CVE-2026-67172

LowCVSS 3.7/10Last modified Oct 6, 2026

Description

HCL BigFix Service Management is affected by an Information Disclosure vulnerability the application returns sensitive information in error messages when invalid inputs are sent to certain API endpoints . This information could enable an attacker to facilitate further attacks.

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200 CWE-209

Affected software

No affected versions have been published.

Timeline

Published: Oct 1, 2026
Last modified: Oct 6, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-671735.1Pivotick did not validate the URL scheme of node imagePath values derived from graph data before assigning them to SVG image resources. An a CVE-2026-671749.2Pivotick contains a DOM-based cross-site scripting vulnerability in its generic UI element resolution and icon-rendering utilities. The try CVE-2026-671787.8MISP installation scripts generated an Apache HTTP virtual-host configuration containing an incorrectly formatted HTTP-to-HTTPS redirect: R CVE-2026-671797.8Genkit does not properly validate host request headers. Any host on the developer's network, and any website the developer visits (via DNS r CVE-2026-67186.2IBM Concert 1.0.0 through 3.0.0 is vulnerable to improper access control which allows unauthorized modification of application files.CVE-2026-671808.4Google Turbinia allows arbitrary command execution via worker tasks. An attacker with privileges to submit a processing request or influence CVE-2026-671815.4Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize HTTP message boun CVE-2026-671827.5Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to bypass access controls by injec CVE-2026-671837.5TinyWeb through 0.0.8 contains a memory leak vulnerability that allows unauthenticated attackers to exhaust available memory by sending ordi CVE-2026-671847.5TinyWeb through 0.0.8 contains a null pointer dereference vulnerability that allows unauthenticated remote attackers to crash worker process CVE-2026-671857.5TinyWeb through 0.0.8 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by submitting ..CVE-2026-671896.1pfSense Plus before 26.07 and pfSense CE through 2.8.1 contain a stored cross-site scripting vulnerability in the Traffic Graphs top-talkers