Updated 9 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

702 results · page 4 of 15

Jun 5, 2026HCL Digital Experience is affected by an OS command injection vulnerability in the Digital Asset Management API.CVE-2026-21837 · Other software · HCLSoftware · reported by psirt@hcl.comHigh 8.7
HCL Digital Experience is affected by an OS command injection vulnerability in the Digital Asset Management API. An attacker may execute arbitrary operating system commands, typically inheriting the privileges of the vulnerable application, which could possibly lead to a complete system takeover and data compromise.
Product
Digital Experience
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Jun 5, 2026HCL Digital Experience and HCL Digital Experience Compose could be susceptible to Host header injection.CVE-2026-21826 · Other software · HCLSoftware · reported by psirt@hcl.comMedium 6.1
HCL Digital Experience and HCL Digital Experience Compose could be susceptible to Host header injection. An attacker can manipulate the Host header and cause the application to behave in unexpected ways.
Product
Digital Experience & DX Compose
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Jun 5, 2026HCL Digital Experience Compose is affected by a reflected cross-site scripting (XSS) vulnerability in the search center.CVE-2026-21825 · Other software · HCLSoftware · reported by psirt@hcl.comMedium 6.1
HCL Digital Experience Compose is affected by a reflected cross-site scripting (XSS) vulnerability in the search center. An attacker could execute arbitrary JavaScript in the victim's browser.
Product
DX Compose
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Jun 4, 2026HCL BigFix Cloud Lifecycle Management is affected by lack of input validation.CVE-2025-62338 · Other software · HCLSoftware · reported by psirt@hcl.comLow 3.3
HCL BigFix Cloud Lifecycle Management is affected by lack of input validation. This low-level flaw allows unauthorized access and may lead to information exposure.
Product
BigFix Cloud Lifecycle Management
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Jun 4, 2026HCL Hive Telco Observability is affected by a Required directives missing from the CSP issue is detected in keycloak component of the web application.CVE-2025-59874 · Other software · HCL · reported by psirt@hcl.comHigh 8.1
HCL Hive Telco Observability is affected by a Required directives missing from the CSP issue is detected in keycloak component of the web application. Missing essential directives can leave a site vulnerable.
Product
Hive
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Jun 4, 2026HCL iControl was affected by Export CSV - CSV Injection vulnerability.CVE-2025-52612 · Other software · HCL · reported by psirt@hcl.comHigh 7.1
HCL iControl was affected by Export CSV - CSV Injection vulnerability. It is vulnerable to a reflected cross-site scripting vulnerability. This was caused by an insufficient sanitation of input parameters. .
Product
iControl
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Jun 4, 2026HCL iControl v4.0.0 was affected by Unhandled Exception - Stack Trace Disclosure vulnerability.CVE-2025-52611 · Other software · HCL · reported by psirt@hcl.comLow 3.1
HCL iControl v4.0.0 was affected by Unhandled Exception - Stack Trace Disclosure vulnerability. The error occurs due to an undefined property being accessed in the application's JavaScript code. Specifically, the code attempts to read the property dashboard key from an object that is undefined. This issue likely stems from one of the following: A missing or improperly initialized object.
Product
iControl
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Jun 4, 2026HCL iControl was affected by Missing Security Headers vulnerability.CVE-2025-52609 · Other software · HCL · reported by psirt@hcl.comLow 3.7
HCL iControl was affected by Missing Security Headers vulnerability. which lead to cross-site scripting (XSS) attacks by enabling the built-in XSS filtering mechanisms of modern web browsers.
Product
iControl
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Jun 4, 2026HCL iControl was affected by Missing Cookie Attributes vulnerability.CVE-2025-52608 · Other software · HCL · reported by psirt@hcl.comLow 3.1
HCL iControl was affected by Missing Cookie Attributes vulnerability. It was observed that the application is missing several critical cookie attributes, including Secure and SameSite. And also path is set to root.
