Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-56453 | 9.8 critical | 0.00% | hcltech, dfxanalytics | HCL DFXAnalytics is affected by an Account Takeover via Response Manipulation vulnerability. A remote attacker can intercept and alter the contents of the server's HTTP responses before they reach the client application, allowing them to manipulate the authentication or authorization logic to bypass controls and gain unauthorized access to targeted user accounts. | Sat 24 Oct |
| CVE-2026-56590 | 9.8 critical | 0.00% | hcltech, bigfix_service_management | HCL BigFix Service Management is affected by an Unrestricted File Upload vulnerability due to improper file validation controls, which could allow an unauthenticated attacker to upload and execute malicious payloads, resulting in a complete server compromise. | 14 Oct |
| CVE-2026-56592 | 9.8 critical | 0.00% | hcltech, bigfix_service_management | HCL BigFix Service Management is affected by an Improper Authentication validation vulnerability related to inadequate account lockouts, which could allow an unauthenticated attacker to execute sustained brute-force attacks against the login interface, resulting in unauthorized system access. | 14 Oct |
| CVE-2026-21806 | 9.8 critical | 0.00% | hcltech, bigfix_service_management | HCL BigFix Service Management is affected by an Administrative Session Concurrency vulnerability. The application allows multiple simultaneous authenticated sessions for the same administrative account, which could enable an unauthorized attacker to predict or hijack valid session identifiers. Successful exploitation allows an attacker to compromise affected administrative sessions and execute actions with full privileged user permissions. | 14 Oct |
| CVE-2026-67100 | 9.8 critical | 0.00% | hcltech, bigfix_service_management | HCL BigFix Service Management is affected by SQL Injection flaw and a Cross-Tenant Data Exposure flaw vulnerabilities. which could allow an authenticated attacker to inject database commands to extract sensitive system details, as well as manipulate request values to gain unauthorized access to full personal profile data and PII across different organizations. | 8 Oct |
| CVE-2025-52635 | 9.8 critical | 0.00% | hcltech, aion | A rusted types in scripts not enforced in CSP vulnerability has been identified in HCL AION.This issue affects AION: 2.0. | 8 Oct |
| CVE-2025-31993 | 9.8 critical | 0.00% | hcltech, unica_centralized_offer_management | HCL Unica Centralized Offer Management is vulnerable to a potential Server-Side Request Forgery (SSRF). An attacker can exploit improper input validation by submitting maliciously crafted input to a target application running on a server. | 8 Oct |
| CVE-2025-31998 | 9.8 critical | 0.00% | hcltech, unica_centralized_offer_management | HCL Unica Centralized Offer Management is vulnerable to poor unhandled exceptions which exposes sensitive information. An attacker can exploit use this information to exploit known vulnerabilities launch targeted attacks, such as remote code execution or denial of service. | 8 Oct |
| CVE-2026-35147 | 8.2 high | 0.00% | hcltech, dfx_server | HCL DFXServer is affected by a Broken Authentication vulnerability via direct API access. The application fails to verify the user's authentication status when accessing specific API endpoints, allowing an unauthenticated attacker to interact with the APIs and perform unauthorized actions without valid credentials. | Sat 24 Oct |
| CVE-2026-35149 | 8.2 high | 0.00% | hcltech, dfx_server | HCL DFXServer is affected by an Authentication Bypass vulnerability via server response manipulation. An unauthorized user without valid credentials can exploit this flaw by intercepting and altering the server's authentication responses, allowing them to gain unauthorized access to the application without verification. | Sat 24 Oct |
| CVE-2026-35142 | 8.2 high | 0.00% | hcltech, dfxanalytics | HCL DFXAnalytics is affected by an Internal IP Address Disclosure vulnerability. The application includes internal IP address details within its generated server responses, which could allow a remote attacker to gather sensitive network topology information and use it to map the internal infrastructure for further targeted attacks. | Sat 24 Oct |
