Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-56568 | 5.3 medium | 0.00% | hcltech, icontrol | HCL iControl was affected by Information Exposure Through Verbose Client-Side API Error Messages vulnerabilities. It involves application displays raw server/API error messages to users instead of generic error messages and exposes internal endpoint names, request parameters, error codes, and authentication status | Fri 23 Oct |
| CVE-2026-56570 | 5.3 medium | 0.00% | hcltech, icontrol | HCL iControl was affected by Auto complete Enabled vulnerabilities. It involves expose sensitive information such as: Valid usernames, Email addresses used for login, Account identifiers If the system is accessed from shared environments, attackers may enumerate valid usernames through browser suggestions. | Fri 23 Oct |
| CVE-2026-56571 | 5.3 medium | 0.00% | hcltech, icontrol | HCL iControl was affected by Improper Error Handling vulnerabilities. It involves Out of memory, null pointer exceptions, system call failure, database unavailable, network timeout, and hundreds of other common conditions can cause errors to be generated. | Fri 23 Oct |
| CVE-2026-56608 | 5.3 medium | 0.00% | hcltech, icontrol | HCL iControl is affected by Missing Access Control vulnerability. The application failed to enforce proper granular access controls, allowing users to access or view administrator-level functionalities without appropriate authorization. | Fri 23 Oct |
| CVE-2026-56597 | 5.3 medium | 0.00% | hcltech, bigfix_service_management | HCL BigFix Service Management is affected by a Sensitive Information Leakage vulnerability, which could allow an unauthenticated attacker to extract internal IP addresses from the application's responses, enabling them to map the underlying network topology and identify potential internal targets. | 14 Oct |
| CVE-2025-52615 | 5.3 medium | 0.00% | hcltech, unica | HCL Unica Platform is impacted by misconfigured security related HTTP headers. This can lead to less secure browser default treatment for the policies controlled by these headers. | 8 Oct |
| CVE-2026-21848 | 5.0 medium | 0.00% | hcltech, bigfix_service_management | HCL BigFix Service Management is affected by a Security Misconfiguration vulnerability, which could allow an authenticated attacker to exploit improper access controls, enabling the unauthorized viewing of restricted data elements across tenant boundaries. | 14 Oct |
| CVE-2025-52658 | 4.8 medium | 0.00% | hcltech, dryice_myxalytics | HCL MyXalytics is affected by the use of vulnerable/outdated versions which can expose the application to known security risks that could be exploited. | 8 Oct |
| CVE-2026-21760 | 4.6 medium | 0.00% | hcltech, devops_loop | HCL DevOps Loop is affected by an Unauthorized Access to Admin Functionality (Forced Browsing) vulnerability. Improper authorization checks may allow unauthorized users to access restricted administrative functionality by directly accessing protected application endpoints. | Sat 24 Oct |
| CVE-2025-52654 | 4.6 medium | 0.00% | hcltech, dryice_myxalytics | HCL MyXalytics v6.6 is affected by an HTML Injection. This issue occurs when untrusted input is included in the output without proper handling, potentially allowing unauthorized content injection and manipulation. | 8 Oct |
| CVE-2026-21764 | 4.3 medium | 0.00% | hcltech, devops_loop | HCL DevOps Loop is affected by insufficient input validation that allows special characters where they should be restricted. This may result in unintended application behavior under certain conditions. | Sat 24 Oct |
| CVE-2026-56585 | 4.3 medium | 0.00% | hcltech, intelliops_event_management | HCL IEM was affected with the Anti Clickjacking XFrame Options Header Missing. It may allow attackers to embed the application in malicious pages and induce unauthorized user actions. | Sat 24 Oct |
| CVE-2025-31954 | 4.3 medium | 0.00% | hcltech, dryice_iautomate | HCL iAutomate v6.5.1 and v6.5.2 is susceptible to a sensitive information disclosure. An HTTP GET method is used to process a request and includes sensitive information in the query string of that request. An attacker could potentially access information or resources they were not intended to see. | 18 Oct |
| CVE-2026-56595 | 4.3 medium | 0.00% | hcltech, bigfix_service_management | HCL BigFix Service Management is affected by a CORS Misconfiguration vulnerability due to improperly validated origin headers, which could allow an attacker to craft a malicious web page that interacts with the vulnerable application, enabling unauthorized access to protected resources and restricted APIs on behalf of a victim. | 14 Oct |
| CVE-2025-31980 | 4.3 medium | 0.00% | hcltech, bigfix_service_management | HCL BigFix Service Management is affected by an Improper Input Validation vulnerability, which could allow an attacker to inject unvalidated, malformed data into the application, enabling potential injection attacks or errors in downstream processing systems. | 14 Oct |
