HCLSoftware
Vulnerability activity for HCLSoftware: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 2
- Critical (CVSS 9+)
- 2
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 2
- Critical (CVSS 9+)
- 2
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 4
- Critical (CVSS 9+)
- 2
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 9.1CriticalOct 27, 2026HCLSoftware Notes Client Crypto / certificateCVE-2026-108015Private keys for eight eMudhra intermediate CA certificates have been compromised https://emudhra.we-have-a-problem.com/ , which impacts certificate trust for outbound network request features of HCL Notes Client. An unauthenticated network attacker could spoof server certificates to execute a man in the middle (MITM) attack, enabling them to intercept and/or modify the content of outbound TLS connections.
- 9.1CriticalOct 27, 2026HCLSoftware Domino Server Crypto / certificateCVE-2026-108014Private keys for eight eMudhra intermediate CA certificates have been compromised https://emudhra.we-have-a-problem.com/ , which impacts certificate trust for outbound network request features of HCL Domino Server. An unauthenticated network attacker could spoof server certificates to execute a man in the middle (MITM) attack, enabling them to intercept and/or modify the content of outbound TLS connections.
- 4.0MediumMay 27, 2026HCLSoftware BigFix Remote Control ServerCVE-2026-21785A misconfigured Content Security Policy (CSP) in HCL BigFix Remote Control Server WebUI (versions 10.1.0.0442 and earlier) fails to define directives without fallbacks, allowing attackers to bypass intended security restrictions and load unauthorized resources.
- 4.6MediumMay 18, 2026HCLSoftware Connections Auth bypass / access controlCVE-2026-21789HCL Connections contains a broken access control vulnerability that may allow unauthorized user to update data in certain scenarios.
Top products
- Notes Client1 CVE in the last year, 1 critical
- Domino Server1 CVE in the last year, 1 critical
- Connections1 CVE in the last year
- BigFix Remote Control Server1 CVE in the last year
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.