CVE-2026-21821

HighCVSS 8.3/10Last modified Jun 17, 2026

Description

The HCL BigFix SCM Reporting site contains an outdated and unsupported version of the jQuery 1.x library. Since jQuery 1.x has reached end-of-life and no longer receives security updates, it may expose the application to publicly known security weaknesses and increase the risk of client-side attacks such as Cross-Site Scripting (XSS) or manipulation through vulnerable third-party components.

Metrics

CVSS 3.1 8.3/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-1104

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: May 13, 2026
Last modified: Jun 17, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-218226.3HCLSoftware AppScan 360° was affected by a Path Traversal vulnerability in the ASReportService component. Improper handling of file paths al CVE-2026-218248.8HCL Commerce contains an privilege escalation vulnerability that could allow denial of service, disclosure of user personal data, and perfor CVE-2026-218256.1HCL Digital Experience Compose is affected by a reflected cross-site scripting (XSS) vulnerability in the search center. An attacker could CVE-2026-218266.1HCL Digital Experience and HCL Digital Experience Compose could be susceptible to Host header injection. An attacker can manipulate the Hos CVE-2026-218273.1HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive information they are n CVE-2026-21839.8A security vulnerability has been detected in Great Developers Certificate Generation System up to 97171bb0e5e22e52eacf4e4fa81773e5f3cffb73.CVE-2026-218324.3HCL AION is affected by a vulnerability where indirect prompt injection can lead to HTML injection in rendered output. Injected markup may b CVE-2026-218333.7HCL AION is affected by a vulnerability in which the Content-Security-Policy (CSP) HTTP response header is not configured. CSP helps prevent CVE-2026-218366.5The HCL DominoIQ RAG feature is affected by a Broken Access Control vulnerability. Under certain circumstances, document level access restr CVE-2026-218378.8HCL Digital Experience is affected by an OS command injection vulnerability in the Digital Asset Management API. An attacker may execute ar CVE-2026-21849.8A vulnerability was detected in Great Developers Certificate Generation System up to 97171bb0e5e22e52eacf4e4fa81773e5f3cffb73. This vulnerab CVE-2026-218403.1HCL BigFix Platform is affected by a user enumeration vulnerability which might allow an attacker, through careful system control and respon