Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
702 results · page 6 of 15
Feb 3, 2026HCL AION is susceptible to Missing Content-Security-Policy.CVE-2025-52629 · Other software · HCL · reported by psirt@hcl.comLow 3.7
HCL AION is susceptible to Missing Content-Security-Policy. An The absence of a CSP header may increase the risk of cross-site scripting and other content injection attacks by allowing unsafe scripts or resources to execute..This issue affects AION: 2.0.
- Product
- AION
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Feb 3, 2026Root File System Not Mounted as Read-Only configuration vulnerability.CVE-2025-52627 · Other software · HCL · reported by psirt@hcl.comMedium 5.5
Root File System Not Mounted as Read-Only configuration vulnerability. This can allow unintended modifications to critical system files, potentially increasing the risk of system compromise or unauthorized changes.This issue affects AION: 2.0.
- Product
- AION
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Feb 3, 2026A Potential Command Injection vulnerability in HCL AION.CVE-2025-52626 · Other software · HCL · reported by psirt@hcl.comMedium 4.5
A Potential Command Injection vulnerability in HCL AION. An This can allow unintended command execution, potentially leading to unauthorized actions on the underlying system.This issue affects AION: 2.0
- Product
- AION
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Jan 28, 2026A sensitive information disclosure in HCL BigFix Compliance allows a remote attacker to access files under the WEB-INF directory, which may contain Java class fCVE-2023-37525 · Other software · HCLSoftware · reported by psirt@hcl.comMedium 5.3
A sensitive information disclosure in HCL BigFix Compliance allows a remote attacker to access files under the WEB-INF directory, which may contain Java class files and configuration information, leading to unauthorized access to application internals.
- Product
- BigFix Compliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Jan 19, 2026HCL AION version 2 is affected by a Weak Password Policy vulnerability.CVE-2025-55252 · Other software · HCL Software · reported by psirt@hcl.comLow 3.1
HCL AION version 2 is affected by a Weak Password Policy vulnerability. This can allow the use of easily guessable passwords, potentially resulting in unauthorized access
- Product
- AION
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Jan 19, 2026HCL AION version 2 is affected by a Technical Error Disclosure vulnerability.CVE-2025-55250 · Other software · HCL Software · reported by psirt@hcl.comLow 1.8
HCL AION version 2 is affected by a Technical Error Disclosure vulnerability. This can expose sensitive technical details, potentially resulting in information disclosure or aiding further attacks.
- Product
- AION
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Jan 19, 2026HCL AION is affected by an Unrestricted File Upload vulnerability.CVE-2025-55251 · Other software · HCL Software · reported by psirt@hcl.comLow 3.1
HCL AION is affected by an Unrestricted File Upload vulnerability. This can allow malicious file uploads, potentially resulting in unauthorized code execution or system compromise.
- Product
- AION
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Jan 19, 2026HCL AION is affected by a Missing Security Response Headers vulnerability.CVE-2025-55249 · Other software · HCL Software · reported by psirt@hcl.comLow 3.5
HCL AION is affected by a Missing Security Response Headers vulnerability. The absence of standard security headers may weaken the application’s overall security posture and increase its susceptibility to common web-based attacks.
- Product
- AION
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Jan 19, 2026HCL AION version 2 is affected by a JWT Token Expiry Too Long vulnerability.CVE-2025-52661 · Other software · HCL Software · reported by psirt@hcl.comLow 2.4
HCL AION version 2 is affected by a JWT Token Expiry Too Long vulnerability. This may increase the risk of token misuse, potentially resulting in unauthorized access if the token is compromised.
- Product
- AION
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Jan 19, 2026HCL AION is affected by an Unrestricted File Upload vulnerability.CVE-2025-52660 · Other software · HCL Software · reported by psirt@hcl.comLow 2.7
HCL AION is affected by an Unrestricted File Upload vulnerability. This can allow malicious file uploads, potentially resulting in unauthorized code execution or system compromise.