Product
iControl
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Jun 4, 2026HCL iControl was affected by Weak Input Validation vulnerability.CVE-2025-52606 · Other software · HCL · reported by psirt@hcl.comMedium 4.3
HCL iControl was affected by Weak Input Validation vulnerability. This weakness is caused during implementation of an architectural security tactic. Received input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.
Product
iControl
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Jun 2, 2026HCL iReflection Third party vulnerable and outdated components issue was detected in the web applicationCVE-2024-42206 · Other software · HCL · reported by psirt@hcl.comLow 3.1
HCL iReflection Third party vulnerable and outdated components issue was detected in the web application
Product
iReflection
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
May 27, 2026A misconfigured Content Security Policy (CSP) in HCL BigFix Remote Control Server WebUI (versions 10.1.0.0442 and earlier) fails to define directives without faCVE-2026-21785 · Other software · HCLSoftware · reported by psirt@hcl.comMedium 4
A misconfigured Content Security Policy (CSP) in HCL BigFix Remote Control Server WebUI (versions 10.1.0.0442 and earlier) fails to define directives without fallbacks, allowing attackers to bypass intended security restrictions and load unauthorized resources.
Product
BigFix Remote Control Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
May 20, 2026The HCL DominoIQ RAG feature is affected by a Broken Access Control vulnerability.CVE-2026-21836 · Other software · HCLSoftware · reported by psirt@hcl.comMedium 6.5
The HCL DominoIQ RAG feature is affected by a Broken Access Control vulnerability. Under certain circumstances, document level access restrictions will be ignored when determining what data to return from an AI query. This could enable an authenticated attacker to view sensitive data.
Product
DominoIQ
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
May 20, 2026HCL BigFix Service Management (SM) is affected by a security misconfiguration due to a missing or insecure “X-Content-Type-Options” header.CVE-2025-31985 · Other software · HCL · reported by psirt@hcl.comLow 3.7
HCL BigFix Service Management (SM) is affected by a security misconfiguration due to a missing or insecure “X-Content-Type-Options” header. This could allow browsers to perform MIME-type sniffing, potentially causing malicious content to be interpreted and executed incorrectly.
Product
BigFix Service Management (SM)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
May 20, 2026HCL BigFix Service Management (SM) is susceptible to a Configuration – 'Insecure Use of Base Image Version'.CVE-2025-31973 · Other software · HCL · reported by psirt@hcl.comMedium 4
HCL BigFix Service Management (SM) is susceptible to a Configuration – 'Insecure Use of Base Image Version'. Using outdated or insecure base images may introduce known vulnerabilities, potentially increasing the risk of exploitation in the application environment.
Product
BigFix Service Management (SM)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
May 18, 2026HCL Connections contains a broken access control vulnerability that may allow unauthorized user to update data in certain scenarios.CVE-2026-21789 · Other software · HCLSoftware · reported by psirt@hcl.comMedium 4.6
HCL Connections contains a broken access control vulnerability that may allow unauthorized user to update data in certain scenarios.
Product
Connections
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
May 14, 2026HCL AION is affected by a vulnerability where sensitive information may be included in URL parameters.CVE-2025-62317 · Other software · HCL · reported by psirt@hcl.comLow 2.6
HCL AION is affected by a vulnerability where sensitive information may be included in URL parameters. Passing sensitive data in URLs may expose it through browser history, logs, or intermediary systems, potentially leading to unintended information disclosure under certain conditions.
Product
AION
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
May 14, 2026HCL AION is affected by a vulnerability where certain security-related HTTP response headers are not properly configured.CVE-2025-62316 · Other software · HCL · reported by psirt@hcl.comLow 2.3
HCL AION is affected by a vulnerability where certain security-related HTTP response headers are not properly configured. Absence of these headers may reduce the effectiveness of browser-based security controls and could expose the application to limited security risks under specific conditions.
Product
AION
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
May 14, 2026HCL AION is affected by a vulnerability where adequate protections against brute-force attempts are not enforced.CVE-2025-62313 · Other software · HCL · reported by psirt@hcl.comMedium 5.4
HCL AION is affected by a vulnerability where adequate protections against brute-force attempts are not enforced. This may allow repeated authentication attempts, potentially leading to unauthorized access or account compromise under certain conditions.
Product
AION
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
May 14, 2026HCL AION is affected by a vulnerability where basic authorization tokens are used for authentication.CVE-2025-62312 · Other software · HCL · reported by psirt@hcl.comLow 3
HCL AION is affected by a vulnerability where basic authorization tokens are used for authentication. Use of basic authorization mechanisms may expose credentials to potential interception or misuse, especially if not combined with secure transmission practices.
Product
AION
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
May 14, 2026HCL AION is affected by a vulnerability where backend service details may be transmitted over insecure HTTP channels.CVE-2025-62311 · Other software · HCL · reported by psirt@hcl.comMedium 4.3
HCL AION is affected by a vulnerability where backend service details may be transmitted over insecure HTTP channels. This may expose sensitive information to potential interception or unauthorized access during transmission under certain conditions
Product
AION
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
May 14, 2026HCL AION is affected by a vulnerability where encryption is not enforced for certain data transmissions or operations.CVE-2025-62310 · Other software · HCL · reported by psirt@hcl.comMedium 5.4
HCL AION is affected by a vulnerability where encryption is not enforced for certain data transmissions or operations. This may expose sensitive information to potential interception or unauthorized access under specific conditions.
Product
AION
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
May 14, 2026HCL AION is affected by a vulnerability where auto-complete functionality is enabled for certain input fields.CVE-2025-62309 · Other software · HCL · reported by psirt@hcl.comLow 2.6
HCL AION is affected by a vulnerability where auto-complete functionality is enabled for certain input fields. This may allow sensitive information to be stored in the browser, potentially leading to unintended exposure under specific conditions.
Product
AION
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
May 14, 2026HCL AION is affected by a vulnerability where sensitive backend infrastructure details may be exposed.CVE-2025-62308 · Other software · HCL · reported by psirt@hcl.comMedium 5.1
HCL AION is affected by a vulnerability where sensitive backend infrastructure details may be exposed. Exposure of such information could reveal internal system architecture or configuration details, which may potentially assist in further analysis or targeted actions under certain conditions
Product
AION
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
May 14, 2026HCL AION is affected by a vulnerability where certain operations may trigger out-of-band interactions, potentially resulting in unintended disclosure of sensitiCVE-2025-62305 · Other software · HCL · reported by psirt@hcl.comMedium 5.1
HCL AION is affected by a vulnerability where certain operations may trigger out-of-band interactions, potentially resulting in unintended disclosure of sensitive information. Such behaviour may allow exposure of data to external systems under specific conditions.
Product
AION
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
May 13, 2026The HCL BigFix SCM Reporting site contains an outdated and unsupported version of the jQuery 1.x library.CVE-2026-21821 · Other software · HCLSoftware · reported by psirt@hcl.comHigh 8.3
The HCL BigFix SCM Reporting site contains an outdated and unsupported version of the jQuery 1.x library. Since jQuery 1.x has reached end-of-life and no longer receives security updates, it may expose the application to publicly known security weaknesses and increase the risk of client-side attacks such as Cross-Site Scripting (XSS) or manipulation through vulnerable third-party components.
Product
BigFix SCM Reporting
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
May 9, 2026A missing authorization vulnerability in HCL BigFix WebUI allows an authenticated user without proper permissions to view sensitive environmental information viCVE-2025-15634 · Other software · HCLSoftware · reported by psirt@hcl.comMedium 5.3
A missing authorization vulnerability in HCL BigFix WebUI allows an authenticated user without proper permissions to view sensitive environmental information via direct URL access to the unauthorized page.
