CVE WatchJul 17, 2026

CVE-2024-23565

HCL Aftermarket EPC is vulnerable to email flooding as the application does not have a proper mail limitation mechanism at Forget Password f

CVSS

5.3

Medium

EPSS

—

KEV

—

Exploit Today

0-100

Published: Jul 17, 2026 · Last modified: Jul 17, 2026 · CWE-799

EPSS · 30d

Not enough EPSS history yet.

Technical description

HCL Aftermarket EPC is vulnerable to email flooding as the application does not have a proper mail limitation mechanism at Forget Password functionality. The actor could b e a human or an automated process such as a virus or bot. This could be used to cause a denial of service, compromise program logic or other consequences.

Official references

support.hcl-software.comhttps://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132294

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-334344.3 MED

11.5%

——3Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 4.6.0 and above, prior to 4.14.5, a logic error in CheckRateLimitsMiddleware.dispatch() causes the /events endpoint rate check to unconditionally overwrite the general rate limit result. When the global max_request_per_minute is exceeded, requests to /events still succeed if the events-specific counter (hardcoded 30/min) has not been reached. This allows event injection into analysisd beyond the admin-configured global rate limit. This issue has been fixed in version 4.14.5.20h