CVE-2026-56595

MediumCVSS 4.3/10Last modified Oct 14, 2026

Description

HCL BigFix Service Management is affected by a CORS Misconfiguration vulnerability due to improperly validated origin headers, which could allow an attacker to craft a malicious web page that interacts with the vulnerable application, enabling unauthorized access to protected resources and restricted APIs on behalf of a victim.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-942

Affected software

No affected versions have been published.

Timeline

Published: Sep 18, 2026
Last modified: Oct 14, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-565963.5HCL BigFix Service Management is affected by an Improper Input Validation vulnerability, which could allow an attacker to supply unexpected CVE-2026-565975.3HCL BigFix Service Management is affected by a Sensitive Information Leakage vulnerability, which could allow an unauthenticated attacker to CVE-2026-565992.2HCL BigFix Service Management is affected by an Insecure Cookie Attribute Configuration vulnerability, which could allow an attacker to expl CVE-2026-56606.3A vulnerability was determined in itsourcecode Construction Management System 1.0. The impacted element is an unknown function of the file /CVE-2026-566085.3HCL iControl is affected by Missing Access Control vulnerability. The application failed to enforce proper granular access controls, allowin CVE-2026-566096.5HCL iControl is affected by Weak SSL/TLS Version Supported vulnerability. It was observed that the application was using weak TLS versions s CVE-2026-56615.3A vulnerability was identified in Free5GC 4.2.0. This affects an unknown function of the component NGSetupRequest Handler. Such manipulation CVE-2026-566195.4HCL BigFix Mobile is vulnerable to Reflected Cross-Site Scripting (Reflected XSS) due to insufficient validation and output encoding of user CVE-2026-566204.3HCL BigFix Mobile is vulnerable to information disclosure due to improper handling of exceptions and verbose error reporting.CVE-2026-566237.1Path traversal on Windows in Apache MINA SSHD component sshd-git. Apache MINA SSHD is a Java library for client-side and server-side SSH. CVE-2026-566247.3Improper certificate validation in Apache MINA SSHD (server-side). Apache MINA SSHD is a Java library for client-side and server-side SSH. CVE-2026-56639.8A security flaw has been discovered in OFFIS DCMTK up to 3.7.0. This impacts the function executeOnReception/executeOnEndOfStudy of the file