Hcltech Devops Plan vulnerabilities

5 CVEs affecting Hcltech Devops Plan, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-37507, published 2026-07-21.

More from Hcltech.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2023-37507, published 2026-07-21. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. HCL DevOps Plan is susceptible to an information disclosure that can allow an attacker to focus their attacks based upon the information revealed.
• CVE-2026-4096, published 2026-06-11. Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days. IBM DevOps Plan 3.0.0 through 3.0.6 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against…
• CVE-2025-36363, published 2026-03-03. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. IBM DevOps Plan 3.0.0 through 3.0.5 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials.
• CVE-2023-37508, published 2026-07-21. Medium severity, CVSS 6.1. EPSS: 0.2% chance of exploitation in the next 30 days. HCL DevOps Plan is potentially susceptible to Cross-Site Scripting (XSS) which could allow an attacker to exploit this vulnerability if certain browser weaknesses are present.
• CVE-2025-36364, published 2026-03-03. Low severity, CVSS 3.3. EPSS: 0.1% chance of exploitation in the next 30 days. IBM DevOps Plan 3.0.0 through 3.0.5 allows web page cache to be stored locally which can be read by another user on the system.