Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
702 results · page 2 of 15
Aug 26, 2026HCL BigFix Quantum Risk Analyzer binary lacks several critical, industry-standard hardening protections that could allow an attacker to cause a stack-based buffCVE-2026-21807 · Other software · HCLSoftware · reported by psirt@hcl.comLow 3.9
HCL BigFix Quantum Risk Analyzer binary lacks several critical, industry-standard hardening protections that could allow an attacker to cause a stack-based buffer overflow.
- Product
- BigFix Quantum Risk Analyzer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Aug 26, 2026HCL Connections is vulnerable to server-side request forgery (SSRF) when an internal server is compromised possibly allowing an attacker to send unauthorized reCVE-2025-62341 · Other software · HCLSoftware · reported by psirt@hcl.comLow 3.7
HCL Connections is vulnerable to server-side request forgery (SSRF) when an internal server is compromised possibly allowing an attacker to send unauthorized requests in certain scenarios leading to information disclosure or security bypass.
- Product
- Connections
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Aug 26, 2026HCL BigFix Quantum Risk Analyzer is affected by a hardcoded external resource reference and a lack of binary integrity which could allow an attacker to obtain sCVE-2026-21810 · Other software · HCLSoftware · reported by psirt@hcl.comMedium 4.4
HCL BigFix Quantum Risk Analyzer is affected by a hardcoded external resource reference and a lack of binary integrity which could allow an attacker to obtain sensitive information or modify the binary.
- Product
- BigFix Quantum Risk Analyzer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Aug 26, 2026HCL BigFix Quantum Risk Analyzer has a certain validation process that provides overly descriptive error messages when it encounters malformed input which can aCVE-2026-21809 · Other software · HCLSoftware · reported by psirt@hcl.comLow 3.9
HCL BigFix Quantum Risk Analyzer has a certain validation process that provides overly descriptive error messages when it encounters malformed input which can allow an attacker to conduct more efficient reconnaissance and fine-tune automated fuzzing tools to produce valid input.
- Product
- BigFix Quantum Risk Analyzer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Aug 26, 2026The Apple profile generated for the Apple built-in Mail, Calendar and Contacts account to synchronize with HCL Traveler requires the Logon Name and Mail AddressCVE-2026-56547 · Other software · HCLSoftware · reported by psirt@hcl.comLow 3.5
The Apple profile generated for the Apple built-in Mail, Calendar and Contacts account to synchronize with HCL Traveler requires the Logon Name and Mail Address to be embedded in them. The values cannot be changed later on, so the Apple profile generation page asks for those values and reflects them back in the generated Apple profile. The Apple profile is not usable without additional information and only allows the attacker to attack their own device, but HCL Traveler could at least check that the values submitted and reflected back in the Apple profile are found in the Domino directory entry for the already authenticated user.
- Product
- Traveler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Aug 25, 2026HCL Hive is affected by an information disclosure vulnerability, which could lead to an attacker gathering sensitive information about the host environment.CVE-2026-21758 · Other software · HCL Software · reported by psirt@hcl.comLow 3.7
HCL Hive is affected by an information disclosure vulnerability, which could lead to an attacker gathering sensitive information about the host environment.
- Product
- Hive
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Aug 25, 2026HCL Hive is affected by multiple infrastructure and network configuration vulnerabilities, which could lead to unauthorized lateral movement, container breakoutCVE-2026-21754 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.4
HCL Hive is affected by multiple infrastructure and network configuration vulnerabilities, which could lead to unauthorized lateral movement, container breakout, and sensitive data exposure within internal communications.
- Product
- Hive
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Aug 25, 2026HCL Hive is affected by weak software supply chain governance, which could lead to the inclusion of vulnerable, unmaintained, or malicious third-party dependencCVE-2026-21753 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.2
HCL Hive is affected by weak software supply chain governance, which could lead to the inclusion of vulnerable, unmaintained, or malicious third-party dependencies within the application environment.
- Product
- Hive
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Aug 24, 2026HCL Hive is affected by a use of vulnerable third-party components which could allow an attacker unauthorized access or compromise of the system by exploiting pCVE-2026-21752 · Other software · HCLSoftware · reported by psirt@hcl.comHigh 7.5
HCL Hive is affected by a use of vulnerable third-party components which could allow an attacker unauthorized access or compromise of the system by exploiting publicly documented security flaws.
