected by a Cross‑Site Request Forgery (CSRF) vulnerability.

HHCL BigFix Service Management (SM) is affected by a Cross‑Site Request Forgery (CSRF) vulnerability. This could lead to unauthorized changes or exposure of sensitive data.

CVE-2025-31981 Medium · 5.3 CWE-319 Apr 21, 2026

HCL BigFix Service Management (SM) Discovery is vulnerable to unenforced encryption

HCL BigFix Service Management (SM) Discovery is vulnerable to unenforced encryption due to port 80 (HTTP) being open, allowing unencrypted access. An attacker with access to the network traffic can sniff packets from the connection and uncover the data.

CVE-2025-31958 High · 8.2 CWE-444 Apr 21, 2026

HCL BigFix Service Management (SM) is susceptible to HTTP Request Smuggling

HCL BigFix Service Management is susceptible to HTTP Request Smuggling. HTTP request smuggling vulnerabilities arise when websites route HTTP requests through web servers with inconsistent HTTP parsing. HTTP Smuggling exploits inconsistencies in request parsing between front-end and back-end servers, allowing attackers to bypass security controls and perform attacks like cache poisoning or request hijacking.

CVE-2025-31991 Critical · 9.8 CWE-307 Apr 13, 2026

HCL DevOps Velocity is susceptible to brute-force attacks

Rate Limiting for attempting a user login is not being properly enforced, making HCL DevOps Velocity susceptible to brute-force attacks past the unsuccessful login attempt limit. This vulnerability is fixed in 5.1.7.

CVE-2026-21767 Low · 3.3 CWE-306 Apr 1, 2026

HCL BigFix Platform is affected by insufficient authentication

HCL BigFix Platform is affected by insufficient authentication. The application might allow users to access sensitive areas of the application without proper authentication.

CVE-2026-21765 High · 7.8 CWE-276 Apr 1, 2026

HCL BigFix Platform is affected by insecure permissions on private cryptographic keys

HCL BigFix Platform is affected by insecure permissions on private cryptographic keys. The private cryptographic keys located on a Windows host machine might be subject to overly permissive file system permissions.

CVE-2026-21790 Medium · 6.3 CWE-346 Mar 24, 2026

HCL Traveler is susceptible to a weak default HTTP header validation vulnerability

HCL Traveler is susceptible to a weak default HTTP header validation vulnerability, which could allow an attacker to bypass additional authentication checks.

CVE-2026-21783 Medium · 4.3 CWE-209 Mar 24, 2026

HCL Traveler is affected by sensitive information disclosure

HCL Traveler is affected by sensitive information disclosure. The application generates some error messages that provide detailed information about errors and failures, such as internal paths, file names, sensitive tokens, credentials, error codes, or stack traces. Attackers could exploit this information to gain insights into the system's architecture and potentially launch targeted attacks.

CVE-2026-21788 Medium · 5.4 CWE-79 Mar 19, 2026

HCL Connections is vulnerable to cross-site scripting (XSS)

HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user which leads to executing malicious script code. This may allow the attacker steal cookie-based authentication credentials and comprise user's account then launch other attacks.

CVE-2024-42210 Medium · 5.4 CWE-79 Mar 19, 2026

HCL Unica Marketing Operations v12.1.8 and lower is affected by a Stored cross-site scripting (XSS) vulnerability

A Stored cross-site scripting (XSS) vulnerability affects HCL Unica Marketing Operations v12.1.8 and lower. Stored cross-site scripting (also known as second-order or persistent XSS) arises when an application receives data from an untrusted source and includes that data within its later HTTP responses in an unsafe way.

CVE-2025-62328 Low · 3.7 CWE-1021 Mar 11, 2026

HCL Nomad server on Domino is affected by a missing default frame-ancestors directive

HCL Nomad server on Domino did not configure the frame-ancestors directive in the Content-Security-Policy header by default which could allow an attacker to obtain sensitive information via unspecified vectors.

CVE-2026-21786 Low · 3.3 CWE-532 Mar 5, 2026

HCL Sametime for iOS is affected by sensitive information disclosure

HCL Sametime for iOS is impacted by a sensitive information disclosure. Hostnames information is written in application logs and certain URLs.

