CVE-2026-67106

MediumCVSS 5.3/10Last modified Oct 5, 2026

Description

HCL BigFix Service Management is affected by an Information Disclosure vulnerability because two exposed API endpoints return sensitive data. This information could enable an attacker to launch further, more serious attacks.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200 CWE-209

Affected software

Vendor	Product	Versions
HCL Software	HCL BigFix Service Management	Version 27

References

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0134015Vendor Advisory

Timeline

Published: Oct 1, 2026
Last modified: Oct 5, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-67116.1The Website LLMs.txt plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and CVE-2026-67124.4The Website LLMs.txt plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and includi CVE-2026-67135.3GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1 CVE-2026-67159.8IBM Concert 1.0 through 3.0.1.1 allows an attacker can supply crafted input that is incorporated into an operating system command without ad CVE-2026-671655.4HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in CVE-2026-671715.3HCL BigFix Service Management is affected by an Information Disclosure vulnerability because an exposed API endpoint exposes sensitive inter CVE-2026-671723.7HCL BigFix Service Management is affected by an Information Disclosure vulnerability the application returns sensitive information in error CVE-2026-671735.1Pivotick did not validate the URL scheme of node imagePath values derived from graph data before assigning them to SVG image resources. An a CVE-2026-671749.2Pivotick contains a DOM-based cross-site scripting vulnerability in its generic UI element resolution and icon-rendering utilities. The try CVE-2026-671754.6Chargemap contains a stored cross-site scripting vulnerability that allows a remote, authenticated attacker to craft a malicious payload in CVE-2026-671765.4Chargemap contains an open redirect vulnerability in the authentication login endpoint. A remote, unauthenticated attacker could send a craf CVE-2026-671775.4Chargemap contains a stored cross site scripting vulnerability. A remote, unauthenticated attacker could craft a payload in the username fie