{"id":"CVE-2026-65022","title":"BigFix Mobile is affected by a Cross-site scripting vulnerability","summary":"The MDM App Catalog / App Store preview does not properly sanitize or encode user-supplied HTML before rendering it.  Injected HTML can be displayed to users who view the preview, which may allow cross-site scripting (XSS) when a user in…","severity":"medium","cvss":6.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N","cvssSource":"cna","cwe":["CWE-79"],"vendor":"HCLSoftware","product":"BigFix MCM & Mobile","affected":["bigfix_mcm_mobile <= 3.7"],"published":"2026-11-06","updated":"2026-11-06","sourceUpdated":"2026-11-06T07:50:49.979Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-65022","references":[{"url":"https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0135001"}],"tags":["cve.org"],"ingestedAt":"2026-11-06T08:48:01.712Z","epss":0.00165,"epssPercentile":0.05753,"slug":"CVE-2026-65022","body":"## Overview\n\nThe MDM App Catalog / App Store preview does not properly sanitize or encode user-supplied HTML before rendering it.  Injected HTML can be displayed to users who view the preview, which may allow cross-site scripting (XSS) when a user interacts with the crafted content.\n\n## Affected\n\n- `bigfix_mcm_mobile <= 3.7`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":35,"depthScoreParts":{"impact":34.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}