Product
BigFix WebUI
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
May 9, 2026An improper authorization vulnerability in HCL BigFix WebUI allows an authenticated user without Master Operator privileges to access internal data (site names,CVE-2025-15633 · Other software · HCLSoftware · reported by psirt@hcl.comMedium 5.3
An improper authorization vulnerability in HCL BigFix WebUI allows an authenticated user without Master Operator privileges to access internal data (site names, versions, and configuration variables) and bypass privilege requirements via unprotected endpoints lacking adequate security headers.
Product
BigFix WebUI
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
May 6, 2026HCL BigFix Service Management (SM) is susceptible to a Root File System Not Mounted as Read-Only.CVE-2025-31974 · Other software · HCL Software · reported by psirt@hcl.comLow 3.9
HCL BigFix Service Management (SM) is susceptible to a Root File System Not Mounted as Read-Only. An improperly configured root file system may allow unintended modifications to critical system components, potentially increasing the risk of system compromise or unauthorized changes.
Product
BigFix Service Management (SM)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
May 6, 2026HCL BigFix Service Management (SM) is vulnerable to information exposure due to improper error handling within its reporting module.CVE-2025-31960 · Other software · HCL · reported by psirt@hcl.comMedium 5.3
HCL BigFix Service Management (SM) is vulnerable to information exposure due to improper error handling within its reporting module. It was observed that supplying an invalid or out-of-range value to the consumer_company parameter during a report-viewing request causes the application to trigger an unhandled exception.
Product
BigFix Service Management (SM)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
May 6, 2026HCL BigFix Service Management (SX) is affected by a Broken Access Control vulnerability leading to privilege escalation.CVE-2024-30151 · Other software · HCL · reported by psirt@hcl.comHigh 8.3
HCL BigFix Service Management (SX) is affected by a Broken Access Control vulnerability leading to privilege escalation. This could allow unauthorized users to gain elevated privileges, bypassing intended access restrictions. This may result in exposure of sensitive data or unauthorized system modifications
Product
BigFix Service Management (SM)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
May 6, 2026HCL BigFix Service Management (SM) is affected by use of a vulnerable WSGI Server was identified.CVE-2025-52613 · Other software · HCL · reported by psirt@hcl.comMedium 4.6
HCL BigFix Service Management (SM) is affected by use of a vulnerable WSGI Server was identified. Deploying an outdated or insecure WSGI server may expose the application to known security weaknesses, potentially increasing the risk of exploitation and unauthorized access.
Product
BigFix Service Management (SM)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
May 6, 2026HCL BigFix Service Management (SM) is affected by a security misconfiguration due to a missing or insecure “X-Content-Type-Options” header.CVE-2025-31984 · Other software · HCL · reported by psirt@hcl.comLow 3.7
HCL BigFix Service Management (SM) is affected by a security misconfiguration due to a missing or insecure “X-Content-Type-Options” header. This could allow browsers to perform MIME-type sniffing, potentially causing malicious content to be interpreted and executed incorrectly.
Product
BigFix Service Management (SM)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
May 6, 2026HCL BigFix Service Management (SM) is affected by a security misconfiguration vulnerability due to CSP header.CVE-2025-31983 · Other software · HCL · reported by psirt@hcl.comLow 3.7
HCL BigFix Service Management (SM) is affected by a security misconfiguration vulnerability due to CSP header. This could allow attackers to inject malicious scripts increasing the risk of cross-site scripting (XSS) and potential exposure of sensitive information.
Product
BigFix Service Management (SM)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
May 6, 2026HCL BigFix Service Management (SM) had directories that were not linked or publicly visible but could be accessed directly.CVE-2025-31982 · Other software · HCL Software · reported by psirt@hcl.comLow 3.7
HCL BigFix Service Management (SM) had directories that were not linked or publicly visible but could be accessed directly. This could allow an increased risk of information disclosure or misuse of sensitive functionality.
