Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-21765 | 7.8 high | 0.00% | hcltech, bigfix_platform | HCL BigFix Platform is affected by insecure permissions on private cryptographic keys. The private cryptographic keys located on a Windows host machine might be subject to overly permissive file system permissions. | Mon 26 Oct |
| CVE-2026-108013 | 6.8 medium | 0.00% | no CPE yet | BigFix Platform uses Mozilla CA certificate bundle (PEM). Versions of the bundle dated before 2026/10/20 still trust certificates whose private keys have been compromised. When BigFix Platform validates servers using such a bundle, an on-path attacker can impersonate remote servers and tamper with files downloaded by the application. The issue is resolved by using bundle version 2026/10/20 or later. The fixed bundle is available starting from BES Support v1520. | Mon 26 Oct |
| CVE-2022-27544 | 6.5 medium | 0.00% | hcltech, bigfix_platform | BigFix Web Reports authorized users may see SMTP credentials in clear text. | 8 Oct |
| CVE-2022-27545 | 5.4 medium | 0.00% | hcltech, bigfix_platform | BigFix Web Reports authorized users may perform HTML injection for the email administrative configuration page. | 8 Oct |
| CVE-2026-21767 | 3.3 low | 0.00% | hcltech, bigfix_platform | HCL BigFix Platform is affected by insufficient authentication. The application might allow users to access sensitive areas of the application without proper authentication. | Mon 26 Oct |
| CVE-2026-21840 | 3.1 low | 0.00% | no CPE yet | HCL BigFix Platform is affected by a user enumeration vulnerability which might allow an attacker, through careful system control and response time monitoring, to perform some level of user enumeration for the BigFix service. | Sat 24 Oct |
6 of 6
Download these 6 as CSV · subscribe to this list.
EPSS scores: 2026-10-28. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.