CVE-2026-21821
The HCL BigFix SCM Reporting site contains an outdated and unsupported version of the jQuery 1.x library. Since jQuery 1.x has reached end-of-life and no longer receives security updates, it may expose the application to publicly known security weaknesses and increase the risk of client-side attacks such as Cross-Site Scripting (XSS) or manipulation through vulnerable third-party components.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.3
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
- EPSS probability
- 0.21%
- CWE
- CWE-1104
- Published
- 2026-05-13
- Last modified
- 2026-05-14
Affected products
- HCLSoftware BigFix SCM Reporting
Weakness type
Related vulnerabilities
- CVE-2026-21753 — HCL Hive is affected by multiple security vulnerabilities.
- CVE-2026-12554 — HP Easy Start for macOS - Security Update
- CVE-2026-21752 — HCL Hive is affected by a use of vulnerable third-party components
- CVE-2026-66788 — Lighthouse: dockerfile build stages use end-of-life fedora 40 referenced by mutable tag
- CVE-2026-11325 — cloudflare/pages-action is deprecated — migration required by September 18th, 2026
- CVE-2026-16634 — TOML::XS versions before 0.06 for Perl bundle an unsupported and vulnerable version of tomlc99
- CVE-2026-56580 — HCL MyCloud was affected by Using Components with Known Vulnerability
- CVE-2026-3031 — Image::EPEG versions through 0.15 for Perl embeds an unsupported version of the Epeg library