- Product
- HCL Hive
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Aug 24, 2026HCL Hive is affected by incorrect default permissions which could allow an attacker unauthorized lateral movement, container breakout, and interception of sensiCVE-2025-68825 · Other software · HCLSoftware · reported by psirt@hcl.comHigh 7.5
HCL Hive is affected by incorrect default permissions which could allow an attacker unauthorized lateral movement, container breakout, and interception of sensitive internal communications.
- Product
- HCL Hive
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Aug 24, 2026HCL Hive is affected by a missing rate limit which could allow an attacker unauthorized access via brute-force or credential stuffing attacks, or cause a denialCVE-2026-21755 · Other software · HCLSoftware · reported by psirt@hcl.comMedium 5.3
HCL Hive is affected by a missing rate limit which could allow an attacker unauthorized access via brute-force or credential stuffing attacks, or cause a denial of service.
- Product
- HCL Hive
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Aug 24, 2026HCL Hive is affected by a cryptographic primitive with a risky implementation which could allow an attacker unauthorized lateral compromise or widespread credenCVE-2026-21751 · Other software · HCLSoftware · reported by psirt@hcl.comHigh 7.4
HCL Hive is affected by a cryptographic primitive with a risky implementation which could allow an attacker unauthorized lateral compromise or widespread credential leakage if a single internal component is breached.
- Product
- HCL Hive
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Aug 24, 2026HCL Hive Keycloak IAM Instance is affected by insufficient granularity of access control which could allow an attacker unauthorized access to resources.CVE-2025-68833 · Other software · HCLSoftware · reported by psirt@hcl.comMedium 5.3
HCL Hive Keycloak IAM Instance is affected by insufficient granularity of access control which could allow an attacker unauthorized access to resources.
- Product
- HCL Hive
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Aug 24, 2026HCL Hive is affected by an information exposure vulnerability where Swagger documentation was found exposed publicly.CVE-2026-21759 · Other software · HCLSoftware · reported by psirt@hcl.comMedium 4.3
HCL Hive is affected by an information exposure vulnerability where Swagger documentation was found exposed publicly. Although no sensitive information (e.g., credentials, PII) was discovered, exposing API documentation to unauthenticated users can increase the overall attack surface.
- Product
- HCL Hive
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Aug 24, 2026HCL Hive is affected by a broken access control vulnerability which could allow an attacker or unauthorized user to introduce unverified, malicious, or broken cCVE-2026-21756 · Other software · HCLSoftware · reported by psirt@hcl.comHigh 7.2
HCL Hive is affected by a broken access control vulnerability which could allow an attacker or unauthorized user to introduce unverified, malicious, or broken code directly into production environments.
- Product
- HCL Hive
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Aug 20, 2026HCL IntelliOps Event Management (IEM) is affected by missing or insecure Cross-Origin Security headers.CVE-2026-21784 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.8
HCL IntelliOps Event Management (IEM) is affected by missing or insecure Cross-Origin Security headers. This issue makes the application's environment and resources susceptible to unauthorized external interaction and potential exploitation.
- Product
- IEM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Aug 20, 2026HCL IntelliOps Event Management (IEM) is affected by information omission.CVE-2025-62306 · Other software · HCL Software · reported by psirt@hcl.comMedium 5
HCL IntelliOps Event Management (IEM) is affected by information omission. The lack of information breaks auditability and observability of a workflow. if an attacker were to gain access to the application, the insufficient logging could hinder incident response.
- Product
- IEM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Aug 20, 2026HCL IntelliOps Event Management (IEM) is affected by a race condition.CVE-2025-62300 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.9
HCL IntelliOps Event Management (IEM) is affected by a race condition. A "timing window" can occur where an attacker can modify the resource causing unpredictable behavior.
- Product
- IEM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Aug 20, 2026HCL IntelliOps Event Management (IEM) is affected by a least privileges violation which could allow an attacker to access the resource with the elevated privileCVE-2025-62299 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.6
HCL IntelliOps Event Management (IEM) is affected by a least privileges violation which could allow an attacker to access the resource with the elevated privilege that could not be accessed with the attacker's original privileges.
