Hcl

By the Year

In 2026 there have been 102 vulnerabilities in Hcl with an average score of 4.4 out of ten. Last year, in 2025 Hcl had 39 security vulnerabilities published. That is, 63 more vulnerabilities have already been reported in 2026 as compared to last year. Last year, the average CVE base score was greater by 0.81

Recent Hcl Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2024-23564	Jul 17, 2026	HCL Aftermarket EPC: Auth Bypass Password Disclosure via Email Request HCL Aftermarket EPC is affected by Business Logic Vulnerability using which a non valid user of the application can obtain passwords from the server and redirect them to their own email address by manipulating the server's response. The application includes checks in the initial requests to verify the validity of the provided UserId, but similar validation is not applied to Email requests when sending passwords to user emails.
CVE-2026-56456	Jul 16, 2026	HCL DFXAnalytics Internal File Path Disclosure via Unhandled Errors HCL DFXAnalytics is affected by an Internal File Path Disclosure vulnerability. The application dashboard inadvertently leaks sensitive information regarding its internal file structure and directory paths through unhandled error messages, system logs, or debugging output, which could allow a remote attacker to map the underlying server environment and identify targets for further exploitation.
CVE-2026-56455	Jul 16, 2026	HCL DFXAnalytics Buffer Overflow Can Trigger DoS HCL DFXAnalytics is affected by a Buffer Overflow vulnerability that can lead to a Denial of Service (DoS). The application fails to properly validate input sizes, allowing an attacker to pass an excessive amount of information into a memory container, which can cause the system to crash or become unresponsive. To mitigate this flaw, comprehensive input length checks must be implemented and enforced on both the client and server sides.
CVE-2026-56454	Jul 16, 2026	HCL DFXAnalytics Deprecated TLS 1.0/1.1 Usage Vulnerability HCL DFXAnalytics is affected by a Deprecated Protocol vulnerability due to the use of TLS 1.0 and TLS 1.1. These legacy protocols contain numerous cryptographic design flaws that expose data to interception and decryption. To remediate this risk, the application must disable all support for TLS 1.0 and TLS 1.1, and exclusively enable support for secure protocols, specifically TLS 1.2 and TLS 1.3.
CVE-2026-56453	Jul 16, 2026	HCL DFXAnalytics Account Takeover via Response Manipulation HCL DFXAnalytics is affected by an Account Takeover via Response Manipulation vulnerability. A remote attacker can intercept and alter the contents of the server's HTTP responses before they reach the client application, allowing them to manipulate the authentication or authorization logic to bypass controls and gain unauthorized access to targeted user accounts.
CVE-2026-35145	Jul 16, 2026	HCL DFXAnalytics Missing HSTS Header Remote MitM Vulnerability HCL DFXAnalytics is affected by a Missing HTTP Strict-Transport-Security Header vulnerability. The application fails to implement the HTTP Strict Transport Security (HSTS) policy within its responses, which could allow a remote attacker to downgrade the communication channel to an unencrypted connection (HTTP) and conduct man-in-the-middle (MitM) attacks. To remediate this, the application must include the "Strict-Transport-Security" header in all web application responses.
CVE-2026-35143	Jul 16, 2026	HCL DFXAnalytics Missing SameSite on Session Cookies CSRF Risk HCL DFXAnalytics is affected by a Missing SameSite Attribute vulnerability. The application fails to set the "SameSite" attribute on session cookies generated during authentication, which could allow a remote attacker to execute Cross-Site Request Forgery (CSRF) attacks if additional mitigations, such as Anti-CSRF tokens, are not implemented.
CVE-2026-35142	Jul 16, 2026	HCL DFXAnalytics IP Address Disclosure CVE-2026-35142 HCL DFXAnalytics is affected by an Internal IP Address Disclosure vulnerability. The application includes internal IP address details within its generated server responses, which could allow a remote attacker to gather sensitive network topology information and use it to map the internal infrastructure for further targeted attacks.
CVE-2026-35141	Jul 16, 2026	Login Replay Vulnerability in HCL DFXAnalytics HCL DFXAnalytics is affected by a Login Replay Attack vulnerability. The application allows a remote attacker to intercept, delay, or fraudulently retransmit valid authentication data to achieve unauthorized access. To mitigate this risk, the application must implement a mechanism to include timestamps with every message, ensuring that messages exceeding a specific age threshold are automatically rejected by the recipient system.