- Product
- AION
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Jan 19, 2026HCL AION version 2 is affected by a Cacheable HTTP Response vulnerability.CVE-2025-52659 · Other software · HCL Software · reported by psirt@hcl.comLow 2.8
HCL AION version 2 is affected by a Cacheable HTTP Response vulnerability. This may lead to unintended storage of sensitive or dynamic content, potentially resulting in unauthorized access or information disclosure.
- Product
- AION
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Jan 16, 2026HCL MyXalytics is affected by improper management of a static JWT signing secret in the web application, where the secret lacks rotation , introducing a securiCVE-2025-59870 · Other software · HCL Software · reported by psirt@hcl.comHigh 7.4
HCL MyXalytics is affected by improper management of a static JWT signing secret in the web application, where the secret lacks rotation , introducing a security risk
- Product
- MyXalytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Jan 7, 2026In HCL DevOps Deploy 8.1.2.0 through 8.1.2.3, a user with LLM configuration privileges may be able to recover a credential previously saved for performing autheCVE-2025-62327 · Other software · HCLSoftware · reported by psirt@hcl.comMedium 4.9
In HCL DevOps Deploy 8.1.2.0 through 8.1.2.3, a user with LLM configuration privileges may be able to recover a credential previously saved for performing authenticated LLM Queries.
- Product
- DevOps Deploy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Jan 7, 2026Improper service binding configuration in internal service components in HCL BigFix IVR version 4.2 allows a privileged attacker to impact service availability CVE-2025-31964 · Other software · HCLSoftware · reported by psirt@hcl.comLow 2.2
Improper service binding configuration in internal service components in HCL BigFix IVR version 4.2 allows a privileged attacker to impact service availability via exposure of administrative services bound to external network interfaces instead of the local authentication interface.
- Product
- BigFix IVR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Jan 7, 2026Improper authentication and missing CSRF protection in the local setup interface component in HCL BigFix IVR version 4.2 allows a local attacker to perform unauCVE-2025-31963 · Other software · HCLSoftware · reported by psirt@hcl.comLow 2.9
Improper authentication and missing CSRF protection in the local setup interface component in HCL BigFix IVR version 4.2 allows a local attacker to perform unauthorized configuration changes via unauthenticated administrative configuration requests.
- Product
- BigFix IVR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Jan 7, 2026Insufficient session expiration in the Web UI authentication component in HCL BigFix IVR version 4.2 allows an authenticated attacker to gain prolonged unauthorCVE-2025-31962 · Other software · HCLSoftware · reported by psirt@hcl.comLow 2
Insufficient session expiration in the Web UI authentication component in HCL BigFix IVR version 4.2 allows an authenticated attacker to gain prolonged unauthorized access to protected API endpoints due to excessive expiration periods.
- Product
- BigFix IVR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Dec 17, 2025Improper management of Content Security Policy in HCL BigFix Remote Control Lite Web Portal (versions 10.1.0.0326 and lower) may allow the execution of maliciouCVE-2025-59849 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.7
Improper management of Content Security Policy in HCL BigFix Remote Control Lite Web Portal (versions 10.1.0.0326 and lower) may allow the execution of malicious code in web pages.
- Product
- BigFix Remote Control
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Dec 17, 2025Improper management of Path-relative stylesheet import in HCL BigFix Remote Control Lite Web Portal (versions 10.1.0.0326 and lower) may allow to execute maliciCVE-2025-55254 · Other software · HCL Software · reported by psirt@hcl.comLow 3.7
Improper management of Path-relative stylesheet import in HCL BigFix Remote Control Lite Web Portal (versions 10.1.0.0326 and lower) may allow to execute malicious code in certain web pages.
- Product
- BigFix Remote Control
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Dec 16, 2025HCL DevOps Deploy / HCL Launch is susceptible to a race condition in http-session client-IP binding enforcement which may allow a session to be briefly reused fCVE-2025-62329 · Other software · HCL Software · reported by psirt@hcl.comMedium 5
HCL DevOps Deploy / HCL Launch is susceptible to a race condition in http-session client-IP binding enforcement which may allow a session to be briefly reused from a new IP address before it is invalidated. This could lead to unauthorized access under certain network conditions.
