Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
28 results
May 20, 2026The HCL DominoIQ RAG feature is affected by a Broken Access Control vulnerability.CVE-2026-21836 · Other software · HCLSoftware · reported by psirt@hcl.comMedium 6.5
The HCL DominoIQ RAG feature is affected by a Broken Access Control vulnerability. Under certain circumstances, document level access restrictions will be ignored when determining what data to return from an AI query. This could enable an authenticated attacker to view sensitive data.
- Product
- DominoIQ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Apr 30, 2025Improper access control of endpoint in HCL Domino Leap allows certain admin users to import applications from the server's filesystem.CVE-2024-30146 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.1
Improper access control of endpoint in HCL Domino Leap allows certain admin users to import applications from the server's filesystem.
- Product
- HCL Domino Leap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Apr 30, 2025Multiple vectors in HCL Domino Volt and Domino Leap allow client-side script injection in the authoring environment and deployed applications.CVE-2024-30145 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.5
Multiple vectors in HCL Domino Volt and Domino Leap allow client-side script injection in the authoring environment and deployed applications.
- Product
- HCL Domino Leap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Apr 30, 2025Insufficient sanitization policy in HCL Leap allows client-side script injection in the deployed application through the HTML widget.CVE-2024-30115 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.3
Insufficient sanitization policy in HCL Leap allows client-side script injection in the deployed application through the HTML widget.
- Product
- HCL Domino Leap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Apr 30, 2025Insufficient default configuration in HCL Leap allows anonymous access to directory information.CVE-2023-45721 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.3
Insufficient default configuration in HCL Leap allows anonymous access to directory information.
- Product
- HCL Domino Leap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Apr 30, 2025Insufficient URI protocol whitelist in HCL Domino Volt and Domino Leap allow script injection through query parameters.CVE-2023-37535 · Other software · HCL Software · reported by psirt@hcl.comHigh 7.1
Insufficient URI protocol whitelist in HCL Domino Volt and Domino Leap allow script injection through query parameters.
- Product
- HCL Domino Leap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Apr 30, 2025Missing "no cache" headers in HCL Leap permits sensitive data to be cached.CVE-2023-37517 · Other software · HCL Software · reported by psirt@hcl.comLow 3.2
Missing "no cache" headers in HCL Leap permits sensitive data to be cached.
- Product
- HCL Domino Leap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Apr 30, 2025Improper sanitization of SVG files in HCL Domino Volt allows client-side script injection in deployed applications.CVE-2022-42450 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.6
Improper sanitization of SVG files in HCL Domino Volt allows client-side script injection in deployed applications.
- Product
- HCL Domino Volt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Apr 30, 2025Unsafe default file type filter policy in HCL Domino Volt allows upload of .html file and execution of unsafe JavaScript in deployed applicationsCVE-2022-42449 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.6
Unsafe default file type filter policy in HCL Domino Volt allows upload of .html file and execution of unsafe JavaScript in deployed applications
- Product
- HCL Domino Volt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Apr 30, 2025Unsafe default file type filter policy in HCL Domino Volt allows upload of .html file and execution of unsafe JavaScript in deployed applications.CVE-2022-27562 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.6
Unsafe default file type filter policy in HCL Domino Volt allows upload of .html file and execution of unsafe JavaScript in deployed applications.
- Product
- HCL Domino Volt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Jul 8, 2024A security vulnerability in HCL Domino could allow disclosure of sensitive configuration information.CVE-2024-23562 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.3
A security vulnerability in HCL Domino could allow disclosure of sensitive configuration information. A remote unauthenticated attacker could exploit this vulnerability to obtain information to launch further attacks against the affected system.
- Product
- Domino Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.comsupport.hcltechsw.com
Feb 28, 2024Internet passwords stored in Person documents in the Domino® Directory created using the "Add Person" action on the People & Groups tab in the Domino® AdministrCVE-2023-37495 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.9
Internet passwords stored in Person documents in the Domino® Directory created using the "Add Person" action on the People & Groups tab in the Domino® Administrator are secured using a cryptographically weak hash algorithm. This could enable attackers with access to the hashed value to determine a user's password, e.g. using a brute force attack. This issue does not impact Person documents created through user registration https://help.hcltechsw.com/domino/10.0.1/admin/conf_userregistration_c.html .
