Hcengineering vulnerabilities
We track 3 vulnerabilities in Hcengineering products across 2 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on October 16, 2026.
Latest Hcengineering vulnerabilities
- 8.1 High severity
Huly Platform: Missing Authorization
Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to merge arbitrary persons by calling the mergeSpecifiedPersons account RPC. Attackers knowing two person UUIDs can graft attacker-controlled unveri
- 8.5 High severity
platform: Server-Side Request Forgery
Huly Platform through 0.7.426 contains a server-side request forgery vulnerability in the print service due to missing hostname allowlist validation. Authenticated workspace members can supply arbitrary URLs to the print endpoint, which Puppeteer renders and r
- 8.5 High severity
platform: Server-Side Request Forgery
Huly Platform through 0.7.423, fixed in commit 68cbf8a contains an authenticated server-side request forgery vulnerability in the /import endpoint of front pod that allows workspace users to make arbitrary server requests. Attackers can exploit this by supplyi