- Product
- DevOps Deploy / Launch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Dec 16, 2025HCL DevOps Deploy is susceptible to a cleartext transmission of sensitive information because the HTTP port remains accessible and does not redirect to HTTPS asCVE-2025-62330 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.9
HCL DevOps Deploy is susceptible to a cleartext transmission of sensitive information because the HTTP port remains accessible and does not redirect to HTTPS as intended. As a result, an attacker with network access could intercept or modify user credentials and session-related data via passive monitoring or man-in-the-middle attacks.
- Product
- DevOps Deploy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Dec 11, 2025HCL Workload Scheduler stores user credentials in plain text which can be read by a local user.CVE-2024-42197 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.5
HCL Workload Scheduler stores user credentials in plain text which can be read by a local user.
- Product
- Workload Scheduler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Dec 3, 2025An issue in HCL Technologies Limited HCLTech GRAGON before v.7.6.0 allows a remote attacker to execute arbitrary code via APIs do not enforcing limits on the nuCVE-2025-63402 · Other software · Hcltech · reported by MITREMedium 5.5
An issue in HCL Technologies Limited HCLTech GRAGON before v.7.6.0 allows a remote attacker to execute arbitrary code via APIs do not enforcing limits on the number or size of requests
- Product
- Dragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexcalibur-hcl.my.salesforce.com
Dec 3, 2025Cross Site Scripting vulnerability in HCL Technologies Limited HCLTech DRAGON before v.7.6.0 allows a remote attacker to execute arbitrary code via missing direCVE-2025-63401 · Other software · Hcltech · reported by MITREMedium 5.5
Cross Site Scripting vulnerability in HCL Technologies Limited HCLTech DRAGON before v.7.6.0 allows a remote attacker to execute arbitrary code via missing directives
- Product
- Dragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexcalibur-hcl.my.salesforce.com
Dec 2, 2025The BigFix SaaS's HTTP responses were missing some security headers.CVE-2025-52622 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.4
The BigFix SaaS's HTTP responses were missing some security headers. The absence of these headers weakens the application's client-side security posture, making it more vulnerable to common web attacks that these headers are designed to mitigate, such as Cross-Site Scripting (XSS), Clickjacking, and protocol downgrade attacks.
- Product
- BigFix SaaS Remediate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Nov 28, 2025File upload vulnerability in HCL Technologies Ltd.CVE-2025-51736 · Other software · Hcltech · reported by MITREMedium 6.3
File upload vulnerability in HCL Technologies Ltd. Unica 12.0.0.
- Product
- Unica
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 28, 2025CSV formula injection vulnerability in HCL Technologies Ltd.CVE-2025-51735 · Other software · Hcltech · reported by MITREHigh 7.5
CSV formula injection vulnerability in HCL Technologies Ltd. Unica 12.0.0.
- Product
- Unica
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 28, 2025Cross-site scripting (XSS) vulnerability in HCL Technologies Ltd.CVE-2025-51734 · Other software · Hcltech · reported by MITREMedium 5.4
Cross-site scripting (XSS) vulnerability in HCL Technologies Ltd. Unica 12.0.0.
- Product
- Unica
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 28, 2025Cross-Site Request Forgery (CSRF) vulnerability in HCL Technologies Ltd.CVE-2025-51733 · Other software · Hcltech · reported by MITREMedium 5.5
Cross-Site Request Forgery (CSRF) vulnerability in HCL Technologies Ltd. Unica 12.0.0.
- Product
- Unica
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 25, 2025HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability caused by improper validation of user-supplied input.CVE-2025-0248 · Other software · HCL Software · reported by psirt@hcl.comHigh 8.1
HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability caused by improper validation of user-supplied input. A remote, unauthenticated attacker can specially craft a URL to execute script in a victim's Web browser within the security context of the hosting Web site and/or steal the victim's cookie-based authentication credentials.
- Product
- iNotes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Nov 20, 2025A Cross-Site Request Forgery (CSRF) vulnerability was identified in HCL Glovius Cloud.CVE-2025-62346 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.8
A Cross-Site Request Forgery (CSRF) vulnerability was identified in HCL Glovius Cloud. An attacker can force a user's web browser to execute an unwanted, malicious action on a trusted site where the user is authenticated, specifically on one endpoint.
