Hcltech Dragon vulnerabilities

2 CVEs affecting Hcltech Dragon, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-63402, published 2025-12-03.

More from Hcltech.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2025-63402, published 2025-12-03. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. An issue in HCL Technologies Limited HCLTech GRAGON before v.7.6.0 allows a remote attacker to execute arbitrary code via APIs do not enforcing limits on the number or size of requests
• CVE-2025-63401, published 2025-12-03. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. Cross Site Scripting vulnerability in HCL Technologies Limited HCLTech DRAGON before v.7.6.0 allows a remote attacker to execute arbitrary code via missing directives