CVE-2026-56460

MediumCVSS 6.5/10Last modified Oct 25, 2026

Description

HCL DevOps Deploy / HCL Launch could disclose sensitive configurations and secrets to authenticated users in API responses that could be used in further attacks against the system.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-201

Affected software

Vendor	Product	Versions
HCLSoftware	HCL DevOps Deploy / HCL Launch	7.3-7.3.2.18, 8.0-8.0.1.13, 8.1-8.1.2.6, 8.2-8.2.1.0

References

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0131697Vendor Advisory

Timeline

Published: Jul 9, 2026
Last modified: Oct 25, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-56472.4A vulnerability was detected in code-projects Online Shoe Store 1.0. This affects an unknown part of the file /admin/admin_feature.php of th CVE-2026-56487.3A flaw has been found in code-projects Simple Laundry System 1.0. This vulnerability affects unknown code of the file /userfinishregister.ph CVE-2026-56496.3A vulnerability has been found in code-projects Online Application System for Admission 1.0. This issue affects some unknown processing of t CVE-2026-56505.3A vulnerability was found in code-projects Online Application System for Admission 1.0. Impacted is an unknown function of the file /enrollm CVE-2026-56514.9The Askeet plugin for WordPress is vulnerable to SQL Injection via the 'sql_query' parameter in multiple AJAX actions (askeet_execute_sql_qu CVE-2026-56529.0An insecure direct object reference vulnerability in the Users API component of Crafty Controller allows a remote, authenticated attacker to CVE-2026-56537.5DCP-ETSI protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service CVE-2026-565373.5HCL Connections is vulnerable to information disclosure which could allow a user to obtain sensitive information they are not entitled to, c CVE-2026-565383.5An endpoint in HCL Connections is vulnerable to information disclosure. In certain scenarios this might lead to disclosing sensitive informa CVE-2026-56547.5AMR-NB codec crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service CVE-2026-565473.5The Apple profile generated for the Apple built-in Mail, Calendar and Contacts account to synchronize with HCL Traveler requires the Logon N CVE-2026-56557.5SDP protocol dissector crash in Wireshark 4.6.0 to 4.6.4 allows denial of service