Vendor
HCLSoftware
98 known vulnerabilities in products by HCLSoftware, 0 of them actively exploited (CISA KEV).
Key figures
98
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
3
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-21837 | HCLSoftware Digital Experience: OS Command Injection | 8.8 | |
| High | CVE-2026-21824 | A privilege escalation vulnerability affects HCL Commerce | 8.8 | |
| Critical | CVE-2026-108015 | eMudhra Compromised Certificate vulnerability impacts HCL Notes Client | — | |
| Critical | CVE-2026-108014 | eMudhra Compromised Certificate vulnerability impacts HCL Domino Server | — | |
| High | CVE-2026-21752 | HCL Hive is affected by a use of vulnerable third-party components | 7.5 | |
| High | CVE-2026-21756 | HCL Hive is affected by a broken access control vulnerability | 7.2 | |
| High | CVE-2025-68825 | HCL Hive is affected by incorrect default permissions | 7.5 | |
| High | CVE-2023-37507 | An information disclosure vulnerability affects HCL DevOps Plan | 7.5 | |
| Medium | CVE-2026-67071 | HCLSoftware HCL DevOps Deploy / HCL Launch: Improper Removal of Sensitive Information Before Storage or Transfer | 6.5 | |
| Medium | CVE-2026-67075 | HCL Digital Experience is affected by improper input sanitation | 6.5 | |
| High | CVE-2026-21751 | HCL Hive is affected by use of a cryptographic primitive with a risky implementation | 7.4 | |
| High | CVE-2023-37524 | HCLSoftware Traveler for Microsoft Outlook: Use of Unmaintained Third Party Components | 7.8 | |
| Medium | CVE-2026-56460 | HCLSoftware HCL DevOps Deploy / HCL Launch: Insertion of Sensitive Information Into Sent Data | 6.5 | |
| High | CVE-2026-56458 | HCL DevOps Deploy is susceptible to a Permissive Cross-domain Security Policy with Untrusted Domains | 7.5 | |
| High | CVE-2026-21821 | HCL BigFix SCM Reporting is affected by vulnerabilities in jQuery | 8.3 | |
| Medium | CVE-2026-67165 | HCL Connections is vulnerable to cross-site scripting (XSS) | 5.4 | |
| Medium | CVE-2026-56577 | HCL MyCloud affected by Weak Password Policy | 6.5 | |
| Medium | CVE-2024-23565 | HCLSoftware Aftermarket EPC: Improper Control of Interaction Frequency | 5.3 | |
| Medium | CVE-2024-23568 | HCLSoftware Aftermarket EPC: Exposure of Sensitive Information to an Unauthorized Actor | 5.3 | |
| Medium | CVE-2024-23566 | HCLSoftware Aftermarket EPC: Guessable CAPTCHA | 6.5 | |
| High | CVE-2026-21765 | HCL BigFix Platform is affected by insecure permissions on private cryptographic keys | 7.8 | |
| Medium | CVE-2026-21755 | HCL Hive is affected by a missing rate limit | 5.3 | |
| High | CVE-2024-42210 | HCLSoftware Unica Marketing Operations (Plan): Cross-site Scripting | 7.6 | |
| Medium | CVE-2026-21770 | HCL Traveler for Microsoft Outlook (HTMO) is susceptible to DLL hijacking | 6.5 | |
| Medium | CVE-2026-21766 | HCL Digital Experience and Digital Experience Compose insufficiently protects credentials | 5.4 |