Microsoft Azure DevOps MCP Flaw Lets Hidden PR Comments Hijack AI Review Agents

A single invisible comment in an Azure DevOps pull request can turn a reviewer's own AI coding agent against them, driving it into projects the attacker has no rights to reach and quietly leaking what it finds. The flaw is in Microsoft's official Azure DevOps MCP server, and it works because one ...

CVE-2023-37507

HCL DevOps Plan is susceptible to an information disclosure that can allow an attacker to focus their attacks based upon the information revealed...

CVE-2023-37508

HCL DevOps Plan is potentially susceptible to Cross-Site Scripting XSS which could allow an attacker to exploit this vulnerability if certain browser weaknesses are present...

EUVD-2023-60604

HCL DevOps Plan is susceptible to an information disclosure that can allow an attacker to focus their attacks based upon the information revealed...

CVE-2023-37507

CVE-2023-37507 affects HCL DevOps Plan. An information disclosure vulnerability exposes information that can be used to tailor attacks. Attack vector is network-based with no authentication, low attack complexity, and no privileges required; the vulnerability mainly impacts confidentiality (Vulne...

CVE-2023-37507 An information disclosure vulnerability affects HCL DevOps Plan

HCL DevOps Plan is susceptible to an information disclosure that can allow an attacker to focus their attacks based upon the information revealed...

CVE-2023-37508

Technical details (affected products, versions, impact, remediation) are not publicly available in the provided documents; monitor for updates.

CVE-2023-37508 HCL DevOps Plan is susceptible to a Cross-Site Scripting (XSS) vulnerability

HCL DevOps Plan is potentially susceptible to Cross-Site Scripting XSS which could allow an attacker to exploit this vulnerability if certain browser weaknesses are present...

EUVD-2023-60603

HCL DevOps Plan is potentially susceptible to Cross-Site Scripting XSS which could allow an attacker to exploit this vulnerability if certain browser weaknesses are present...

PT-2026-61823

HCL DevOps Plan is potentially susceptible to Cross-Site Scripting XSS which could allow an attacker to exploit this vulnerability if certain browser weaknesses are present...

CVE-2026-21762

HCL DevOps Loop is affected by missing HTTP security headers. Missing security headers may reduce browser protections against common web-based attacks such as clickjacking, MIME-type sniffing, and cross-site scripting...

CVE-2026-21764

HCL DevOps Loop is affected by insufficient input validation that allows special characters where they should be restricted. This may result in unintended application behavior under certain conditions...

CVE-2026-21760

HCL DevOps Loop is affected by an Unauthorized Access to Admin Functionality Forced Browsing vulnerability. Improper authorization checks may allow unauthorized users to access restricted administrative functionality by directly accessing protected application endpoints...

CVE-2026-21761

HCL DevOps Loop is affected by a Cross-Origin Resource Sharing CORS misconfiguration. Improper CORS configuration may allow unauthorized cross-origin requests, potentially exposing application resources to untrusted domains...

CVE-2026-21764 Insufficient Input Validation in DevOps Loop

HCL DevOps Loop is affected by insufficient input validation that allows special characters where they should be restricted. This may result in unintended application behavior under certain conditions...

CVE-2026-21764

Technical details about CVE-2026-21764 are not publicly available in the provided documents. Monitor for updates from official sources; current entries only state insufficient input validation without specifics.

CVE-2026-21764

HCL DevOps Loop is affected by insufficient input validation that allows special characters where they should be restricted. This may result in unintended application behavior under certain conditions...

EUVD-2026-45233

HCL DevOps Loop is affected by insufficient input validation that allows special characters where they should be restricted. This may result in unintended application behavior under certain conditions...

CVE-2026-21762 Missing HTTP Security Headers in DevOps Loop

HCL DevOps Loop is affected by missing HTTP security headers. Missing security headers may reduce browser protections against common web-based attacks such as clickjacking, MIME-type sniffing, and cross-site scripting...

CVE-2026-21762

Technical details are not publicly available in the provided documents. Monitor for updates.