Product
BigFix Service Management (SM)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
May 6, 2026HCL BigFix Service Management (SM) does not adequately sanitize or safely render spreadsheet files (CSV, XLS, XLSX) before processing or distributing them.CVE-2025-31978 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.6
HCL BigFix Service Management (SM) does not adequately sanitize or safely render spreadsheet files (CSV, XLS, XLSX) before processing or distributing them. An attacker could populate data fields which, when saved to a CSV file, may attempt information exfiltration or other malicious activity when automatically executed by the spreadsheet software. Note that current versions of Excel warn users of untrusted content.
Product
BigFix Service Management (SM)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
May 6, 2026HCL BigFix Service Management (SM) is vulnerable to insufficiently protected credentials for a short duration while communicating with a backend, internal appliCVE-2025-31976 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.8
HCL BigFix Service Management (SM) is vulnerable to insufficiently protected credentials for a short duration while communicating with a backend, internal application which could allow an attacker to potentially misuse them, if exfiltrated. .
Product
BigFix Service Management (SM)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
May 6, 2026HCL BigFix Service Management (SM) is affected by an Information Disclosure – Server Banner issue was identified.CVE-2025-31975 · Other software · HCL · reported by psirt@hcl.comLow 2.6
HCL BigFix Service Management (SM) is affected by an Information Disclosure – Server Banner issue was identified. Exposed server banners may reveal software versions and system details, potentially aiding attackers in targeting known vulnerabilities.
Product
BigFix Service Management (SM)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
May 6, 2026HCL BigFix Service Management (SM) application fails to strip EXIF metadata from uploaded images.CVE-2025-31959 · Other software · HCL Software · reported by psirt@hcl.comLow 3.5
HCL BigFix Service Management (SM) application fails to strip EXIF metadata from uploaded images. This could lead to confidentiality and privacy risks if sensitive location information is unintentionally shared. .
Product
BigFix Service Management (SM)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
May 6, 2026HHCL BigFix Service Management (SM) is affected by a Cross‑Site Request Forgery (CSRF) vulnerability.CVE-2025-31957 · Other software · HCL Software · reported by psirt@hcl.comLow 2.6
HHCL BigFix Service Management (SM) is affected by a Cross‑Site Request Forgery (CSRF) vulnerability. This could lead to unauthorized changes or exposure of sensitive data.
Product
BigFix Service Management (SM)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
May 6, 2026HCL BigFix RunBookAI is affected by a Continued availability of Less-Secure “Input Text” Vulnerability .CVE-2025-62345 · Other software · HCL · reported by psirt@hcl.comLow 2.7
HCL BigFix RunBookAI is affected by a Continued availability of Less-Secure “Input Text” Vulnerability . A component contains a security weakness in its input handling implementation, increasing the risk of misconfiguration and operational errors.
Product
BigFix RunBookAI
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
May 6, 2026HCL BigFix RunBookAI is affected by a Unvalidated Command Input / Potential Command Smuggling vulnerability.CVE-2025-31951 · Other software · HCL · reported by psirt@hcl.comHigh 8.8
HCL BigFix RunBookAI is affected by a Unvalidated Command Input / Potential Command Smuggling vulnerability. A flaw in a component's input handling was identified that could permit unauthorized command execution.
Product
BigFix RunBookAI
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
May 6, 2026HCL DFXAnalytics is affected by an Insecure Security Header Configuration vulnerability where the application utilizes the outdated X-XSS-Protection header, whiCVE-2025-59854 · Other software · HCL · reported by psirt@hcl.comLow 3.1
HCL DFXAnalytics is affected by an Insecure Security Header Configuration vulnerability where the application utilizes the outdated X-XSS-Protection header, which could allow an attacker to exploit browser-specific rendering flaws or bypass security controls that should instead be managed by a robust Content Security Policy (CSP).
