CVE-2026-21783 is a medium-severity vulnerability in HCLSoftware Traveler versions prior to 14.5.1.0, where error messages disclose sensitive information such as internal paths, file names, tokens, credentials, error codes, or stack traces. This information disclosure can aid attackers in understanding system architecture and crafting targeted attacks. The vulnerability does not require user interaction but does require some level of privileges (PR:L). There are no known exploits in the wild currently. The CVSS score is 4.3, reflecting limited confidentiality impact without direct integrity or availability effects. Organizations using affected versions should update to 14.
HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user which leads to executing malicious script code. This may allow the attacker steal cookie-based authentication credentials and comprise user's account then launch other attacks.
A Stored cross-site scripting (XSS) vulnerability affects HCL Unica Marketing Operations v12.1.8 and lower. Stored cross-site scripting (also known as second-order or persistent XSS) arises when an application receives data from an untrusted source and includes that data within its later HTTP responses in an unsafe way.
HCL Nomad server on Domino did not configure the frame-ancestors directive in the Content-Security-Policy header by default which could allow an attacker to obtain sensitive information via unspecified vectors.
HCL Digital Experience is susceptible to stored cross-site scripting (XSS) in the administrative user interface which would require elevated privileges to exploit.
HCL Connections is vulnerable to information disclosure. In a very specific user navigation scenario, this could allow a user to obtain limited information when a single piece of internal metadata is returned in the browser.
Rate limiting for certain API calls is not being enforced, making HCL Velocity vulnerable to Denial of Service (DoS) attacks. An attacker could flood the system with a large number of requests, overwhelming its resources and causing it to become unresponsive to legitimate users. This vulnerability is fixed in 5.1.7.
CVE-2025-62327 is a medium severity vulnerability in HCL DevOps Deploy versions 8.1 through 8.1.2.3, where users with LLM configuration privileges can recover previously saved credentials used for authenticated LLM queries. The vulnerability stems from insufficient protection of stored credentials (CWE-522). Exploitation requires privileged access but no user interaction and can lead to credential disclosure, impacting confidentiality. There are no known exploits in the wild yet. The CVSS score is 4.9, reflecting a moderate risk primarily due to the need for elevated privileges.
CVE-2025-31964 is a low-severity vulnerability in HCL BigFix IVR version 4.2 caused by improper service binding configuration. This flaw allows privileged attackers to expose administrative services externally instead of restricting them to local interfaces, potentially impacting service availability. Although it does not directly compromise confidentiality or integrity, the exposure could lead to denial-of-service conditions. Exploitation requires high privileges and no user interaction, with a low CVSS score of 2.2. No known exploits are currently reported in the wild. European organizations using BigFix IVR 4.2 should verify service bindings and restrict administrative interfaces to local networks to mitigate risk. Countries with significant HCL BigFix deployments and critical infrastructure relying on this product are more likely to be affected.
CVE-2025-31963 is a vulnerability in HCL BigFix IVR version 4.2 involving missing authentication and lack of CSRF protection in its local setup interface. This flaw allows a local attacker with high privileges to perform unauthorized configuration changes by sending unauthenticated administrative requests. The vulnerability requires local access and user interaction, with a low CVSS score of 2.9, indicating limited impact. Although the confidentiality and integrity of configuration data can be affected, availability remains intact. No known exploits are reported in the wild, and no patches have been published yet. European organizations using BigFix IVR 4.2 should be cautious, especially those with critical infrastructure relying on this product. Mitigation involves restricting local access, monitoring configuration changes, and applying vendor updates once available.
CVE-2025-31962 is a vulnerability in HCL BigFix IVR version 4.2 where insufficient session expiration in the Web UI authentication component allows authenticated attackers to maintain prolonged unauthorized access to protected API endpoints. The flaw arises from excessive session expiration periods, enabling attackers with valid credentials to extend their access beyond intended limits. Although the CVSS score is low (2.0), the issue could lead to confidentiality risks if attackers exploit prolonged sessions. No known exploits are reported in the wild, and the vulnerability requires high privileges and user interaction to exploit. European organizations using HCL BigFix IVR 4.2 should review session management policies and apply any available patches or compensating controls. Countries with significant HCL BigFix deployments and critical infrastructure relying on this product are more likely to be affected. Mitigations include reducing session timeout durations, enforcing re-authentication, and monitoring session activity closely.