CVE-2025-59873 Medium · 5.9 CWE-598 Feb 23, 2026

Session Token Exposure via URL Query Parameters

An information exposure vulnerability exists in Vulnerability in HCL Software ZIE for Web. The application transmits sensitive session tokens and authentication identifiers within the URL query parameters . An attacker who gains access to any network log or operates a site linked from the application can hijack user sessions This issue affects ZIE for Web: v16.

CVE-2025-62326 Medium · 4.8 CWE-79 Feb 20, 2026

HCL Digital Experience is susceptible to stored cross-site scripting (XSS)

HCL Digital Experience is susceptible to stored cross-site scripting (XSS) in the administrative user interface which would require elevated privileges to exploit.

CVE-2025-52603 Low · 3.5 CWE-213 Feb 20, 2026

HCL Connections is vulnerable to information disclosure

HCL Connections is vulnerable to information disclosure. In a very specific user navigation scenario, this could allow a user to obtain limited information when a single piece of internal metadata is returned in the browser.

CVE-2025-31990 Medium · 6.8 CWE-770 Feb 7, 2026

HCL DevOps Velocity is susceptible to a Denial of Service vulnerability

Rate limiting for certain API calls is not being enforced, making HCL Velocity vulnerable to Denial of Service (DoS) attacks. An attacker could flood the system with a large number of requests, overwhelming its resources and causing it to become unresponsive to legitimate users. This vulnerability is fixed in 5.1.7.

CVE-2023-37525 Medium · 5.3 CWE-497 Jan 28, 2026

HCL BigFix Compliance is vulnerable to a sensitive information disclosure

A sensitive information disclosure in HCL BigFix Compliance allows a remote attacker to access files under the WEB-INF directory, which may contain Java class files and configuration information, leading to unauthorized access to application internals.

CVE-2025-55252 Critical · 9.8 CWE-521 Jan 19, 2026

HCL AION is affected by a Weak Password Policy vulnerability

HCL AION version 2 is affected by a Weak Password Policy vulnerability. This can allow the use of easily guessable passwords, potentially resulting in unauthorized access

CVE-2025-55250 Medium · 5.3 CWE-209 Jan 19, 2026

HCL AION is affected by a Technical Error Disclosure vulnerability

HCL AION version 2 is affected by a Technical Error Disclosure vulnerability. This can expose sensitive technical details, potentially resulting in information disclosure or aiding further attacks.

CVE-2025-55251 Critical · 9.8 CWE-434 Jan 19, 2026

HCL AION is affected by an Unrestricted File Upload vulnerability

HCL AION is affected by an Unrestricted File Upload vulnerability. This can allow malicious file uploads, potentially resulting in unauthorized code execution or system compromise.

CVE-2025-55249 Medium · 5.3 CWE-693 Jan 19, 2026

HCL AION is affected by a Missing Security Response Headers vulnerability.

HCL AION is affected by a Missing Security Response Headers vulnerability. The absence of standard security headers may weaken the application’s overall security posture and increase its susceptibility to common web-based attacks.

CVE-2025-52661 Medium · 5.3 CWE-613 Jan 19, 2026

HCL AION version 2 is affected by a JWT Token Expiry Too Long vulnerability. This may…

HCL AION version 2 is affected by a JWT Token Expiry Too Long vulnerability. This may increase the risk of token misuse, potentially resulting in unauthorized access if the token is compromised.

CVE-2025-52660 Critical · 9.8 CWE-644 Jan 19, 2026

HCL AION is affected by an Host Header Injection vulnerability

HCL AION is affected by an Unrestricted File Upload vulnerability. This can allow malicious file uploads, potentially resulting in unauthorized code execution or system compromise.

CVE-2025-52659 High · 7.5 CWE-525 Jan 19, 2026

HCL AION is affected by a Cacheable HTTP Response vulnerability

HCL AION version 2 is affected by a Cacheable HTTP Response vulnerability. This may lead to unintended storage of sensitive or dynamic content, potentially resulting in unauthorized access or information disclosure.

CVE-2025-59870 Critical · 9.8 CWE-323 Jan 16, 2026

Improper management of a static JWT signing secret in the web application, where the secret lacks rotation , introducing a security risk

HCL MyXalytics is affected by improper management of a static JWT signing secret in the web application, where the secret lacks rotation , introducing a security risk