CVE-2026-21808 is a medium severity vulnerability in HCL BigFix Quantum Risk Analyzer version 2.0.1.47. The product generates highly detailed logs by default, which can inadvertently include sensitive information. This logging behavior increases the risk of sensitive data leakage and may expose internal application logic and architectural details to an attacker. There is no official patch or remediation guidance available at this time.
CVE-2026-21807 is a stack-based buffer overflow vulnerability in HCLSoftware BigFix Quantum Risk Analyzer version 2.0.1.47. The binary lacks several critical hardening protections, which could allow an attacker with high privileges to exploit the flaw. The vulnerability has a low CVSS score of 3.9, indicating limited impact and exploitability. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild for this vulnerability.
CVE-2026-21810 affects HCL BigFix Quantum Risk Analyzer version 2.0.1.47 and involves a hardcoded external resource reference combined with a lack of binary integrity checks. This vulnerability could allow an attacker with high privileges to modify the binary, potentially leading to unauthorized code changes. The CVSS score is 4.4, indicating a medium severity level. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
HCL BigFix Quantum Risk Analyzer version 2.0.1.47 has a vulnerability where overly descriptive error messages are generated upon receiving malformed input. This can aid attackers in reconnaissance and refining fuzzing techniques. The issue is identified as CWE-209, involving the generation of error messages containing sensitive information. The CVSS score is 3.9, indicating a low severity level.
CVE-2026-56547 is a low severity vulnerability in HCLSoftware Traveler affecting versions prior to 14.5.1.1. It involves improper input validation in the Apple profile generation process for Mail, Calendar, and Contacts synchronization. The profile requires embedding the Logon Name and Mail Address, which cannot be changed later. The vulnerability allows an attacker to submit values that are reflected back in the Apple profile without verifying that these values match the authenticated user's Domino directory entry. However, the profile is not usable without additional information, limiting the attack to the attacker's own device.
HCL Software Hive version 1.0 contains a vulnerability where sensitive cookies are set without the 'HttpOnly' flag. This issue is part of multiple infrastructure and network configuration vulnerabilities that could allow unauthorized lateral movement, container breakout, and exposure of sensitive data within internal communications. The vulnerability has a CVSS score of 5.4, indicating a medium severity level.
CVE-2026-21753 identifies a medium severity vulnerability in HCL Software Hive version 1.0 related to weak software supply chain governance. This weakness may allow the inclusion of vulnerable, unmaintained, or malicious third-party components within the application environment, potentially impacting confidentiality and integrity. The vulnerability has a CVSS 3.1 base score of 4.2, indicating a network attack vector with high attack complexity and requiring user interaction. No known exploits or patches are currently documented.
HCL Software Hive version 1.0 contains an information disclosure vulnerability (CVE-2026-21758) that could allow an attacker to obtain sensitive information about the host environment. The vulnerability has a low severity rating with a CVSS score of 3.7 and does not involve privilege or user interaction. No known exploits are reported in the wild, and no patch or remediation details are currently provided.
HCL Hive is affected by incorrect default permissions which could allow an attacker unauthorized lateral movement, container breakout, and interception of sensitive internal communications.
HCL Hive is affected by a use of vulnerable third-party components which could allow an attacker unauthorized access or compromise of the system by exploiting publicly documented security flaws.
CVE-2026-21755 is a medium severity vulnerability in HCL Hive version 1.0 caused by improper restriction of excessive authentication attempts. The lack of rate limiting allows attackers to perform brute-force or credential stuffing attacks, potentially leading to unauthorized access or denial of service. No patch or official fix information is provided.
CVE-2025-68833 affects HCL Hive version 1.0 and involves insufficient granularity of access control in the HCL Hive Keycloak IAM instance. This vulnerability could allow an attacker to gain unauthorized access to certain resources. The CVSS score is 5.3, indicating a medium severity level. There is no indication of active exploitation in the wild, and no patch or official remediation has been provided yet.
HCL Hive version 1.0 contains a vulnerability involving the use of a cryptographic primitive with a risky implementation. This flaw could enable an attacker to perform unauthorized lateral compromise or cause widespread credential leakage if one internal component is breached. The vulnerability has a high severity rating with a CVSS score of 7.4. No official patch or remediation guidance has been provided yet, and no known exploits are reported in the wild.
HCL Hive version 1.0 is affected by a broken access control vulnerability (CWE-266) that could allow an attacker with high privileges to introduce unverified or malicious code directly into production environments. This vulnerability has a high severity with a CVSS score of 7.2. No official patch or remediation guidance is currently available from the vendor.
HCL Hive version 1.0 is affected by an information exposure vulnerability where Swagger API documentation is publicly accessible without authentication. While no sensitive information such as credentials or personally identifiable information was found exposed, the public availability of API documentation can increase the attack surface by revealing implementation details.
HCL IntelliOps Event Management (IEM) version 1.4.0 has a vulnerability due to missing or insecure Cross-Origin Security headers. This weakness can lead to unauthorized external interactions with the application environment and resources, potentially exposing sensitive information. The vulnerability is classified under CWE-200, indicating exposure of sensitive information to unauthorized actors. The CVSS v3.1 score is 4.8, reflecting a medium severity level. There are no known exploits in the wild and no official patches or fixes have been provided yet.
CVE-2025-62299 is a least privilege violation vulnerability in HCL IntelliOps Event Management (IEM) version 1.4.0. This flaw allows an attacker with certain privileges to access resources with elevated privileges that they should not normally have. The vulnerability has a medium severity rating with a CVSS score of 6.6.
HCL IntelliOps Event Management (IEM) version 1.4.0 contains a race condition vulnerability (CWE-362) that allows concurrent execution using a shared resource with improper synchronization. This timing window can enable an attacker to modify the resource, leading to unpredictable behavior. The vulnerability has a medium severity with a CVSS score of 5.9 and impacts the integrity of the system without affecting confidentiality or availability.
CVE-2025-62306 is an information omission vulnerability in HCL IntelliOps Event Management (IEM) version 1.4.0. The flaw results in insufficient logging of workflow events, which can impair auditability and observability. This lack of detailed logging could hinder incident response efforts if an attacker gains access to the application. The vulnerability has a medium severity rating with a CVSS score of 5. No patch or remediation information is currently provided by the vendor.
CVE-2025-62307 is a medium severity vulnerability in HCL IntelliOps Event Management (IEM) version 1.4.0 caused by insufficient logging. This weakness reduces the ability to detect attacks and weakens accountability by obscuring privilege probing activities. The vulnerability does not allow direct compromise of confidentiality or availability but impacts integrity and detection capabilities.