| CVE-2026-67102 | 8.1 high | 0.00% | hcltech, bigfix_service_management | HCL BigFix Service Management is affected by a high-severity Broken Access Control vulnerability, which could allow a low-privileged user to gain unauthorized access to administrative screens and functions reserved for higher-privileged roles. | 8 Oct |
| CVE-2023-37524 | 7.8 high | 0.00% | hcltech, traveler_for_microsoft_outlook | HCL Traveler for Microsoft Outlook (HTMO) is susceptible to vulnerabilities due to .NET Framework 4.5 being out of service. Since .NET Framework 4.5 has reached end-of-life and no longer receives security updates, it may expose the application to publicly known security weaknesses through vulnerable third-party components. | 20 h ago |
| CVE-2026-21765 | 7.8 high | 0.00% | hcltech, bigfix_platform | HCL BigFix Platform is affected by insecure permissions on private cryptographic keys. The private cryptographic keys located on a Windows host machine might be subject to overly permissive file system permissions. | Mon 26 Oct |
| CVE-2025-52656 | 7.6 high | 0.00% | hcltech, dryice_myxalytics | HCL MyXalytics: 6.6. is affected by Mass Assignment vulnerability. Mass Assignment occurs when user input is automatically bound to application objects without proper validation or access controls, potentially allowing unauthorized modification of sensitive fields. | 8 Oct |
| CVE-2025-51735 | 7.5 high | 0.00% | hcltech, unica | CSV formula injection vulnerability in HCL Technologies Ltd. Unica 12.0.0. | Mon 26 Oct |
| CVE-2026-56454 | 7.5 high | 0.00% | hcltech, dfxanalytics | HCL DFXAnalytics is affected by a Deprecated Protocol vulnerability due to the use of TLS 1.0 and TLS 1.1. These legacy protocols contain numerous cryptographic design flaws that expose data to interception and decryption. To remediate this risk, the application must disable all support for TLS 1.0 and TLS 1.1, and exclusively enable support for secure protocols, specifically TLS 1.2 and TLS 1.3. | Sat 24 Oct |
| CVE-2026-56455 | 7.5 high | 0.00% | hcltech, dfxanalytics | HCL DFXAnalytics is affected by a Buffer Overflow vulnerability that can lead to a Denial of Service (DoS). The application fails to properly validate input sizes, allowing an attacker to pass an excessive amount of information into a memory container, which can cause the system to crash or become unresponsive. To mitigate this flaw, comprehensive input length checks must be implemented and enforced on both the client and server sides. | Sat 24 Oct |
| CVE-2025-52630 | 7.5 high | 0.00% | hcltech, aion | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in HCL AION.This issue affects AION: 2.0. | 8 Oct |
| CVE-2025-52632 | 7.5 high | 0.00% | hcltech, aion | A Missing Secure Attribute in Encrypted Session (SSL) Cookie vulnerability in HCL AION.This issue affects AION: 2.0. | 8 Oct |
| CVE-2025-52634 | 7.5 high | 0.00% | hcltech, aion | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in HCL AION This issue affects HCL AION: 2.0. | 8 Oct |
| CVE-2025-52625 | 7.5 high | 0.00% | hcltech, aion | A vulnerability Cacheable SSL Page Found vulnerability has been identified in HCL AION. Cached data may expose credentials, system identifiers, or internal file paths to attackers with access to the device or browser This issue affects AION: 2.0. | 8 Oct |
| CVE-2025-31997 | 7.5 high | 0.00% | hcltech, unica_centralized_offer_management | HCL Unica Centralized Offer Management is vulnerable to Insecure Direct Object References (IDOR). An attacker can bypass authorization and access resources in the system directly, for example database records or files. | 8 Oct |
| CVE-2025-52616 | 7.5 high | 0.00% | hcltech, unica | HCL Unica 12.1.10 can expose sensitive system information. An attacker could use this information to form an attack plan by leveraging known vulnerabilities in the application. | 8 Oct |