Product
DFXAnalytics
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
May 6, 2026HCL DFXAnalytics is affected by an Improper Error Handling vulnerability where the application exposes detailed stack traces in responses, which could allow an CVE-2025-59853 · Other software · HCL · reported by psirt@hcl.comLow 3.1
HCL DFXAnalytics is affected by an Improper Error Handling vulnerability where the application exposes detailed stack traces in responses, which could allow an attacker to gain insights into the application's internal structure, code logic, and environment configurations.
Product
DFXAnalytics
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
May 6, 2026HCL DFXAnalytics is affected by an Insufficient Transport Layer Protection vulnerability where data is transmitted over the network without encryption, which CVE-2025-59852 · Other software · HCL · reported by psirt@hcl.comLow 3.7
HCL DFXAnalytics is affected by an Insufficient Transport Layer Protection vulnerability where data is transmitted over the network without encryption, which could allow an attacker to compromise the confidentiality, integrity, and authentication of sensitive information.
Product
DFXAnalytics
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
May 6, 2026HCL DFXAnalytics is affected by a Using Components with Known Vulnerabilities flaw where the application utilizes unpatched libraries or sub-components, which cCVE-2025-59851 · Other software · HCL · reported by psirt@hcl.comLow 3.7
HCL DFXAnalytics is affected by a Using Components with Known Vulnerabilities flaw where the application utilizes unpatched libraries or sub-components, which could allow an attacker to identify and exploit publicly known security vulnerabilities to gain unauthorized access or compromise the application.
Product
DFXAnalytics
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
May 6, 2026HCL DFXAnalytics is affected by an Insecure Security Header configuration vulnerability where the Content-Security-Policy does not define strict directives for CVE-2025-31970 · Other software · HCL · reported by psirt@hcl.comMedium 5.3
HCL DFXAnalytics is affected by an Insecure Security Header configuration vulnerability where the Content-Security-Policy does not define strict directives for object-src and base-uri, which could allow an attacker to exploit injection vectors such as Cross-Site Scripting (XSS)
Product
DFXAnalytics
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Apr 30, 2026As dhclient is building an environment to pass to dhclient-script, it may need to resize the array of string pointers.CVE-2026-42512 · Other software · FreeBSD · reported by secteam@freebsd.orgHigh 8.1
As dhclient is building an environment to pass to dhclient-script, it may need to resize the array of string pointers. The code which expands the array incorrectly calculates its new size when requesting memory, resulting in a heap buffer overrun. A specially crafted packet can cause dhclient to overrun its buffer of environment entries. This can result in a crash, but it may be possible to leverage this bug to achieve remote code execution.
Product
FreeBSD
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.freebsd.org
Apr 30, 2026The BOOTP file field is written to the lease file without escaping embedded double-quotes, allowing injection of arbitrary dhclient.conf directives.CVE-2026-42511 · Other software · FreeBSD · reported by secteam@freebsd.orgHigh 8.1
The BOOTP file field is written to the lease file without escaping embedded double-quotes, allowing injection of arbitrary dhclient.conf directives. When the lease file is subsequently re-parsed by dhclient, e.g., after a system restart, an attacker-controlled field from the lease is passed to dhclient-script(8), which evaluates it. A rogue DHCP server may be able to execute arbirary code as root on a system running dhclient.
Product
FreeBSD
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.freebsd.org
Apr 21, 2026HCL BigFix Service Management (SM) Discovery is vulnerable to unenforced encryption due to port 80 (HTTP) being open, allowing unencrypted access.CVE-2025-31981 · Other software · HCLSoftware · reported by psirt@hcl.comMedium 5.3
HCL BigFix Service Management (SM) Discovery is vulnerable to unenforced encryption due to port 80 (HTTP) being open, allowing unencrypted access. An attacker with access to the network traffic can sniff packets from the connection and uncover the data.
Product
BigFix Service Management (SM)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.