PatchTheCVE: hcl leaphttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2024-30127: Missing "no cache" headers in HCL Leap permits sensitive data to be cached.https://patchthecve.com/cve/CVE-2024-30127.htmlhttps://patchthecve.com/cve/CVE-2024-30127.htmlWed, 17 Jun 2026 07:26:20 +0000LOW 3.2: Missing "no cache" headers in HCL Leap permits sensitive data to be cached.CVE-2023-37516: Missing "no cache" headers in HCL Leap permits user directory information to be cached.https://patchthecve.com/cve/CVE-2023-37516.htmlhttps://patchthecve.com/cve/CVE-2023-37516.htmlWed, 17 Jun 2026 06:08:21 +0000LOW 3.2: Missing "no cache" headers in HCL Leap permits user directory information to be cached.CVE-2022-44760: Unsafe default file type filter policy in HCL Leap allows execution of unsafe JavaScript in deployed applicatihttps://patchthecve.com/cve/CVE-2022-44760.htmlhttps://patchthecve.com/cve/CVE-2022-44760.htmlWed, 17 Jun 2026 05:08:54 +0000MEDIUM 4.6: Unsafe default file type filter policy in HCL Leap allows execution of unsafe JavaScript in deployed applications.CVE-2022-44759: Improper sanitization of SVG files in HCL Leap allows client-side script injection in deployed applications.https://patchthecve.com/cve/CVE-2022-44759.htmlhttps://patchthecve.com/cve/CVE-2022-44759.htmlWed, 17 Jun 2026 05:08:54 +0000MEDIUM 4.6: Improper sanitization of SVG files in HCL Leap allows client-side script injection in deployed applications.CVE-2024-30147: Multiple vectors in HCL Leap allow client-side script injection in the authoring environment and deployed applhttps://patchthecve.com/cve/CVE-2024-30147.htmlhttps://patchthecve.com/cve/CVE-2024-30147.htmlWed, 17 Jun 2026 07:26:21 +0000MEDIUM 6.5: Multiple vectors in HCL Leap allow client-side script injection in the authoring environment and deployed applications.CVE-2024-30114: Insufficient sanitization in HCL Leap allows client-side script injection in the authoring environment.https://patchthecve.com/cve/CVE-2024-30114.htmlhttps://patchthecve.com/cve/CVE-2024-30114.htmlWed, 17 Jun 2026 07:26:19 +0000LOW 3.7: Insufficient sanitization in HCL Leap allows client-side script injection in the authoring environment.CVE-2024-30113: Insufficient sanitization policy in HCL Leap allows client-side script injection in the deployed application thttps://patchthecve.com/cve/CVE-2024-30113.htmlhttps://patchthecve.com/cve/CVE-2024-30113.htmlWed, 17 Jun 2026 07:26:18 +0000MEDIUM 6.3: Insufficient sanitization policy in HCL Leap allows client-side script injection in the deployed application through the HTML widget.CVE-2023-45720: Insufficient default configuration in HCL Leap allows anonymous access to directory information.https://patchthecve.com/cve/CVE-2023-45720.htmlhttps://patchthecve.com/cve/CVE-2023-45720.htmlWed, 17 Jun 2026 06:29:24 +0000MEDIUM 5.3: Insufficient default configuration in HCL Leap allows anonymous access to directory information.CVE-2023-37534: Insufficient URI protocol whitelist in HCL Leap allows script injection through query parameters.https://patchthecve.com/cve/CVE-2023-37534.htmlhttps://patchthecve.com/cve/CVE-2023-37534.htmlWed, 17 Jun 2026 06:08:23 +0000HIGH 7.1: Insufficient URI protocol whitelist in HCL Leap allows script injection through query parameters.CVE-2024-30148: Improper access control of endpoint in HCL Leap allows certain admin users to import applications from the serhttps://patchthecve.com/cve/CVE-2024-30148.htmlhttps://patchthecve.com/cve/CVE-2024-30148.htmlWed, 17 Jun 2026 07:26:21 +0000MEDIUM 4.1: Improper access control of endpoint in HCL Leap allows certain admin users to import applications from the server's filesystem.