- Product
- HCL Domino Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Sep 8, 2023In some configuration scenarios, the Domino server host name can be exposed.CVE-2023-28010 · Other software · HCL Software · reported by psirt@hcl.comMedium 4
In some configuration scenarios, the Domino server host name can be exposed. This information could be used to target future attacks.
- Product
- HCL Domino Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
May 23, 2023The HCL Domino AppDev Pack IAM service is susceptible to a User Account Enumeration vulnerability.CVE-2023-28015 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.3
The HCL Domino AppDev Pack IAM service is susceptible to a User Account Enumeration vulnerability. During a failed login attempt a difference in messages could allow an attacker to determine if the user is valid or not. The attacker could use this information to focus a brute force attack on valid users.
- Product
- Domino AppDev Pack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Dec 19, 2022HCL Domino is susceptible to a stack based buffer overflow vulnerability in lasr.dll in Micro Focus KeyView.CVE-2022-44754 · Other software · HCL Software · reported by psirt@hcl.comCritical 9.8
HCL Domino is susceptible to a stack based buffer overflow vulnerability in lasr.dll in Micro Focus KeyView. This could allow a remote unauthenticated attacker to crash the application or execute arbitrary code via a crafted Lotus Ami Pro file. This is different from the vulnerability described in CVE-2022-44750. This vulnerability applies to software previously licensed by IBM.
- Product
- Domino
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Dec 19, 2022HCL Domino is susceptible to a stack based buffer overflow vulnerability in wp6sr.dll in Micro Focus KeyView.CVE-2022-44752 · Other software · HCL Software · reported by psirt@hcl.comCritical 9.8
HCL Domino is susceptible to a stack based buffer overflow vulnerability in wp6sr.dll in Micro Focus KeyView. This could allow a remote unauthenticated attacker to crash the application or execute arbitrary code via a crafted WordPerfect file. This vulnerability applies to software previously licensed by IBM.
- Product
- Domino
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Dec 19, 2022HCL Domino is susceptible to a stack based buffer overflow vulnerability in lasr.dll in Micro Focus KeyView.CVE-2022-44750 · Other software · HCL Software · reported by psirt@hcl.comCritical 9.8
HCL Domino is susceptible to a stack based buffer overflow vulnerability in lasr.dll in Micro Focus KeyView. This could allow a remote unauthenticated attacker to crash the application or execute arbitrary code via a crafted Lotus Ami Pro file. This is different from the vulnerability described in CVE-2022-44754. This vulnerability applies to software previously licensed by IBM.
- Product
- Domino
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Nov 4, 2022HCL Domino is susceptible to an information disclosure vulnerability.CVE-2022-38654 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.5
HCL Domino is susceptible to an information disclosure vulnerability. In some scenarios, local calls made on the server to search the Domino directory will ignore xACL read restrictions. An authenticated attacker could leverage this vulnerability to access attributes from a user's person record.
- Product
- HCL Domino
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Nov 4, 2022HCL XPages applications are susceptible to a Cross Site Request Forgery (CSRF) vulnerability.CVE-2022-38660 · Other software · HCL Software · reported by psirt@hcl.comHigh 8.3
HCL XPages applications are susceptible to a Cross Site Request Forgery (CSRF) vulnerability. An unauthenticated attacker could exploit this vulnerability to perform actions in the application on behalf of the logged in user.
- Product
- HCL Domino
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
May 19, 2022HCL Domino is affected by an Insufficient Access Control vulnerability.CVE-2020-4107 · Other software · HCL Software · reported by psirt@hcl.comHigh 8.8
HCL Domino is affected by an Insufficient Access Control vulnerability. An authenticated attacker with local access to the system could exploit this vulnerability to attain escalation of privileges, denial of service, or information disclosure.
