Hcltech Devops Velocity vulnerabilities

4 CVEs affecting Hcltech Devops Velocity, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-31991, published 2026-04-13.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-22348, published 2025-01-20. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0. 25 uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve…
CVE-2024-22347, published 2025-01-20. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0. 25 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
CVE-2025-31991, published 2026-04-13. Critical severity, CVSS 9.8. EPSS: 0.2% chance of exploitation in the next 30 days. Rate Limiting for attempting a user login is not being properly enforced, making HCL DevOps Velocity susceptible to brute-force attacks past the unsuccessful login attempt limit. This vulnerability…
CVE-2024-22349, published 2025-01-20. Low severity, CVSS 3.3. EPSS: 0.2% chance of exploitation in the next 30 days. IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0. 25 allows web pages to be stored locally which can be read by another user on the system.