Product by HCL
Bigfix
41 known vulnerabilities in Bigfix (HCL), 0 of them actively exploited (CISA KEV).
Key figures
41
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
6
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-18963 | Red Hat: Weak Password Recovery Mechanism for Forgotten Password | 9.1 | |
| High | CVE-2026-25639 | Axios affected by Denial of Service via __proto__ Key in mergeConfig | 7.5 | |
| High | CVE-2025-13465 | Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions | 5.3 | |
| High | CVE-2026-39983 | FTP Command Injection via CRLF in basic-ftp | 8.6 | |
| High | CVE-2024-7348 | PostgreSQL relation replacement during pg_dump executes arbitrary SQL | 8.8 | |
| High | CVE-2026-48095 | Mcmilk 7-Zip: Out-of-bounds Write | 8.8 | |
| Critical | CVE-2026-67100 | HCL BigFix Service Management: SQL Injection | 9.8 | |
| High | CVE-2026-3304 | Multer vulnerable to Denial of Service via incomplete cleanup | 7.5 | |
| High | CVE-2026-2359 | Multer vulnerable to Denial of Service via resource exhaustion | 7.5 | |
| High | CVE-2026-41673 | xmldom: Denial of service via uncontrolled recursion in XML serialization | 7.5 | |
| High | CVE-2024-39338 | Axios: Server-Side Request Forgery (SSRF) | 7.5 | |
| High | CVE-2026-41674 | xmldom: XML injection through unvalidated DocumentType serialization | 7.5 | |
| Medium | CVE-2025-4207 | PostgreSQL: Buffer Over-read | 5.9 | |
| Critical | CVE-2026-67101 | HCL BigFix Service Management: Server-Side Request Forgery (SSRF) | 9.3 | |
| High | CVE-2026-67102 | HCL BigFix Service Management: Improper Authorization | 8.1 | |
| High | CVE-2026-41675 | xmldom: XML node injection through unvalidated processing instruction serialization | 7.5 | |
| High | CVE-2026-41672 | xmldom: XML node injection through unvalidated comment serialization | 7.5 | |
| High | CVE-2026-27904 | minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions | 7.5 | |
| High | CVE-2026-67105 | HCL BigFix Service Management: Cleartext Transmission of Sensitive Information | 7.4 | |
| High | CVE-2026-56589 | HCL BigFix Service Management: Cross-site Scripting | 7.2 | |
| High | CVE-2026-67103 | HCL BigFix Service Management: Cross-site Scripting | 7.6 | |
| Medium | CVE-2024-13176 | Timing side-channel in ECDSA signature computation | 4.1 | |
| Medium | CVE-2026-108013 | HCL Software BigFix Platform: security vulnerability | 6.8 | |
| High | CVE-2026-73086 | nanoid: Integer Overflow or Wraparound | 7.4 | |
| Critical | CVE-2026-56592 | HCL BigFix Service Management: Improper Restriction of Excessive Authentication Attempts | 6.5 |
News
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 33sans-atrisk-mail,
- NCSC-2026-0326 [1.00] [M/H] Kwetsbaarheden verholpen in Keycloakncsc-nl,
- Credential Management: N-able Passportal Token Leak; Keycloak Password Reset Flaw; Australian Password Bookssans-newsbites-mail,
- Critical Keycloak Password Reset Flaw Could Let Unauthenticated Attackers Take Over Any Accountthehackernews,