- Product
- IEM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Aug 20, 2026HCL IntelliOps Event Management (IEM) is affected by insufficient logging.CVE-2025-62307 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.4
HCL IntelliOps Event Management (IEM) is affected by insufficient logging. Insufficient logging weakens accountability, obscures attack detection, and enables privilege probing.
- Product
- IEM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Aug 13, 2026HCL AION is affected by a vulnerability where indirect prompt injection can lead to HTML injection in rendered output.CVE-2026-21832 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.3
HCL AION is affected by a vulnerability where indirect prompt injection can lead to HTML injection in rendered output. Injected markup may be displayed to users, potentially resulting in unintended behavior or security impact under certain conditions.
- Product
- AION
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Aug 13, 2026HCL AION is affected by a vulnerability where JavaScript responses containing data could be referenced by external pages, potentially allowing sensitive informaCVE-2025-62318 · Other software · HCL Software · reported by psirt@hcl.comLow 3.7
HCL AION is affected by a vulnerability where JavaScript responses containing data could be referenced by external pages, potentially allowing sensitive information to be captured by an attacker-controlled page (JavaScript hijacking) under certain conditions.
- Product
- AION
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Aug 13, 2026HCL AION is affected by a vulnerability where certain input fields do not enforce sufficient server-side input validation.CVE-2025-62315 · Other software · HCL Software · reported by psirt@hcl.comLow 3.4
HCL AION is affected by a vulnerability where certain input fields do not enforce sufficient server-side input validation. Unexpected or crafted input may be accepted by the application, potentially resulting in unintended behavior or security impact under certain conditions.
- Product
- AION
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Aug 13, 2026HCL AION is affected by a vulnerability where certain endpoints lack sufficient anti-automation controls.CVE-2025-62314 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.6
HCL AION is affected by a vulnerability where certain endpoints lack sufficient anti-automation controls. Automated or scripted requests may be submitted without adequate rate limiting or challenge mechanisms, potentially resulting in unintended behavior or security impact under certain conditions.
- Product
- AION
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Aug 13, 2026HCL AION is affected by a vulnerability where the shared storage used by product components is architected without sufficient access separation.CVE-2025-52640 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.7
HCL AION is affected by a vulnerability where the shared storage used by product components is architected without sufficient access separation. Processes sharing the storage may be able to access or modify files beyond their intended scope, potentially resulting in unintended behavior or security impact under certain conditions.
- Product
- AION
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Aug 10, 2026HCL BigFix Mobile is vulnerable to Reflected Cross-Site Scripting (Reflected XSS) due to insufficient validation and output encoding of user-controlled input.CVE-2026-56619 · Other software · HCLSoftware · reported by psirt@hcl.comMedium 5.4
HCL BigFix Mobile is vulnerable to Reflected Cross-Site Scripting (Reflected XSS) due to insufficient validation and output encoding of user-controlled input.
- Product
- HCL BigFix Mobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Aug 10, 2026HCL BigFix Mobile is vulnerable to information disclosure due to improper handling of exceptions and verbose error reporting.CVE-2026-56620 · Other software · HCLSoftware · reported by psirt@hcl.comMedium 4.3
HCL BigFix Mobile is vulnerable to information disclosure due to improper handling of exceptions and verbose error reporting.
- Product
- HCL BigFix Mobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Aug 5, 2026The default login portlet in HCL Digital Experience and Digital Experience Compose insufficiently protects credentials.CVE-2026-21766 · Other software · HCLSoftware · reported by psirt@hcl.comMedium 5.4
The default login portlet in HCL Digital Experience and Digital Experience Compose insufficiently protects credentials. Under certain very specific use cases and specific configurations, sensitive information may be written to web server logs. This only affects applications using the default login portlet.
