HCL Software HCL Notes vulnerabilities

Latest HCL Software HCL Notes CVEs

Newest publication first

1. CVE-2026-9007 Reflected XSS in HCL Notes

   Published 2026-07-15

   Medium·CVSS 5.5 EPSS 0.44%

   Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in HCL Notes from HCL Software allows reflected Cross-Site Scripting (XSS). Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of another user...

2. CVE-2021-27760 HCL Notes 11.0 - 11.0.1 FP4 Sametime Embedded chat clients are vulnerable to group chats loading script on restart

   Published 2022-05-06

   Medium·CVSS 5.5 EPSS 0.73%

   An issue was discovered in the Sametime chat feature in the Notes 11.0 - 11.0.1 FP4 clients. An authenticated Sametime chat user could cause Remote Code Execution on another chat client by sending a specially formatted message through chat containing Javascript code.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.