| CVE-2025-31996 | 7.5 high | 0.00% | hcltech, unica | HCL Unica Platform is affected by unprotected files due to improper access controls. These files may contain sensitive information such as private or system information that can be exploited by attackers to compromise the application, infrastructure, or users. | 8 Oct |
| CVE-2026-35140 | 7.2 high | 0.00% | hcltech, dfxanalytics | HCL DFXAnalytics is affected by a Missing Secure Attribute in Encrypted Session (SSL) Cookie vulnerability. The application fails to set the "secure" attribute on session cookies generated during authentication, which could allow a remote attacker to intercept network traffic and capture sensitive cookies, session tokens, or credentials sent in cleartext over unencrypted channels. | Sat 24 Oct |
| CVE-2026-35143 | 6.5 medium | 0.00% | hcltech, dfxanalytics | HCL DFXAnalytics is affected by a Missing SameSite Attribute vulnerability. The application fails to set the "SameSite" attribute on session cookies generated during authentication, which could allow a remote attacker to execute Cross-Site Request Forgery (CSRF) attacks if additional mitigations, such as Anti-CSRF tokens, are not implemented. | Sat 24 Oct |
| CVE-2026-56577 | 6.5 medium | 0.00% | hcltech, dryice_mycloud | HCL MyCloud was affected with Weak Password Policy. It may increase the risk of account compromise through brute-force or credential-based attacks. | Sat 24 Oct |
| CVE-2026-56609 | 6.5 medium | 0.00% | hcltech, icontrol | HCL iControl is affected by Weak SSL/TLS Version Supported vulnerability. It was observed that the application was using weak TLS versions such as TLS 1.0 and 1.1. These outdated protocols lack modern security features, making them vulnerable to known attacks and exposing sensitive information during data transmission. | Fri 23 Oct |
| CVE-2025-52639 | 6.5 medium | 0.00% | hcltech, connections | HCL Connections is vulnerable to a sensitive information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitled to, caused by improper rendering of application data. | 18 Oct |
| CVE-2022-27544 | 6.5 medium | 0.00% | hcltech, bigfix_platform | BigFix Web Reports authorized users may see SMTP credentials in clear text. | 8 Oct |
| CVE-2026-35146 | 6.3 medium | 0.00% | hcltech, dfx_server | HCL DFXServer is affected by an Unencrypted Communication vulnerability. The application permits users to establish connections over unencrypted channels via the HTTP protocol, which could allow a remote attacker to intercept network traffic and expose sensitive data transmitted between the user and the application. | Sat 24 Oct |
| CVE-2026-35148 | 6.3 medium | 0.00% | hcltech, dfx_server | HCL DFXServer is affected by a Missing Access Control vulnerability. This vulnerability states that certain endpoints are accessible without any form of authentication in another browser. This allows any network user to invoke these APIs and interact with the application without verification of their identity or authorization level. | Sat 24 Oct |
| CVE-2026-4096 | 6.1 medium | 0.00% | hcltech, devops_plan | IBM DevOps Plan 3.0.0 through 3.0.6 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking | Mon 26 Oct |
| CVE-2026-67103 | 6.1 medium | 0.00% | hcltech, bigfix_service_management | HCL BigFix Service Management is affected by Cross-Site Scripting (XSS) vulnerability, which could allow an attacker to inject unsanitized malicious scripts that execute in a victim's browser, enabling session hijacking, account takeover, and unauthorized actions on behalf of affected users. | 8 Oct |
| CVE-2025-52650 | 6.1 medium | 0.00% | hcltech, aion | Inline script execution allowed in CSP vulnerability has been identified in HCL AION v2.0 | 8 Oct |
| CVE-2025-52624 | 6.1 medium | 0.00% | hcltech, aion | A vulnerability Bypass of the script allowlist configuration in HCL AION. An incorrectly configured Content-Security-Policy header may allow unauthorized scripts to execute, increasing the risk of cross-site scripting and other injection-based attacks.This issue affects AION: 2.0. | 8 Oct |