- Product
- HCL Domino
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Dec 28, 2020HCL Domino is susceptible to a Denial of Service (DoS) vulnerability due to insufficient validation of input to its public API.CVE-2020-14273 · Other software · Hcltech · reported by psirt@hcl.comHigh 7.5
HCL Domino is susceptible to a Denial of Service (DoS) vulnerability due to insufficient validation of input to its public API. An unauthenticated attacker could could exploit this vulnerability to crash the Domino server.
- Product
- Domino
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Dec 22, 2020HCL Domino v9, v10, v11 is susceptible to an Information Disclosure vulnerability in XPages due to improper error handling of user input.CVE-2020-14270 · Other software · Hcltech · reported by psirt@hcl.comMedium 5.3
HCL Domino v9, v10, v11 is susceptible to an Information Disclosure vulnerability in XPages due to improper error handling of user input. An unauthenticated attacker could exploit this vulnerability to obtain information about the XPages software running on the Domino server.
- Product
- Domino
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Dec 1, 2020HCL Domino is susceptible to a Buffer Overflow vulnerability in DXL due to improper validation of user input.CVE-2020-14260 · Other software · Hcltech · reported by psirt@hcl.comCritical 9.8
HCL Domino is susceptible to a Buffer Overflow vulnerability in DXL due to improper validation of user input. A successful exploit could enable an attacker to crash Domino or execute attacker-controlled code on the server system.
- Product
- Domino
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Dec 1, 2020HCL Domino is susceptible to a lockout policy bypass vulnerability in the ID Vault service.CVE-2020-4128 · Other software · Hcltech · reported by psirt@hcl.comMedium 5.3
HCL Domino is susceptible to a lockout policy bypass vulnerability in the ID Vault service. An unauthenticated attacker could use this vulnerability to mount a brute force attack against the ID Vault service.
- Product
- Domino
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Nov 30, 2020HCL Domino is susceptible to a lockout policy bypass vulnerability in the LDAP service.CVE-2020-4129 · Other software · Hcltech · reported by psirt@hcl.comMedium 5.3
HCL Domino is susceptible to a lockout policy bypass vulnerability in the LDAP service. An unauthenticated attacker could use this vulnerability to mount a brute force attack against the LDAP service. Fixes are available in HCL Domino versions 9.0.1 FP10 IF6, 10.0.1 FP6 and 11.0.1 FP1 and later.
- Product
- HCL Domino
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Nov 30, 2020HCL Domino is susceptible to a Login CSRF vulnerability.CVE-2020-4127 · Other software · Hcltech · reported by psirt@hcl.comMedium 6.5
HCL Domino is susceptible to a Login CSRF vulnerability. With a valid credential, an attacker could trick a user into accessing a system under another ID or use an intranet user's system to access internal systems from the internet. Fixes are available in HCL Domino versions 9.0.1 FP10 IF6, 10.0.1 FP6 and 11.0.1 FP1 and later.
- Product
- HCL Domino
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Nov 21, 2020HCL Domino is susceptible to a Denial of Service vulnerability due to improper validation of user-supplied input, potentially giving an attacker the ability to CVE-2020-14234 · Other software · HCL · reported by psirt@hcl.comHigh 7.5
HCL Domino is susceptible to a Denial of Service vulnerability due to improper validation of user-supplied input, potentially giving an attacker the ability to crash the server. Versions previous to release 9.0.1 FP10 IF6 and release 10.0.1 are affected.
- Product
- HCL Domino
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Nov 21, 2020HCL Domino is susceptible to a Denial of Service vulnerability caused by improper validation of user-supplied input.CVE-2020-14230 · Other software · HCL · reported by psirt@hcl.comHigh 7.5
HCL Domino is susceptible to a Denial of Service vulnerability caused by improper validation of user-supplied input. A remote unauthenticated attacker could exploit this vulnerability using a specially-crafted email message to hang the server. Versions previous to releases 9.0.1 FP10 IF6, 10.0.1 FP5 and 11.0.1 are affected.
- Product
- HCL Domino
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.