- Product
- Glovius Cloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Nov 18, 2025HCL Connections is vulnerable to a sensitive information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitledCVE-2025-52639 · Other software · HCL Software · reported by psirt@hcl.comLow 3.5
HCL Connections is vulnerable to a sensitive information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitled to, caused by improper rendering of application data.
- Product
- Connections
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Nov 5, 2025Improper authentication in the API authentication middleware of HCL DevOps Loop allows authentication tokens to be accepted without proper validation of their eCVE-2025-55278 · Other software · HCL Software · reported by psirt@hcl.comHigh 8.1
Improper authentication in the API authentication middleware of HCL DevOps Loop allows authentication tokens to be accepted without proper validation of their expiration and cryptographic signature. As a result, an attacker could potentially use expired or tampered tokens to gain unauthorized access to sensitive resources and perform actions with elevated privileges.
- Product
- DevOps Loop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Nov 5, 2025HCL iAutomate v6.5.1 and v6.5.2 is susceptible to a sensitive information disclosure.CVE-2025-31954 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.4
HCL iAutomate v6.5.1 and v6.5.2 is susceptible to a sensitive information disclosure. An HTTP GET method is used to process a request and includes sensitive information in the query string of that request. An attacker could potentially access information or resources they were not intended to see.
- Product
- iAutomate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Nov 5, 2025HCL BigFix Query is affected by a sensitive information disclosure in the WebUI Query application.CVE-2025-52602 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.2
HCL BigFix Query is affected by a sensitive information disclosure in the WebUI Query application. An HTTP GET endpoint request returns discoverable responses that may disclose: group names, active user names (or IDs). An attacker can use that information to target individuals with phishing or other social-engineering attacks.
- Product
- BigFix Query
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Oct 16, 2025HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a credential leakage which could allow an attacker to access other computers or applications.CVE-2024-42192 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.5
HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a credential leakage which could allow an attacker to access other computers or applications.
- Product
- Traveler for Microsoft Outlook
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Oct 16, 2025HCL BigFix Mobile 3.3 and earlier are vulnerable to certain insecure directives within the Content Security Policy (CSP).CVE-2025-0277 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.5
HCL BigFix Mobile 3.3 and earlier are vulnerable to certain insecure directives within the Content Security Policy (CSP). An attacker could trick users into performing actions by not properly restricting the sources of scripts and other content.
- Product
- BigFix Mobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Oct 16, 2025HCL BigFix Modern Client Management (MCM) 3.3 and earlier are vulnerable to certain insecure directives within the Content Security Policy (CSP).CVE-2025-0276 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.5
HCL BigFix Modern Client Management (MCM) 3.3 and earlier are vulnerable to certain insecure directives within the Content Security Policy (CSP). An attacker could trick users into performing actions by not properly restricting the sources of scripts and other content.
- Product
- BigFix Modern Client Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Oct 16, 2025HCL BigFix Mobile 3.3 and earlier is affected by improper access control.CVE-2025-0275 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.3
HCL BigFix Mobile 3.3 and earlier is affected by improper access control. Unauthorized users can access a small subset of endpoint actions, potentially allowing access to select internal functions.
- Product
- BigFix Mobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Oct 16, 2025HCL BigFix Modern Client Management (MCM) 3.3 and earlier is affected by improper access control.CVE-2025-0274 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.3
HCL BigFix Modern Client Management (MCM) 3.3 and earlier is affected by improper access control. Unauthorized users can access a small subset of endpoint actions, potentially allowing access to select internal functions.
- Product
- BigFix Modern Client Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Oct 13, 2025HCL Unica MaxAI Workbench is vulnerable to improper input validation.CVE-2025-31995 · Other software · HCL Software · reported by psirt@hcl.comLow 3.5
HCL Unica MaxAI Workbench is vulnerable to improper input validation. This allows attackers to exploit vulnerabilities such as SQL Injection, XSS, or command injection, leading to unauthorized access or data breaches, etc.