| CVE-2025-52614 | 4.3 medium | 0.00% | hcltech, unica | HCL Unica Platform is affected by a Cookie without HTTPOnly Flag Set vulnerability. A malicious agent may be able to induce this event by feeding a user suitable links, either directly or via another web site. | 8 Oct |
| CVE-2025-0274 | 4.3 medium | 0.00% | hcltech, bigfix_mobile, bigfix_modern_client_management | HCL BigFix Modern Client Management (MCM) 3.3 and earlier is affected by improper access control. Unauthorized users can access a small subset of endpoint actions, potentially allowing access to select internal functions. | 8 Oct |
| CVE-2025-0275 | 4.3 medium | 0.00% | hcltech, bigfix_mobile, bigfix_modern_client_management | HCL BigFix Mobile 3.3 and earlier is affected by improper access control. Unauthorized users can access a small subset of endpoint actions, potentially allowing access to select internal functions. | 8 Oct |
| CVE-2026-56586 | 4.2 medium | 0.00% | hcltech, intelliops_event_management | HCL IEM was affected with X-Content-Type-Options Header Missing. It may enable attackers to perform SSL stripping or man-in-the-middle attacks and intercept sensitive data. | Sat 24 Oct |
| CVE-2026-56587 | 3.7 low | 0.00% | hcltech, intelliops_event_management | HCL IEM was affected with Strict transport security not enforced. It may enable attackers to perform SSL stripping or man-in-the-middle attacks and compromise secure communications. | Sat 24 Oct |
| CVE-2026-56537 | 3.5 low | 0.00% | hcltech, connections | HCL Connections is vulnerable to information disclosure which could allow a user to obtain sensitive information they are not entitled to, caused by improper handling of request data.they are not entitled to, caused by improper handling of request data. | Sat 24 Oct |
| CVE-2026-56538 | 3.5 low | 0.00% | hcltech, connections | An endpoint in HCL Connections is vulnerable to information disclosure. In certain scenarios this might lead to disclosing sensitive information to unauthorized users. | Sat 24 Oct |
| CVE-2026-21767 | 3.3 low | 0.00% | hcltech, bigfix_platform | HCL BigFix Platform is affected by insufficient authentication. The application might allow users to access sensitive areas of the application without proper authentication. | Mon 26 Oct |
| CVE-2026-56567 | 3.3 low | 0.00% | hcltech, icontrol | HCL iControl v4.3.0 was affected by Security Misconfiguration vulnerabilities. It involves the public exposure of internal configuration files due to improper web server or application hardening. | Fri 23 Oct |
| CVE-2026-56569 | 3.3 low | 0.00% | hcltech, icontrol | HCL iControl was affected by Sensitive Data Exposure vulnerabilities. It involves the public exposure of internal configuration files due to improper web server or application hardening. | Fri 23 Oct |
| CVE-2026-35145 | 3.1 low | 0.00% | hcltech, dfxanalytics | HCL DFXAnalytics is affected by a Missing HTTP Strict-Transport-Security Header vulnerability. The application fails to implement the HTTP Strict Transport Security (HSTS) policy within its responses, which could allow a remote attacker to downgrade the communication channel to an unencrypted connection (HTTP) and conduct man-in-the-middle (MitM) attacks. To remediate this, the application must include the "Strict-Transport-Security" header in all web application responses. | Sat 24 Oct |
| CVE-2026-56579 | 3.1 low | 0.00% | hcltech, dryice_mycloud | HCL MyCloud was affected with License Key Revealed in HTTP Response. It may enable attackers to misuse the exposed information and compromise the application's security. | Sat 24 Oct |
| CVE-2026-56582 | 3.1 low | 0.00% | hcltech, dryice_mycloud | HCL MyCloud was affected by the SSL/TLS LUCKY13 Vulnerability. An attacker may exploit this vulnerability to decrypt sensitive information through a TLS/SSL padding oracle attack. | Sat 24 Oct |
| CVE-2026-56583 | 3.1 low | 0.00% | hcltech, dryice_mycloud | HCL MyCloud was affected with Concurrent Login Vulnerability. It may increase the risk of unauthorized access, session hijacking, and account misuse. | Sat 24 Oct |
| CVE-2026-56581 | 2.6 low | 0.00% | hcltech, dryice_mycloud | HCL MyCloud was affected with Cookie Attribute Path Not Set. It may increase the risk of unauthorized access to session data or authentication tokens. | Sat 24 Oct |
| CVE-2026-56578 | 2.2 low | 0.00% | hcltech, dryice_mycloud | HCL MyCloud was affected by Server Version Disclosure. It may help attackers identify and exploit known vulnerabilities affecting the disclosed software versions. | Sat 24 Oct |
| CVE-2026-56580 | 2.2 low | 0.00% | hcltech, dryice_mycloud | HCL MyCloud was affected by Using Components with Known Vulnerability ( IIS Server ). It may allow attackers to exploit publicly disclosed weaknesses and compromise the system. | Sat 24 Oct |
82 of 82 · Previous
Download these 82 as CSV · subscribe to this list.
EPSS scores: 2026-10-28. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.