CVE-2026-21821CWE-1104

HCL BigFix SCM Reporting is affected by vulnerabilities in jQuery

High · published May 13, 2026

CVSS v3.1
8.3
EPSS
0%
Percentile
10.9
In the wild
Unconfirmed
What it is

The HCL BigFix SCM Reporting site contains an outdated and unsupported version of the jQuery 1.x library. Since jQuery 1.x has reached end-of-life and no longer receives security updates, it may expose the application to publicly known security weaknesses and increase the risk of client-side attacks such as Cross-Site Scripting (XSS) or manipulation through vulnerable third-party components.

The record
Technical detail
CVSS v3.1
8.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00212 · 10.9th percentile
Weakness
CWE-1104 · Use of Unmaintained Third Party Components
Published
2026-05-13T19:50Z
EPSS history
Timeline
  • 13 MAY 19:50Z
    HCL BigFix SCM Reporting is affected by vulnerabilities in jQuery
    cvelistv5