HCLSoftware Vulnerabilities and Affected Products
Vulnerabilities associated with DevOps Loop.
Products
Clear product- Aftermarket EPC14 vulnerabilities
- MyCloud7 vulnerabilities
- Connections6 vulnerabilities
- DevOps Loop4 vulnerabilities
- IntelliOps Event Management4 vulnerabilities
- BigFix IVR3 vulnerabilities
- HCL DevOps Deploy / HCL Launch3 vulnerabilities
- Traveler for Microsoft Outlook3 vulnerabilities
- BigFix Platform2 vulnerabilities
- BigFix Service Management (SM)2 vulnerabilities
- BigFix WebUI2 vulnerabilities
- DevOps Plan2 vulnerabilities
- DFXServer2 vulnerabilities
- Digital Experience2 vulnerabilities
- HCL BigFix Mobile2 vulnerabilities
- Traveler2 vulnerabilities
- BigFix Cloud Lifecycle Management1 vulnerability
- BigFix Compliance1 vulnerability
- BigFix Remote Control Server1 vulnerability
- BigFix SCM Reporting1 vulnerability
- Commerce1 vulnerability
- DevOps Deploy1 vulnerability
- DFMPro for CATIA1 vulnerability
- DFXAnalytics1 vulnerability
- Digital Experience & DX Compose1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
Insufficient Input Validation in DevOps LoopHCL DevOps Loop is affected by insufficient input validation that allows special characters where they should be restricted. This may result in unintended application behavior under certain conditions. CWE-754Jul 17, 2026 | CVSS3.1v3.1 | EPSS0.153% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Missing HTTP Security Headers in DevOps LoopHCL DevOps Loop is affected by missing HTTP security headers. Missing security headers may reduce browser protections against common web-based attacks such as clickjacking, MIME-type sniffing, and cross-site scripting. CWE-644Jul 17, 2026 | CVSS3.7v3.1 | EPSS0.171% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
CVE-2026-21761MEDIUM | CORS Misconfiguration in DevOps LoopHCL DevOps Loop is affected by a Cross-Origin Resource Sharing (CORS) misconfiguration. Improper CORS configuration may allow unauthorized cross-origin requests, potentially exposing application resources to untrusted domains. CWE-942Jul 17, 2026 | CVSS4.2v3.1 | EPSS0.145% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-21760MEDIUM | Unauthorized Access to Admin Functionality via Forced BrowsingHCL DevOps Loop is affected by an Unauthorized Access to Admin Functionality (Forced Browsing) vulnerability. Improper authorization checks may allow unauthorized users to access restricted administrative functionality by directly accessing protected application endpoints. CWE-425Jul 17, 2026 | CVSS4.6v3.1 | EPSS0.148% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |