hcltech has 84 CVEs on record between 2022 and 2026. Disclosure cadence is accelerating: 18 in the last 90 days against 8 in the 90 before. The busiest recent month was May 2026 with 16. The median CVSS is 4.9 (medium), with 2 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-200 (15) and CWE-79 (11). Most affected products: bigfix_service_management (33), aion (8), dfxanalytics (6).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 4.9
- Publish → KEV
- —
- Last 90 days
- 18 prev 8
Weakness classes
Products
- bigfix_service_management 33
- aion 8
- dfxanalytics 6
- devops_plan 5
- unica 5
- bigfix_mobile 4
Worst active — by depth score
CVE-2026-67100Critical· 9.8HCL BigFix Service Management is affected by SQL Injection flaw and a Cross-Tenant Data Exposure flaw vulnerabilities54CVE-2026-67101Critical· 9.3HCL BigFix Service Management is affected by a Server-Side Request Forgery (SSRF) vulnerability in its search functionality, which could allow an attacker to force the application server to send requests to internal systems that are not …51CVE-2026-67102High· 8.1HCL BigFix Service Management is affected by a high-severity Broken Access Control vulnerability, which could allow a low-privileged user to gain unauthorized access to administrative screens and functions reserved for higher-privileged …45CVE-2025-52650High· 8.2Inline script execution allowed in CSP vulnerability has been identified in HCL AION v2.045CVE-2026-67103High· 7.6HCL BigFix Service Management is affected by Cross-Site Scripting (XSS) vulnerability, which could allow an attacker to inject unsanitized malicious scripts that execute in a victim's browser, enabling session hijacking, account takeover…42
hcltech vulnerabilities
CVEs affecting hcltech, newest first. Open any entry for full detail, references, and exploit status.
84 CVEsRSS
CVE-2025-52614Low· 3.5HCL Unica Platform is affected by a Cookie without HTTPOnly Flag Set vulnerability
HCL Unica Platform is affected by a Cookie without HTTPOnly Flag Set vulnerability. A malicious agent may be able to induce this event by feeding a user suitable links, either directly or via another web site.
CVE-2025-31969Medium· 4.0HCL Unica Platform is impacted by misconfigured Content Security Policy (CSP)
HCL Unica Platform is impacted by misconfigured Content Security Policy (CSP). These can result in malicious resources getting loaded and browsers may come across certain types of attacks, such as cross-site scripting and clickjacking.
CVE-2025-52616Medium· 5.3HCL Unica 12.1.10 can expose sensitive system information
HCL Unica 12.1.10 can expose sensitive system information. An attacker could use this information to form an attack plan by leveraging known vulnerabilities in the application.
CVE-2025-31997Medium· 4.2HCL Unica Centralized Offer Management is vulnerable to Insecure Direct Object References (IDOR)
HCL Unica Centralized Offer Management is vulnerable to Insecure Direct Object References (IDOR). An attacker can bypass authorization and access resources in the system directly, for example database records or files.
CVE-2025-31993Low· 3.5HCL Unica Centralized Offer Management is vulnerable to a potential Server-Side Request Forgery (SSRF)
HCL Unica Centralized Offer Management is vulnerable to a potential Server-Side Request Forgery (SSRF). An attacker can exploit improper input validation by submitting maliciously crafted input to a target application running on a server.
CVE-2025-31998Low· 3.5HCL Unica Centralized Offer Management is vulnerable to poor unhandled exceptions which exposes sensitive information
HCL Unica Centralized Offer Management is vulnerable to poor unhandled exceptions which exposes sensitive information. An attacker can exploit use this information to exploit known vulnerabilities launch targeted attacks, such as remote…
CVE-2025-52635Low· 3.7A rusted types in scripts not enforced in CSP vulnerability has been identified in HCL AION.This issue affects AION: 2.0.
A rusted types in scripts not enforced in CSP vulnerability has been identified in HCL AION.This issue affects AION: 2.0.