CVE-2026-35140	Jul 16, 2026	Missing Secure Attribute on Auth Session Cookie in HCL DFXAnalytics HCL DFXAnalytics is affected by a Missing Secure Attribute in Encrypted Session (SSL) Cookie vulnerability. The application fails to set the "secure" attribute on session cookies generated during authentication, which could allow a remote attacker to intercept network traffic and capture sensitive cookies, session tokens, or credentials sent in cleartext over unencrypted channels.
CVE-2026-35147	Jul 16, 2026	HCL DFXServer Broken Auth via Direct API HCL DFXServer is affected by a Broken Authentication vulnerability via direct API access. The application fails to verify the user's authentication status when accessing specific API endpoints, allowing an unauthenticated attacker to interact with the APIs and perform unauthorized actions without valid credentials.
CVE-2026-35149	Jul 16, 2026	HCL DFXServer Auth Bypass via Server Response Manip HCL DFXServer is affected by an Authentication Bypass vulnerability via server response manipulation. An unauthorized user without valid credentials can exploit this flaw by intercepting and altering the server's authentication responses, allowing them to gain unauthorized access to the application without verification.
CVE-2026-35148	Jul 16, 2026	Missing Access Control in HCL DFXServer API Endpoints HCL DFXServer is affected by a Missing Access Control vulnerability. This vulnerability states that certain endpoints are accessible without any form of authentication in another browser. This allows any network user to invoke these APIs and interact with the application without verification of their identity or authorization level.
CVE-2026-9007	Jul 15, 2026	HCL Notes 12.0.2FP5HF8 XSS via Reflected User Input Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in HCL Notes from HCL Software allows reflected Cross-Site Scripting (XSS).  Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of another user. This issue affects HCL Notes: Release 12.0.2FP5HF8 on Linux 4.18.0-553.52.1.El8_10.X64_64#1.
CVE-2025-59872	Jun 17, 2026	Unrestricted File Upload in HCL ZIE for Web (CVE-2025-59872) HCL ZIE for Web is affetced by an Unrestricted File Upload vulnerability, If the server is configured to execute code, then it may be possible to obtain command execution on the server by uploading a file known as a web shell, which allows you to execute arbitrary code or operating system commands. For this attack to be successful, the file needs to be uploaded inside the Webroot, and the server must be configured to execute the code
CVE-2025-62340	Jun 17, 2026	HCL iControl Session Timeout Failure HCL iControl was affected by Inadequate Session Timeout vulnerability. The vulnerability involves a security risk where a web application fails to automatically terminate user sessions after a period of inactivity
CVE-2025-62338	Jun 04, 2026	HCL BigFix Cloud LC Mgt: Input Validation Flaw Enables Info Exposure HCL BigFix Cloud Lifecycle Management is affected by lack of input validation.  This low-level flaw allows unauthorized access and may lead to information exposure.	Bigfix
CVE-2025-59874	Jun 04, 2026	CSP Directive Missing in HCL Hive Telco Obs Keycloak Web App HCL Hive Telco Observability is affected by  a Required directives missing from the CSP issue is detected in keycloak component of the web application. Missing essential directives can leave a site vulnerable.
CVE-2025-52606	Jun 04, 2026	HCL iControl Weak Input Validation (WIV) Vulnerability HCL iControl was affected by Weak Input Validation vulnerability. This weakness is caused during implementation of an architectural security tactic. Received input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.
CVE-2025-52608	Jun 04, 2026	HCL iControl Missing Cookie Attributes (Secure, SameSite) HCL iControl was affected by Missing Cookie Attributes vulnerability. It was observed that the application is missing several critical cookie attributes, including Secure and SameSite. And also path is set to root.
CVE-2025-52609	Jun 04, 2026	HCL iControl XSS via Missing Security Headers HCL iControl was affected by Missing Security Headers vulnerability. which lead to cross-site scripting (XSS) attacks by enabling the built-in XSS filtering mechanisms of modern web browsers.
CVE-2025-52611	Jun 04, 2026	HCL iControl v4.0.0 stack trace disclosure via undefined JS property HCL iControl v4.0.0 was affected by Unhandled Exception - Stack Trace Disclosure vulnerability. The error occurs due to an undefined property being accessed in the application's JavaScript code. Specifically, the code attempts to read the property dashboard key from an object that is undefined. This issue likely stems from one of the following: A missing or improperly initialized object.
CVE-2025-52612	Jun 04, 2026	Reflected XSS via CSV Export in HCL iControl HCL iControl was affected by Export CSV - CSV Injection vulnerability. It is vulnerable to a reflected cross-site scripting vulnerability. This was caused by an insufficient sanitation of input parameters. .
CVE-2024-42206	Jun 02, 2026	CVE-2024-42206: HCL iReflection Web App Uses Outdated Vulnerable Components HCL iReflection Third party vulnerable and outdated components issue was detected in the web application
CVE-2025-31985	May 20, 2026	HCL BigFix SM X-Content-Type-Options Header Misconfig - Browser MIME Sniffing HCL BigFix Service Management (SM) is affected by a security misconfiguration due to a missing or insecure X-Content-Type-Options header. This could allow browsers to perform MIME-type sniffing, potentially causing malicious content to be interpreted and executed incorrectly.	Bigfix
CVE-2025-31973	May 20, 2026	Insecure Base Image Use in HCL BigFix Service Management HCL BigFix Service Management (SM) is susceptible to a Configuration 'Insecure Use of Base Image Version'. Using outdated or insecure base images may introduce known vulnerabilities, potentially increasing the risk of exploitation in the application environment.	Bigfix
CVE-2025-62305	May 14, 2026	OOB Disclosure in HCL AION (CVE-2025-62305) HCL AION is affected by a vulnerability where certain operations may trigger out-of-band interactions, potentially resulting in unintended disclosure of sensitive information. Such behaviour may allow exposure of data to external systems under specific conditions.	Aion
CVE-2025-62317	May 14, 2026	HCL AION Sensitive Data in URL Parameters Disclosure HCL AION is affected by a vulnerability where sensitive information may be included in URL parameters. Passing sensitive data in URLs may expose it through browser history, logs, or intermediary systems, potentially leading to unintended information disclosure under certain conditions.	Aion
CVE-2025-62308	May 14, 2026	Sensitive Backend Info Disclosure in HCL AION HCL AION is affected by a vulnerability where sensitive backend infrastructure details may be exposed. Exposure of such information could reveal internal system architecture or configuration details, which may potentially assist in further analysis or targeted actions under certain conditions	Aion
CVE-2025-62309	May 14, 2026	HCL AION Autocomplete Info Disclosure via Browser Caching HCL AION is affected by a vulnerability where auto-complete functionality is enabled for certain input fields. This may allow sensitive information to be stored in the browser, potentially leading to unintended exposure under specific conditions.	Aion
CVE-2025-62312	May 14, 2026	HCL AION Basic Auth Token Leak Vulnerability HCL AION is affected by a vulnerability where basic authorization tokens are used for authentication. Use of basic authorization mechanisms may expose credentials to potential interception or misuse, especially if not combined with secure transmission practices.	Aion
CVE-2025-62316	May 14, 2026	HCL AION HTTP Response Header Misconfig Weakens Browser Security HCL AION is affected by a vulnerability where certain security-related HTTP response headers are not properly configured. Absence of these headers may reduce the effectiveness of browser-based security controls and could expose the application to limited security risks under specific conditions.	Aion
CVE-2025-62313	May 14, 2026	HCL AION Brute-Force Access via Missing Auth Throttle HCL AION is affected by a vulnerability where adequate protections against brute-force attempts are not enforced. This may allow repeated authentication attempts, potentially leading to unauthorized access or account compromise under certain conditions.	Aion
CVE-2025-62311	May 14, 2026	HCL AION Backend Service Data Exposure via Insecure HTTP HCL AION is affected by a vulnerability where backend service details may be transmitted over insecure HTTP channels. This may expose sensitive information to potential interception or unauthorized access during transmission under certain conditions	Aion
CVE-2025-62310	May 14, 2026	Unencrypted Data Exposure in HCL AION Encryption Not Enforced HCL AION is affected by a vulnerability where encryption is not enforced for certain data transmissions or operations. This may expose sensitive information to potential interception or unauthorized access under specific conditions.	Aion
CVE-2024-30151	May 06, 2026	Broken Access Control in HCL BigFix SM (SX) Enables Privilege Escalation HCL BigFix Service Management (SX) is affected by a Broken Access Control vulnerability leading to privilege escalation. This could allow unauthorized users to gain elevated privileges, bypassing intended access restrictions. This may result in exposure of sensitive data or unauthorized system modifications	Bigfix
CVE-2025-31960	May 06, 2026	Info Exposure via Unhandled Exception in HCL BigFix SM Reporting HCL BigFix Service Management (SM) is vulnerable to information exposure due to improper error handling within its reporting module. It was observed that supplying an invalid or out-of-range value to the consumer_company parameter during a report-viewing request causes the application to trigger an unhandled exception.	Bigfix