- Product
- HCL Digital Experience and Digital Experience Compose
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Aug 5, 2026Missing permission checks in Jenkins HCL AppScan Plugin 1.8.3 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentiaCVE-2026-70433 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Missing permission checks in Jenkins HCL AppScan Plugin 1.8.3 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
- Product
- Jenkins HCL AppScan Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2026HCL iControl is affected by Weak SSL/TLS Version Supported vulnerability.CVE-2026-56609 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.8
HCL iControl is affected by Weak SSL/TLS Version Supported vulnerability. It was observed that the application was using weak TLS versions such as TLS 1.0 and 1.1. These outdated protocols lack modern security features, making them vulnerable to known attacks and exposing sensitive information during data transmission.
- Product
- HCL iControl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Aug 3, 2026HCL iControl is affected by Missing Access Control vulnerability.CVE-2026-56608 · Other software · HCL Software · reported by psirt@hcl.comLow 3.7
HCL iControl is affected by Missing Access Control vulnerability. The application failed to enforce proper granular access controls, allowing users to access or view administrator-level functionalities without appropriate authorization.
- Product
- HCL iControl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Jul 31, 2026HCL iControl was affected by Improper Error Handling vulnerabilities.CVE-2026-56571 · Other software · HCL Software · reported by psirt@hcl.comLow 3.7
HCL iControl was affected by Improper Error Handling vulnerabilities. It involves Out of memory, null pointer exceptions, system call failure, database unavailable, network timeout, and hundreds of other common conditions can cause errors to be generated.
- Product
- HCL iControl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Jul 31, 2026HCL iControl was affected by Auto complete Enabled vulnerabilities.CVE-2026-56570 · Other software · HCL Software · reported by psirt@hcl.comLow 3.7
HCL iControl was affected by Auto complete Enabled vulnerabilities. It involves expose sensitive information such as: Valid usernames, Email addresses used for login, Account identifiers If the system is accessed from shared environments, attackers may enumerate valid usernames through browser suggestions.
- Product
- HCL iControl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Jul 31, 2026HCL iControl was affected by Sensitive Data Exposure vulnerabilities.CVE-2026-56569 · Other software · HCL Software · reported by psirt@hcl.comMedium 4
HCL iControl was affected by Sensitive Data Exposure vulnerabilities. It involves the public exposure of internal configuration files due to improper web server or application hardening.
- Product
- HCL iControl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Jul 31, 2026HCL iControl was affected by Information Exposure Through Verbose Client-Side API Error Messages vulnerabilities.CVE-2026-56568 · Other software · HCL Software · reported by psirt@hcl.comLow 3.7
HCL iControl was affected by Information Exposure Through Verbose Client-Side API Error Messages vulnerabilities. It involves application displays raw server/API error messages to users instead of generic error messages and exposes internal endpoint names, request parameters, error codes, and authentication status
- Product
- HCL iControl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Jul 31, 2026HCL iControl v4.3.0 was affected by Security Misconfiguration vulnerabilities.CVE-2026-56567 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.1
HCL iControl v4.3.0 was affected by Security Misconfiguration vulnerabilities. It involves the public exposure of internal configuration files due to improper web server or application hardening.
- Product
- HCL iControl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Jul 31, 2026HCL iControl was affected by Improper Input Validation vulnerability.CVE-2025-62347 · Other software · HCL · reported by psirt@hcl.comMedium 4.3
HCL iControl was affected by Improper Input Validation vulnerability. It is vulnerable to unexpected system behavior and potential security bypasses. This was caused by an implementation flaw in an architectural security tactic that fails to properly validate whether the received input matches the expected type.
- Product
- HCL iControl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Jul 27, 2026An endpoint in HCL Connections is vulnerable to information disclosure.CVE-2026-56538 · Other software · HCLSoftware · reported by psirt@hcl.comLow 3.5
An endpoint in HCL Connections is vulnerable to information disclosure. In certain scenarios this might lead to disclosing sensitive information to unauthorized users.
- Product
- Connections
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Jul 27, 2026HCL Connections is vulnerable to information disclosure which could allow a user to obtain sensitive information they are not entitled to, caused by improper haCVE-2026-56537 · Other software · HCLSoftware · reported by psirt@hcl.comLow 3.5
HCL Connections is vulnerable to information disclosure which could allow a user to obtain sensitive information they are not entitled to, caused by improper handling of request data.they are not entitled to, caused by improper handling of request data.