CVE-2025-52625Low· 3.7A vulnerability Cacheable SSL Page Found vulnerability has been identified in HCL AION. Cached data may expose credentials, system identifiers, or internal file paths to attackers with access to the device or browser This issue af…
A vulnerability Cacheable SSL Page Found vulnerability has been identified in HCL AION. Cached data may expose credentials, system identifiers, or internal file paths to attackers with access to the device or browser This issue af…
CVE-2025-52624Medium· 5.4A vulnerability Bypass of the script allowlist configuration in HCL AION. An incorrectly configured Content-Security-Policy header may allow unauthorized scripts to execute, increasing the risk of cross-site scripting and other inject…
A vulnerability Bypass of the script allowlist configuration in HCL AION. An incorrectly configured Content-Security-Policy header may allow unauthorized scripts to execute, increasing the risk of cross-site scripting and other inject…
CVE-2025-52650High· 8.2Inline script execution allowed in CSP vulnerability has been identified in HCL AION v2.0
Inline script execution allowed in CSP vulnerability has been identified in HCL AION v2.0
CVE-2025-52634Low· 3.7Exposure of Sensitive Information to an Unauthorized Actor vulnerability in HCL AION This issue affects HCL AION: 2.0.
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in HCL AION This issue affects HCL AION: 2.0.
CVE-2025-52632Medium· 6.5A Missing Secure Attribute in Encrypted Session (SSL) Cookie vulnerability in HCL AION.This issue affects AION: 2.0.
A Missing Secure Attribute in Encrypted Session (SSL) Cookie vulnerability in HCL AION.This issue affects AION: 2.0.
CVE-2025-52630Low· 3.7Exposure of Sensitive Information to an Unauthorized Actor vulnerability in HCL AION.This issue affects AION: 2.0.
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in HCL AION.This issue affects AION: 2.0.
CVE-2025-52658Low· 3.5HCL MyXalytics is affected by the use of vulnerable/outdated versions which can expose the application to known security risks that could be exploited.
HCL MyXalytics is affected by the use of vulnerable/outdated versions which can expose the application to known security risks that could be exploited.
CVE-2025-52656High· 7.6HCL MyXalytics: 6.6. is affected by Mass Assignment vulnerability
HCL MyXalytics: 6.6. is affected by Mass Assignment vulnerability. Mass Assignment occurs when user input is automatically bound to application objects without proper validation or access controls, potentially allowing unauthorized modi…
CVE-2025-52654Medium· 4.6HCL MyXalytics v6.6 is affected by an HTML Injection
HCL MyXalytics v6.6 is affected by an HTML Injection. This issue occurs when untrusted input is included in the output without proper handling, potentially allowing unauthorized content injection and manipulation.
CVE-2025-52653High· 7.6HCL MyXalytics product is affected by Cross Site Scripting vulnerability in the web application
HCL MyXalytics product is affected by Cross Site Scripting vulnerability in the web application. This can allow the execution of unauthorized scripts, potentially resulting in unauthorized actions or access.
CVE-2025-31977Medium· 5.3HCL BigFix SM is affected by cryptographic weakness due to weak or outdated encryption algorithms. An attacker with network access could exploit this weakness to decrypt or manipulate encrypted communications under certain conditions.
HCL BigFix SM is affected by cryptographic weakness due to weak or outdated encryption algorithms. An attacker with network access could exploit this weakness to decrypt or manipulate encrypted communications under certain conditions.
CVE-2025-31972Medium· 6.5HCL BigFix SM is affected by a Sensitive Information Exposure vulnerability where internal connections do not use TLS encryption which could allow an attacker unauthorized access to sensitive data transmitted between internal components.
HCL BigFix SM is affected by a Sensitive Information Exposure vulnerability where internal connections do not use TLS encryption which could allow an attacker unauthorized access to sensitive data transmitted between internal components.
CVE-2024-22349Medium· 4.0IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0
IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0. 25 allows web pages to be stored locally which can be read by another user on the system.
CVE-2024-22348Medium· 5.3IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0
IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0. 25 uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is n…
CVE-2024-22347Medium· 5.9IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0
IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0. 25 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
CVE-2022-27545Medium· 4.6BigFix Web Reports authorized users may perform HTML injection for the email administrative configuration page.
BigFix Web Reports authorized users may perform HTML injection for the email administrative configuration page.
CVE-2022-27544Medium· 5.0BigFix Web Reports authorized users may see SMTP credentials in clear text.
BigFix Web Reports authorized users may see SMTP credentials in clear text.