- Product
- MaxAI Workbench
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Oct 13, 2025HCL Unica Platform is affected by unprotected files due to improper access controls.CVE-2025-31996 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.3
HCL Unica Platform is affected by unprotected files due to improper access controls. These files may contain sensitive information such as private or system information that can be exploited by attackers to compromise the application, infrastructure, or users.
- Product
- Unica Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Oct 13, 2025HCL Unica Campaign 12.1.10 is vulnerable to Reflected Cross-Site Scripting (XSS) where an attacker injects malicious script into an HTTP request, which is then CVE-2025-31994 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.3
HCL Unica Campaign 12.1.10 is vulnerable to Reflected Cross-Site Scripting (XSS) where an attacker injects malicious script into an HTTP request, which is then reflected unsafely in the server's immediate response to the victim's browser, executing the script as if it originated from the trusted website.
- Product
- Unica Campaign
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Oct 12, 2025HCL Unica Platform is impacted by misconfigured security related HTTP headers.CVE-2025-52615 · Other software · HCL Software · reported by psirt@hcl.comLow 3.5
HCL Unica Platform is impacted by misconfigured security related HTTP headers. This can lead to less secure browser default treatment for the policies controlled by these headers.
- Product
- Unica Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Oct 12, 2025HCL Unica Platform is affected by a Cookie without HTTPOnly Flag Set vulnerability.CVE-2025-52614 · Other software · HCL Software · reported by psirt@hcl.comLow 3.5
HCL Unica Platform is affected by a Cookie without HTTPOnly Flag Set vulnerability. A malicious agent may be able to induce this event by feeding a user suitable links, either directly or via another web site.
- Product
- Unica Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Oct 12, 2025HCL Unica Platform is impacted by misconfigured Content Security Policy (CSP).CVE-2025-31969 · Other software · HCL Software · reported by psirt@hcl.comMedium 4
HCL Unica Platform is impacted by misconfigured Content Security Policy (CSP). These can result in malicious resources getting loaded and browsers may come across certain types of attacks, such as cross-site scripting and clickjacking.
- Product
- Unica Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Oct 12, 2025HCL Unica MaxAI Assistant is susceptible to a HTML injection vulnerability.CVE-2025-31992 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.6
HCL Unica MaxAI Assistant is susceptible to a HTML injection vulnerability. An attacker could insert special characters that are processed client-side in the context of the user's session.
- Product
- MaxAI Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Oct 12, 2025HCL Unica 12.1.10 can expose sensitive system information.CVE-2025-52616 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.3
HCL Unica 12.1.10 can expose sensitive system information. An attacker could use this information to form an attack plan by leveraging known vulnerabilities in the application.
- Product
- Unica
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Oct 11, 2025HCL Unica Centralized Offer Management is vulnerable to poor unhandled exceptions which exposes sensitive information.CVE-2025-31998 · Other software · HCL Software · reported by psirt@hcl.comLow 3.5
HCL Unica Centralized Offer Management is vulnerable to poor unhandled exceptions which exposes sensitive information. An attacker can exploit use this information to exploit known vulnerabilities launch targeted attacks, such as remote code execution or denial of service.
- Product
- Unica Centralized Offer Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Oct 11, 2025HCL Unica Centralized Offer Management is vulnerable to Insecure Direct Object References (IDOR).CVE-2025-31997 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.2
HCL Unica Centralized Offer Management is vulnerable to Insecure Direct Object References (IDOR). An attacker can bypass authorization and access resources in the system directly, for example database records or files.
- Product
- Unica Centralized Offer Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Oct 11, 2025HCL Unica Centralized Offer Management is vulnerable to a potential Server-Side Request Forgery (SSRF).CVE-2025-31993 · Other software · HCL Software · reported by psirt@hcl.comLow 3.5
HCL Unica Centralized Offer Management is vulnerable to a potential Server-Side Request Forgery (SSRF). An attacker can exploit improper input validation by submitting maliciously crafted input to a target application running on a server.
- Product
- Unica Centralized Offer Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.