- Product
- Connections
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Jul 21, 2026HCL MyCloud was affected with Concurrent Login Vulnerability.CVE-2026-56583 · Other software · HCLSoftware · reported by psirt@hcl.comLow 3.1
HCL MyCloud was affected with Concurrent Login Vulnerability. It may increase the risk of unauthorized access, session hijacking, and account misuse.
- Product
- MyCloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Jul 21, 2026HCL MyCloud was affected by the SSL/TLS LUCKY13 Vulnerability.CVE-2026-56582 · Other software · HCLSoftware · reported by psirt@hcl.comLow 3.1
HCL MyCloud was affected by the SSL/TLS LUCKY13 Vulnerability. An attacker may exploit this vulnerability to decrypt sensitive information through a TLS/SSL padding oracle attack.
- Product
- MyCloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Jul 21, 2026HCL MyCloud was affected with Cookie Attribute Path Not Set.CVE-2026-56581 · Other software · HCLSoftware · reported by psirt@hcl.comLow 2.6
HCL MyCloud was affected with Cookie Attribute Path Not Set. It may increase the risk of unauthorized access to session data or authentication tokens.
- Product
- MyCloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Jul 21, 2026HCL MyCloud was affected by Using Components with Known Vulnerability ( IIS Server ).CVE-2026-56580 · Other software · HCLSoftware · reported by psirt@hcl.comLow 2.2
HCL MyCloud was affected by Using Components with Known Vulnerability ( IIS Server ). It may allow attackers to exploit publicly disclosed weaknesses and compromise the system.
- Product
- MyCloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Jul 21, 2026HCL MyCloud was affected with License Key Revealed in HTTP Response.CVE-2026-56579 · Other software · HCLSoftware · reported by psirt@hcl.comLow 3.1
HCL MyCloud was affected with License Key Revealed in HTTP Response. It may enable attackers to misuse the exposed information and compromise the application's security.
- Product
- MyCloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Jul 21, 2026HCL MyCloud was affected by Server Version Disclosure.CVE-2026-56578 · Other software · HCLSoftware · reported by psirt@hcl.comLow 2.2
HCL MyCloud was affected by Server Version Disclosure. It may help attackers identify and exploit known vulnerabilities affecting the disclosed software versions.
- Product
- MyCloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Jul 21, 2026HCL MyCloud was affected with Weak Password Policy.CVE-2026-56577 · Other software · HCLSoftware · reported by psirt@hcl.comLow 3.1
HCL MyCloud was affected with Weak Password Policy. It may increase the risk of account compromise through brute-force or credential-based attacks.
- Product
- MyCloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Jul 21, 2026HCL IEM was affected with X-Content-Type-Options Header Missing.CVE-2026-56586 · Other software · HCLSoftware · reported by psirt@hcl.comLow 3.1
HCL IEM was affected with X-Content-Type-Options Header Missing. It may enable attackers to perform SSL stripping or man-in-the-middle attacks and intercept sensitive data.
- Product
- IntelliOps Event Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Jul 21, 2026HCL IEM was affected with the Anti Clickjacking XFrame Options Header Missing.CVE-2026-56585 · Other software · HCLSoftware · reported by psirt@hcl.comLow 3.1
HCL IEM was affected with the Anti Clickjacking XFrame Options Header Missing. It may allow attackers to embed the application in malicious pages and induce unauthorized user actions.
- Product
- IntelliOps Event Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Jul 21, 2026HCL IEM was affected with Strict transport security not enforced.CVE-2026-56587 · Other software · HCLSoftware · reported by psirt@hcl.comLow 3.7
HCL IEM was affected with Strict transport security not enforced. It may enable attackers to perform SSL stripping or man-in-the-middle attacks and compromise secure communications.
- Product
- IntelliOps Event Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Jul 21, 2026HCL IEM was affected with the Information disclosure nginx server.CVE-2026-56584 · Other software · HCLSoftware · reported by psirt@hcl.comLow 3.7
HCL IEM was affected with the Information disclosure nginx server. It may enable attackers to identify outdated software versions and target known vulnerabilities or publicly available exploits.
- Product
- IntelliOps Event Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.