tenable

Latest CVEs · RSS

• CVE-2026-103946 2026-10-14 · CVSS 8.3
  An SQL injection vulnerability could allow an authenticated user to read or modify data stored by Nessus.
• CVE-2026-108125 2026-10-09 · CVSS 7.1
  Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in wp-post-author. This issue affects wp-post-author version
• CVE-2026-108124 2026-10-09 · CVSS 4.9
  Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in wp-post-author. This issue affects wp-post-author before
• CVE-2026-106126 2026-10-08 · CVSS 9.9
  A command injection vulnerability in the Active Directory Events Listener of Tenable Identity Exposure (SaaS) allows an authenticated, low-privileged attacker t
• CVE-2026-92626 2026-09-16 · CVSS 7.5
  Control iD iDSecure versions prior to 4.8.3.0 are affected by an unauthenticated Denial of Service. The /api/dguardintegration/dguardVersion endpoint derefere
• CVE-2026-92625 2026-09-16 · CVSS 7.5
  Control iD iDSecure versions prior to 4.8.3.0 are affected by an unauthenticated Denial of Service. The /api/license/restartService endpoint is reachable with
• CVE-2026-84860 2026-09-16 · CVSS 8.8
  ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authorization Bypass Spring Security gates DWR endpoints by URL path pattern, but DWR itself dispa
• CVE-2026-84859 2026-09-16 · CVSS 6.5
  ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authenticated Blind SQL Injection The /api/events/search endpoint accepts a JSON body containing a
• CVE-2026-84858 2026-09-16 · CVSS 8.8
  ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authenticated Remote Code Execution via Scripting Sandbox Bypass The DWR "DataSourceEditDwr" class
• CVE-2026-83492 2026-08-31 · CVSS 6.9
  Improper input validation vulnerability in Extend Themes Kubio AI Website Builder. This issue affects Kubio AI Website Builder: before 2.9.1.
• CVE-2026-82123 2026-08-28 · CVSS 6.5
  Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Tangible Loops & Logic.
• CVE-2026-19682 2026-08-14 · CVSS 9.9
  A command injection vulnerability exists in Security Center where a remote, unauthenticated attacker could exploit this issue to execute arbitrary commands on t
• CVE-2026-19681 2026-08-14 · CVSS 9.9
  An authenticated command injection vulnerability exists in Security Center related to file upload processing. An attacker could exploit this issue by uploading
• CVE-2026-19680 2026-08-14 · CVSS 7.1
  A SQL injection vulnerability exists in Security Center that could allow an attacker to access unauthorized data from the application's database.
• CVE-2026-19679 2026-08-14 · CVSS 8.8
  An input validation vulnerability exists in Security Center's file upload handling, where insufficient sanitization of uploaded filenames could contribute to a
• CVE-2026-19639 2026-08-14 · CVSS 4.3
  An improper access control vulnerability exists where an authenticated non-administrative application user could potentially view settings outside of their assi
• CVE-2026-19636 2026-08-14 · CVSS 5.3
  An issue was identified in which CSRF tokens were generated using a predictable method, potentially reducing their effectiveness as a security control. This has
• CVE-2026-19635 2026-08-14 · CVSS 8.8
  A local privilege escalation vulnerability exists in Security Center. An attacker with write access to a specific configuration file could achieve arbitrary cod
• CVE-2026-19631 2026-08-14 · CVSS 4.9
  A SQL injection vulnerability exists in Security Center that could allow an authenticated administrator to execute arbitrary SQL queries, potentially resulting
• CVE-2026-19629 2026-08-14 · CVSS 8.1
  A privilege escalation vulnerability exists in Tenable Security Center that allows a user with "Security Manager" role and "manage user" permission on a single
• CVE-2026-19628 2026-08-14 · CVSS 7.2
  A command injection vulnerability exists in Tenable Security Center. An authenticated administrator could modify application configuration values to achieve arb
• CVE-2026-19626 2026-08-14 · CVSS 9.9
  A remote code execution vulnerability exists in Tenable Security Center's report generation functionality. An authenticated, non-administrative user could explo
• CVE-2026-19657 2026-08-12 · CVSS 6.1
  ScadaLTS 2.7.8.1 reflects user-supplied input into an HTML response without sanitization. An unauthenticated attacker who lures a victim into visiting a crafted
• CVE-2026-19656 2026-08-12 · CVSS 9.9
  ScadaLTS 2.7.8.1 exposes a server-side method that lacks authorization checks, allowing any authenticated user (including one holding only low-privilege, read-o
• CVE-2026-19579 2026-08-11 · CVSS 5.3
  Snipe-IT before 8.6.0 contains an authorization bypass (insecure direct object reference) in the asset checkout-request cancellation endpoint. The cancel_by_adm