| CVE-2025-31969 | 6.1 medium | 0.00% | hcltech, unica | HCL Unica Platform is impacted by misconfigured Content Security Policy (CSP). These can result in malicious resources getting loaded and browsers may come across certain types of attacks, such as cross-site scripting and clickjacking. | 8 Oct |
| CVE-2025-0276 | 6.1 medium | 0.00% | hcltech, bigfix_mobile, bigfix_modern_client_management | HCL BigFix Modern Client Management (MCM) 3.3 and earlier are vulnerable to certain insecure directives within the Content Security Policy (CSP). An attacker could trick users into performing actions by not properly restricting the sources of scripts and other content. | 8 Oct |
| CVE-2025-0277 | 6.1 medium | 0.00% | hcltech, bigfix_mobile, bigfix_modern_client_management | HCL BigFix Mobile 3.3 and earlier are vulnerable to certain insecure directives within the Content Security Policy (CSP). An attacker could trick users into performing actions by not properly restricting the sources of scripts and other content. | 8 Oct |
| CVE-2026-67101 | 5.8 medium | 0.00% | hcltech, bigfix_service_management | HCL BigFix Service Management is affected by a Server-Side Request Forgery (SSRF) vulnerability in its search functionality, which could allow an attacker to force the application server to send requests to internal systems that are not accessible from the internet. | 8 Oct |
| CVE-2025-63402 | 5.5 medium | 0.00% | hcltech, dragon | An issue in HCL Technologies Limited HCLTech GRAGON before v.7.6.0 allows a remote attacker to execute arbitrary code via APIs do not enforcing limits on the number or size of requests | Tue 27 Oct |
| CVE-2025-51734 | 5.4 medium | 0.00% | hcltech, unica | Cross-site scripting (XSS) vulnerability in HCL Technologies Ltd. Unica 12.0.0. | Mon 26 Oct |
| CVE-2026-21761 | 5.4 medium | 0.00% | hcltech, devops_loop | HCL DevOps Loop is affected by a Cross-Origin Resource Sharing (CORS) misconfiguration. Improper CORS configuration may allow unauthorized cross-origin requests, potentially exposing application resources to untrusted domains. | Sat 24 Oct |
| CVE-2022-27545 | 5.4 medium | 0.00% | hcltech, bigfix_platform | BigFix Web Reports authorized users may perform HTML injection for the email administrative configuration page. | 8 Oct |
| CVE-2025-52653 | 5.4 medium | 0.00% | hcltech, dryice_myxalytics | HCL MyXalytics product is affected by Cross Site Scripting vulnerability in the web application. This can allow the execution of unauthorized scripts, potentially resulting in unauthorized actions or access. | 8 Oct |
| CVE-2026-35141 | 5.3 medium | 0.00% | hcltech, dfxanalytics | HCL DFXAnalytics is affected by a Login Replay Attack vulnerability. The application allows a remote attacker to intercept, delay, or fraudulently retransmit valid authentication data to achieve unauthorized access. To mitigate this risk, the application must implement a mechanism to include timestamps with every message, ensuring that messages exceeding a specific age threshold are automatically rejected by the recipient system. | Sat 24 Oct |
| CVE-2026-56456 | 5.3 medium | 0.00% | hcltech, dfxanalytics | HCL DFXAnalytics is affected by an Internal File Path Disclosure vulnerability. The application dashboard inadvertently leaks sensitive information regarding its internal file structure and directory paths through unhandled error messages, system logs, or debugging output, which could allow a remote attacker to map the underlying server environment and identify targets for further exploitation. | Sat 24 Oct |
| CVE-2026-21762 | 5.3 medium | 0.00% | hcltech, devops_loop | HCL DevOps Loop is affected by missing HTTP security headers. Missing security headers may reduce browser protections against common web-based attacks such as clickjacking, MIME-type sniffing, and cross-site scripting. | Sat 24 Oct |
| CVE-2026-56584 | 5.3 medium | 0.00% | hcltech, intelliops_event_management | HCL IEM was affected with the Information disclosure nginx server. It may enable attackers to identify outdated software versions and target known vulnerabilities or publicly available exploits. | Sat 24 Oct |
50 of 82 · Next
Download these 82 as CSV · subscribe to this list.
EPSS scores: 2026-10-28. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.