PT-2026-95318

Name of the Vulnerable Software and Affected Versions HCL BigFix Service Management affected versions not specified Description A security misconfiguration involving improper access controls allows an authenticated attacker to view restricted data elements across tenant boundaries. This issue...

CVE-2026-67100: Improper Neutralization of Special Elements used in an SQL Command

HCL BigFix Service Management is affected by SQL Injection flaw and a Cross-Tenant Data Exposure flaw vulnerabilities. which could allow an authenticated attacker to inject database commands to extract sensitive system details, as well as manipulate request values to gain unauthorized access to...

CVE-2026-56592: Improper Restriction of Excessive Authentication Attempts

HCL BigFix Service Management is affected by an Improper Authentication validation vulnerability related to inadequate account lockouts, which could allow an unauthenticated attacker to execute sustained brute-force attacks against the login interface, resulting in unauthorized system access...

CVE-2026-21806: Undefined Security Weakness

HCL BigFix Service Management is affected by an Administrative Session Concurrency vulnerability. The application allows multiple simultaneous authenticated sessions for the same administrative account, which could enable an unauthorized attacker to predict or hijack valid session identifiers...

CVE-2026-56597: Exposure of Sensitive Information to an Unauthorized Actor

HCL BigFix Service Management is affected by a Sensitive Information Leakage vulnerability, which could allow an unauthenticated attacker to extract internal IP addresses from the application's responses, enabling them to map the underlying network topology and identify potential internal targets...

PT-2026-95328

Name of the Vulnerable Software and Affected Versions HCL BigFix Service Management affected versions not specified Description Improper file validation controls lead to an unrestricted file upload issue. This allows an unauthenticated attacker to upload and execute malicious payloads, which can...

PT-2026-95331

Name of the Vulnerable Software and Affected Versions HCL BigFix Service Management affected versions not specified Description A sensitive information leakage issue allows an unauthenticated attacker to extract internal IP addresses from application responses. This can be used to map the...

CVE-2026-67103: Improper Neutralization of Input During Web Page Generation

HCL BigFix Service Management is affected by Cross-Site Scripting XSS vulnerability, which could allow an attacker to inject unsanitized malicious scripts that execute in a victim's browser, enabling session hijacking, account takeover, and unauthorized actions on behalf of affected users...

CVE-2026-56595: Permissive Cross-domain Policy with Untrusted Domains

HCL BigFix Service Management is affected by a CORS Misconfiguration vulnerability due to improperly validated origin headers, which could allow an attacker to craft a malicious web page that interacts with the vulnerable application, enabling unauthorized access to protected resources and...

PT-2026-95304

Name of the Vulnerable Software and Affected Versions HCL BigFix Service Management affected versions not specified Description An authenticated attacker can exploit a SQL Injection flaw and a Cross-Tenant Data Exposure flaw. These issues allow the injection of database commands to extract...

CVE-2026-67071

HCL DevOps Deploy / HCL Launch is susceptible to an information disclosure vulnerability when processing redacted property values. If a deployment is configured with a secure property that starts with certain non-ASCII characters, the redaction engine may fail to mask subsequent ASCII secure valu...

CVE-2026-67071

HCL DevOps Deploy / HCL Launch contains an information disclosure vulnerability in its redaction engine . When a deployment is configured with a secure property that starts with certain non-ASCII characters , the engine may fail to mask subsequent ASCII secure values embedded inside insecure prop...

CVE-2026-67071 HCL DevOps Deploy / HCL Launch is susceptible to an Improper Removal of Sensitive Information Before Storage or Transfer

HCL DevOps Deploy / HCL Launch is susceptible to an information disclosure vulnerability when processing redacted property values. If a deployment is configured with a secure property that starts with certain non-ASCII characters, the redaction engine may fail to mask subsequent ASCII secure valu...

EUVD-2026-82428

HCL DevOps Deploy / HCL Launch is susceptible to an information disclosure vulnerability when processing redacted property values. If a deployment is configured with a secure property that starts with certain non-ASCII characters, the redaction engine may fail to mask subsequent ASCII secure valu...

CVE-2026-67071 HCL DevOps Deploy / HCL Launch is susceptible to an Improper Removal of Sensitive Information Before Storage or Transfer

HCL DevOps Deploy / HCL Launch is susceptible to an information disclosure vulnerability when processing redacted property values. If a deployment is configured with a secure property that starts with certain non-ASCII characters, the redaction engine may fail to mask subsequent ASCII secure valu...

CVE-2026-67071: Improper Removal of Sensitive Information Before Storage or Transfer

HCL DevOps Deploy / HCL Launch is susceptible to an information disclosure vulnerability when processing redacted property values. If a deployment is configured with a secure property that starts with certain non-ASCII characters, the redaction engine may fail to mask subsequent ASCII secure valu...

clawpatrol v0.5.10

clawpatrol The security firewall for agents. Claw Patrol sits between your agents and prod, parses their traffic at the wire, and gates each action against rules you write in HCL. For example, you can block destructive SQL, or pause kubectl delete pod until a human approves it before the request...

CVE-2025-52657

HCL MyXalytics was affected by Potential DOS Vulnerability. It allows users to input data without any restriction on the number of characters which can impact system performance or availability...

CVE-2025-52652

HCL MyXalytics was affected by Content Spoofing Vulnerability. It may allow an attacker to manipulate displayed content, making it appear as though it originates from a trusted source, potentially leading to phishing or data theft...

CVE-2025-52651

HCL MyXalytics was affected by Improper Input validation Vulnerability. It allow malicious or unexpected data to cause unintended system behaviour or security issues...