Vendor
HCL Software
51 known vulnerabilities in products by HCL Software, 0 of them actively exploited (CISA KEV).
Key figures
51
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
6
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2020-14275 | HCL Commerce: Denial of Service | 9.8 | |
| Critical | CVE-2020-14245 | HCL OneTest UI: security vulnerability | 9.8 | |
| Critical | CVE-2021-27741 | Commerce: XML External Entity (XXE) | 9.1 | |
| High | CVE-2020-14274 | HCL Commerce: Information Disclosure | 7.5 | |
| High | CVE-2020-14231 | HCL Client Application Access: Stack-Based Buffer Overflow | 8.8 | |
| Medium | CVE-2020-14225 | HCL iNotes: security vulnerability | 6.5 | |
| Critical | CVE-2022-38656 | HCL Commerce, when using Elasticsearch, could be affected by a denial of service vulnerability | 8.6 | |
| High | CVE-2025-0255 | HCL DevOps Deploy / HCL Launch is susceptible to command injection vulnerability | 7.2 | |
| Medium | CVE-2026-56460 | HCLSoftware HCL DevOps Deploy / HCL Launch: Insertion of Sensitive Information Into Sent Data | 6.5 | |
| High | CVE-2026-56458 | HCL DevOps Deploy is susceptible to a Permissive Cross-domain Security Policy with Untrusted Domains | 7.5 | |
| High | CVE-2020-14246 | HCL OneTest Performance: security vulnerability | 7.5 | |
| Medium | CVE-2020-14247 | HCL OneTest Performance: security vulnerability | 6.5 | |
| High | CVE-2024-23576 | HCL Commerce is potentially affected by a denial of service and information disclosure vulnerability | 7.1 | |
| Medium | CVE-2026-56459 | HCL DevOps Deploy / HCL Launch is susceptible to sensitive information disclosure | 5.5 | |
| Medium | CVE-2026-56457 | HCL DevOps Deploy / HCL Launch is susceptible to an exposure of sensitive information | 4.3 | |
| Medium | CVE-2022-44756 | HCL BigFix Insights for Vulnerability Remediation (IVR) is vulnerable to improper input validation | 6.4 | |
| High | CVE-2025-0257 | HCL DevOps Deploy / HCL Launch is susceptible to unauthorized access to other services | 6.3 | |
| Medium | CVE-2022-42445 | HCL Launch is vulnerable to Insufficiently Protected LDAP Search Credentials (CVE-2022-42445) | 4.9 | |
| Medium | CVE-2022-27551 | HCL Launch could allow an authenticated user to obtain sensitive information (CVE-2022-27551) | 5.3 | |
| High | CVE-2023-45703 | HCL Launch is susceptible to a Denial of Service vulnerability | 5.3 | |
| Critical | CVE-2023-37522 | HCL BigFix OSD Bare Metal Server WebUI is affected by missing or insecure tags | 5.6 | |
| Medium | CVE-2025-62330 | HCL DevOps Deploy is susceptible to a cleartext transmission of sensitive information | 5.9 | |
| Critical | CVE-2023-37523 | HCL BigFix OSD Bare Metal Server WebUI is affected by missing or insecure tags | 5.6 | |
| Medium | CVE-2024-23558 | HCL DevOps Deploy / HCL Launch does not invalidate all session authentication cookies after logout | 6.3 | |
| Medium | CVE-2022-27548 | HCL Launch: Plaintext Storage of a Password | 4.9 |
Products
| HCL Launch | 28 | 0 |
| HCL Software DevOps Deploy | 20 | 0 |
| HCL Commerce | 7 | 0 |
| HCL BigFix OSD Bare Metal Server WebUI | 3 | 0 |
| HCL OneTest Performance | 3 | 0 |