hcengineering has 3 CVEs on record. 2 were published in the last 90 days. The median CVSS is 8.5 (high). Most affected products: platform (2), Huly Platform (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 8.5
- Publish → KEV
- —
- Last 90 days
- 2 prev 1
Worst active — by depth score
CVE-2026-56769High· 8.5Huly Platform - Server-Side Request Forgery via /import Endpoint59CVE-2026-91079High· 8.5Huly Platform through 0.7.426 contains a server-side request forgery vulnerability in the print service due to missing hostname allowlist validation47CVE-2026-111606High· 8.1Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to merge arbitrary persons by calling the mergeSpecifiedPersons account RPC45
hcengineering vulnerabilities
CVEs affecting hcengineering, newest first. Open any entry for full detail, references, and exploit status.
3 CVEsRSS
CVE-2026-111606High· 8.1Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to merge arbitrary persons by calling the mergeSpecifiedPersons account RPC
Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to merge arbitrary persons by calling the mergeSpecifiedPersons account RPC. Attackers knowing two person UUIDs can graft att…
CVE-2026-91079High· 8.5Huly Platform through 0.7.426 contains a server-side request forgery vulnerability in the print service due to missing hostname allowlist validation
Huly Platform through 0.7.426 contains a server-side request forgery vulnerability in the print service due to missing hostname allowlist validation. Authenticated workspace members can supply arbitrary URLs to the print endpoint, which …
CVE-2026-56769High· 8.5PoCHuly Platform - Server-Side Request Forgery via /import Endpoint
Huly Platform through 0.7.423, fixed in commit 68cbf8a contains an authenticated server-side request forgery vulnerability in the /import endpoint of front pod that allows workspace users to make arbitrary server requests. Attackers can …