Threat database

CVE-2026-67165 is a cross-site scripting (XSS) vulnerability in HCL Connections. It allows an attacker to inject and execute arbitrary script code in the browser of a user. This can lead to theft of cookie-based authentication credentials and compromise of the user's account. The vulnerability has a medium severity with a CVSS score of 5.4. No affected versions or patch information are provided.

HCL Digital Experience is affected by improper input sanitation.  This can result in HTML injection which could be leveraged in content spoofing from a trusted domain. Apply HCL Digital Experience 9.5 CF238 or later to address this.

HCL DevOps Deploy / HCL Launch contains an information disclosure vulnerability related to improper redaction of secure property values. When a deployment uses a secure property starting with certain non-ASCII characters, the redaction engine may fail to mask ASCII secure values embedded in insecure properties, potentially exposing sensitive information.

HCL Connections versions 7.0 and 8.0 contain an information disclosure vulnerability (CWE-359) that allows unauthorized users to access sensitive information due to improper handling of request data. The vulnerability has a low severity with a CVSS score of 3.1. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.

HCL Connections contains a server-side request forgery (SSRF) vulnerability that may allow an attacker with limited privileges and user interaction to send unauthorized requests from the server. This could lead to limited information disclosure or security bypass in certain scenarios. The vulnerability has a low CVSS score of 3.7 and no known exploits in the wild. No patch or official remediation guidance is currently available.

CVE-2026-21808 is a medium severity vulnerability in HCL BigFix Quantum Risk Analyzer version 2.0.1.47. The product generates highly detailed logs by default, which can inadvertently include sensitive information. This logging behavior increases the risk of sensitive data leakage and may expose internal application logic and architectural details to an attacker. There is no official patch or remediation guidance available at this time.

CVE-2026-21807 is a stack-based buffer overflow vulnerability in HCLSoftware BigFix Quantum Risk Analyzer version 2.0.1.47. The binary lacks several critical hardening protections, which could allow an attacker with high privileges to exploit the flaw. The vulnerability has a low CVSS score of 3.9, indicating limited impact and exploitability. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild for this vulnerability.

CVE-2026-21810 affects HCL BigFix Quantum Risk Analyzer version 2.0.1.47 and involves a hardcoded external resource reference combined with a lack of binary integrity checks. This vulnerability could allow an attacker with high privileges to modify the binary, potentially leading to unauthorized code changes. The CVSS score is 4.4, indicating a medium severity level. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

HCL BigFix Quantum Risk Analyzer version 2.0.1.47 has a vulnerability where overly descriptive error messages are generated upon receiving malformed input. This can aid attackers in reconnaissance and refining fuzzing techniques. The issue is identified as CWE-209, involving the generation of error messages containing sensitive information. The CVSS score is 3.9, indicating a low severity level.

CVE-2026-56547 is a low severity vulnerability in HCLSoftware Traveler affecting versions prior to 14.5.1.1. It involves improper input validation in the Apple profile generation process for Mail, Calendar, and Contacts synchronization. The profile requires embedding the Logon Name and Mail Address, which cannot be changed later. The vulnerability allows an attacker to submit values that are reflected back in the Apple profile without verifying that these values match the authenticated user's Domino directory entry. However, the profile is not usable without additional information, limiting the attack to the attacker's own device.

HCL Hive is affected by incorrect default permissions which could allow an attacker unauthorized lateral movement, container breakout, and interception of sensitive internal communications.

HCL Hive is affected by a use of vulnerable third-party components which could allow an attacker unauthorized access or compromise of the system by exploiting publicly documented security flaws.

CVE-2026-21755 is a medium severity vulnerability in HCL Hive version 1.0 caused by improper restriction of excessive authentication attempts. The lack of rate limiting allows attackers to perform brute-force or credential stuffing attacks, potentially leading to unauthorized access or denial of service. No patch or official fix information is provided.

CVE-2025-68833 affects HCL Hive version 1.0 and involves insufficient granularity of access control in the HCL Hive Keycloak IAM instance. This vulnerability could allow an attacker to gain unauthorized access to certain resources. The CVSS score is 5.3, indicating a medium severity level. There is no indication of active exploitation in the wild, and no patch or official remediation has been provided yet.

HCL Hive version 1.0 contains a vulnerability involving the use of a cryptographic primitive with a risky implementation. This flaw could enable an attacker to perform unauthorized lateral compromise or cause widespread credential leakage if one internal component is breached. The vulnerability has a high severity rating with a CVSS score of 7.4. No official patch or remediation guidance has been provided yet, and no known exploits are reported in the wild.

HCL Hive version 1.0 is affected by a broken access control vulnerability (CWE-266) that could allow an attacker with high privileges to introduce unverified or malicious code directly into production environments. This vulnerability has a high severity with a CVSS score of 7.2. No official patch or remediation guidance is currently available from the vendor.

HCL Hive version 1.0 is affected by an information exposure vulnerability where Swagger API documentation is publicly accessible without authentication. While no sensitive information such as credentials or personally identifiable information was found exposed, the public availability of API documentation can increase the attack surface by revealing implementation details.

HCL BigFix Mobile is vulnerable to Reflected Cross-Site Scripting (Reflected XSS) due to insufficient validation and output encoding of user-controlled input.

HCL BigFix Mobile is vulnerable to information disclosure due to improper handling of exceptions and verbose error reporting.

CVE-2026-21766 is a medium severity vulnerability in HCL Digital Experience and Digital Experience Compose version 9.5. The default login portlet insufficiently protects credentials, which under specific configurations may cause sensitive information to be written to web server logs. This issue only affects applications using the default login portlet and does not impact other components or configurations.