CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| CVE-2025-55250 | 中危5.3 | HCL AION version 2 is affected by a Technical Error Disclosure vulnerability. This can expose sensitive technical details, potentially resulting in information disclosure or aiding further attacks. | 19/01/2026 |
| CVE-2025-55251 | 严重9.8 | HCL AION is affected by an Unrestricted File Upload vulnerability. This can allow malicious file uploads, potentially resulting in unauthorized code execution or system compromise. | 19/01/2026 |
| CVE-2025-55249 | 中危5.3 | HCL AION is affected by a Missing Security Response Headers vulnerability. The absence of standard security headers may weaken the application’s overall security posture and increase its susceptibility to common web-based attacks. | 19/01/2026 |
| CVE-2025-52661 | 中危5.3 | HCL AION version 2 is affected by a JWT Token Expiry Too Long vulnerability. This may increase the risk of token misuse, potentially resulting in unauthorized access if the token is compromised. | 19/01/2026 |
| CVE-2025-52660 | 严重9.8 | HCL AION is affected by an Unrestricted File Upload vulnerability. This can allow malicious file uploads, potentially resulting in unauthorized code execution or system compromise. | 19/01/2026 |
| CVE-2025-52659 | 高危7.5 | HCL AION version 2 is affected by a Cacheable HTTP Response vulnerability. This may lead to unintended storage of sensitive or dynamic content, potentially resulting in unauthorized access or information disclosure. | 19/01/2026 |
| CVE-2025-59870 | 严重9.8 | HCL MyXalytics is affected by improper management of a static JWT signing secret in the web application, where the secret lacks rotation , introducing a security risk | 16/01/2026 |
| CVE-2025-31964 | 中危4.9 | Improper service binding configuration in internal service components in HCL BigFix IVR version 4.2 allows a privileged attacker to impact service availability via exposure of administrative services bound to external network interfaces instead of the local authentication interface. | 07/01/2026 |
| CVE-2025-31963 | 低危3.3 | Improper authentication and missing CSRF protection in the local setup interface component in HCL BigFix IVR version 4.2 allows a local attacker to perform unauthorized configuration changes via unauthenticated administrative configuration requests. | 07/01/2026 |
| CVE-2025-31962 | 中危4.3 | Insufficient session expiration in the Web UI authentication component in HCL BigFix IVR version 4.2 allows an authenticated attacker to gain prolonged unauthorized access to protected API endpoints due to excessive expiration periods. | 07/01/2026 |
| CVE-2025-63402 | 中危5.5 | An issue in HCL Technologies Limited HCLTech GRAGON before v.7.6.0 allows a remote attacker to execute arbitrary code via APIs do not enforcing limits on the number or size of requests | 03/12/2025 |
| CVE-2025-63401 | 中危5.5 | Cross Site Scripting vulnerability in HCL Technologies Limited HCLTech DRAGON before v.7.6.0 allows a remote attacker to execute arbitrary code via missing directives | 03/12/2025 |
| CVE-2025-51736 | 中危6.3 | File upload vulnerability in HCL Technologies Ltd. Unica 12.0.0. | 28/11/2025 |
| CVE-2025-51735 | 高危7.5 | CSV formula injection vulnerability in HCL Technologies Ltd. Unica 12.0.0. | 28/11/2025 |
| CVE-2025-51734 | 中危5.4 | Cross-site scripting (XSS) vulnerability in HCL Technologies Ltd. Unica 12.0.0. | 28/11/2025 |
| CVE-2025-51733 | 中危5.5 | Cross-Site Request Forgery (CSRF) vulnerability in HCL Technologies Ltd. Unica 12.0.0. | 28/11/2025 |
| CVE-2025-52639 | 中危6.5 | HCL Connections is vulnerable to a sensitive information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitled to, caused by improper rendering of application data. | 18/11/2025 |