CVE-2025-31974	May 06, 2026	HCL BigFix SM Root FS Read-Only Misconfig allows critical changes HCL BigFix Service Management (SM) is susceptible to a Root File System Not Mounted as Read-Only. An improperly configured root file system may allow unintended modifications to critical system components, potentially increasing the risk of system compromise or unauthorized changes.	Bigfix
CVE-2025-31975	May 06, 2026	HCL BigFix SM InfoDisclosure: Server Banner Leak Reveals Versions HCL BigFix Service Management (SM) is affected by an Information Disclosure Server Banner issue was identified. Exposed server banners may reveal software versions and system details, potentially aiding attackers in targeting known vulnerabilities.	Bigfix
CVE-2025-52613	May 06, 2026	HCL BigFix SM WSGI Server Vulnerability Enables Unauthorized Access HCL BigFix Service Management (SM) is affected by use of a vulnerable WSGI Server was identified. Deploying an outdated or insecure WSGI server may expose the application to known security weaknesses, potentially increasing the risk of exploitation and unauthorized access.	Bigfix
CVE-2025-31976	May 06, 2026	Insufficiently Protected Credentials in HCL BigFix SM HCL BigFix Service Management (SM) is vulnerable to insufficiently protected credentials for a short duration while communicating with a backend, internal application which could allow an attacker to potentially misuse them, if exfiltrated. .	Bigfix
CVE-2025-31978	May 06, 2026	HCL BigFix SM CSV/XLS/XLSX Sanitization Bypass (CVE-2025-31978) HCL BigFix Service Management (SM) does not adequately sanitize or safely render spreadsheet files (CSV, XLS, XLSX) before processing or distributing them. An attacker could populate data fields which, when saved to a CSV file, may attempt information exfiltration or other malicious activity when automatically executed by the spreadsheet software. Note that current versions of Excel warn users of untrusted content.	Bigfix
CVE-2025-31959	May 06, 2026	HCL BigFix SM Exif Metadata Exposure Vulnerability HCL BigFix Service Management (SM) application fails to strip EXIF metadata from uploaded images. This could lead to confidentiality and privacy risks if sensitive location information is unintentionally shared. .	Bigfix
CVE-2025-31982	May 06, 2026	Unlinked Directory Access Enables Information Disclosure in HCL BigFix SM HCL BigFix Service Management (SM) had directories that were not linked or publicly visible but could be accessed directly. This could allow an increased risk of information disclosure or misuse of sensitive functionality.	Bigfix
CVE-2025-31984	May 06, 2026	BigFix SM MIME-Type Sniffing via Missing X-Content-Type-Options Header HCL BigFix Service Management (SM) is affected by a security misconfiguration due to a missing or insecure X-Content-Type-Options header. This could allow browsers to perform MIME-type sniffing, potentially causing malicious content to be interpreted and executed incorrectly.	Bigfix
CVE-2025-31983	May 06, 2026	HCL BigFix SM CSP Header XSS Vulnerability HCL BigFix Service Management (SM) is affected by a security misconfiguration vulnerability due to CSP header. This could allow attackers to inject malicious scripts increasing the risk of cross-site scripting (XSS) and potential exposure of sensitive information.	Bigfix
CVE-2025-31957	May 06, 2026	HCL BigFix SM CSRF Enables Unauthorized Changes HHCL BigFix Service Management (SM) is affected by a CrossSite Request Forgery (CSRF) vulnerability. This could lead to unauthorized changes or exposure of sensitive data.	Bigfix
CVE-2025-62345	May 06, 2026	HCL BigFix RunBookAI Input Handling Vulnerability (CVE-2025-62345) HCL BigFix RunBookAI is affected by a Continued availability of Less-Secure Input Text Vulnerability . A component contains a security weakness in its input handling implementation, increasing the risk of misconfiguration and operational errors.	Bigfix
CVE-2025-31951	May 06, 2026	HCL BigFix RunBookAI Command Smuggling via Unvalidated Input HCL BigFix RunBookAI is affected by a Unvalidated Command Input / Potential Command Smuggling vulnerability. A flaw in a component's input handling was identified that could permit unauthorized command execution.	Bigfix
CVE-2025-59854	May 06, 2026	HCL DFXAnalytics: Vulnerable X-XSS-Protection Header (CSP Bypass) HCL DFXAnalytics is affected by an Insecure Security Header Configuration vulnerability where the application utilizes the outdated X-XSS-Protection header, which could allow an attacker to exploit browser-specific rendering flaws or bypass security controls that should instead be managed by a robust Content Security Policy (CSP).