CVE-2026-21764
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
The vulnerability in HCL DevOps Loop is caused by insufficient input validation, allowing special characters where they should be restricted. This may result in unintended application behavior under certain conditions.
Risk Assessment
The risk involves potential disruption of application behavior, which could affect data integrity or system stability, potentially enabling injection attacks or other adverse effects.
Recommendation
It is recommended to immediately update HCL DevOps Loop to the latest version containing security fixes and implement additional input validation at the application level.
Other vulnerabilities in HCL DevOps Loop
See all- CVE-2026-21762Low
HCL DevOps Loop is missing HTTP security headers, which reduces browser protections against common web-based attacks such as clickjacking, MIME-type sniffing, and cross-site scripting.
- CVE-2026-21761Medium
CVE-2026-21761 in HCL DevOps Loop is caused by a misconfigured Cross-Origin Resource Sharing (CORS) policy. This flaw may allow unauthorized cross-origin requests, potentially exposing application resources to untrusted domains.
- CVE-2026-21760Medium
HCL DevOps Loop is affected by an Unauthorized Access to Admin Functionality (Forced Browsing) vulnerability. Improper authorization checks may allow unauthorized users to access restricted administrative functionality by directly accessing protected application endpoints.
Original NVD description (English source)
HCL DevOps Loop is affected by insufficient input validation that allows special characters where they should be restricted. This may result in unintended application behavior under certain conditions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS