CVE-2026-67077
Medium · 4.2CVSS
4.2
EPSS
0.1%
Published
Oct 28, 2026
CISA due date
—
The record
HCL BigFix AEX is affected by a Server-Side Request Forgery vulnerability, which could allow an attacker to cause the application to send unauthorized requests to external resources. Successful exploitation could lead to access to unintended services, sensitive information disclosure, or unauthorized actions through the affected application.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-118687 Coder before 2.29.21, 2.30.0 before 2.34.12, 2.35.0 before 2.35.9, 2.36.0 before 2.36.7… CWE-441
- CVE-2026-114612 LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. CWE-441
- CVE-2026-114478 Insufficient preservation of the original sender in the forwarding of Progressive Robot… CWE-441
- CVE-2026-101897 Angular is a development platform for building mobile and desktop web applications using… CWE-441
- CVE-2026-83837 Improper access control in Windows Kernel-Mode Drivers allows an authorized attacker to… CWE-441
- CVE-2026-70148 Improper authorization in Windows Broadcast DVR User Service allows an authorized… CWE-441
- CVE-2026-93320 BuildKit may be tricked into performing file actions with special file inodes where… CWE-441
- CVE-2026-101907 Axios is a promise-based HTTP client for the browser and Node.js. CWE-441