13
CVEs
4
Critical
6
High
0
KEV
0
PoC
1
Unpatched C/H
92.3%
Patch Rate
0.7%
Avg EPSS
Severity Breakdown
CRITICAL
4
HIGH
6
MEDIUM
3
LOW
0
Monthly CVE Trend
Affected Products (4)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-64879 | OS command injection in Tenable Security Center (Tenable.sc) lets an authenticated attacker execute arbitrary shell commands by uploading an audit file whose filename contains shell metacharacters, which the application passes unsanitized into a system command. The flaw (CWE-78) carries a CVSS 4.0 base score of 9.4 with high impact to confidentiality, integrity, and availability of both the vulnerable and subsequent systems. There is no public exploit identified at time of analysis and it is not listed in CISA KEV. | CRITICAL | 9.4 | 2.6% | 50 |
No patch
|
| CVE-2026-64878 | Authenticated remote code execution in Tenable Security Center allows an attacker to inject shell metacharacters through asset filter parameters on the Analysis REST endpoint, breaking out of command argument handling to run arbitrary commands as a low-privileged OS user. The CVSS 4.0 base score of 9.4 reflects high confidentiality, integrity, and availability impact plus a scope change to subsequent systems, though exploitation requires low-level authenticated access (PR:L). There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV. | CRITICAL | 9.4 | 0.5% | 48 |
|
| CVE-2026-64877 | SQL injection in the ticketing REST API of Tenable Security Center (versions before 6.8.0) allows an authenticated non-admin user to read sensitive information from the underlying appliance database. Because any low-privileged authenticated account can trigger it over the network, the flaw effectively collapses the product's internal privilege boundaries and exposes vulnerability, asset, and configuration data held by the appliance. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the vendor (Tenable) has released a fixed version. | CRITICAL | 9.4 | 0.2% | 47 |
|
| CVE-2026-18667 | Remote code execution in Tenable Sensor Proxy (versions before 1.4.2) lets an attacker run code with elevated privileges by luring an operator into connecting the sensor to an attacker-controlled host. The CWE-94 code-injection flaw is triggered during that connection, and the CVSS 4.0 score of 9.3 reflects full compromise of confidentiality, integrity, and availability on the proxy host. There is no public exploit identified at time of analysis and it is not on CISA KEV, but a vendor patch is available. | CRITICAL | 9.3 | 0.4% | 47 |
|
| CVE-2026-19679 | Command injection in Tenable Security Center's file upload handler allows an authenticated low-privilege network attacker to execute arbitrary OS commands on the underlying server. The root cause is insufficient sanitization of user-supplied filenames before they are passed to a downstream shell-invocable operation, classified under CWE-78. With a CVSS base score of 8.8 and full confidentiality, integrity, and availability impact, this represents a serious privilege escalation path within a product that itself manages vulnerability data across enterprise environments. No public exploit code or CISA KEV listing has been identified at time of analysis. | HIGH | 8.7 | 1.6% | 45 |
|
| CVE-2026-64881 | OS command injection in Tenable Security Center (formerly Tenable.sc) lets authenticated users abuse the audit file upload handler, which fails to sanitize filenames and lets shell metacharacters reach a system command call. Rated CVSS 4.0 8.7 (High), the flaw is described as reaching full command execution when chained with a related vulnerability, giving an attacker code execution on the appliance. No public exploit identified at time of analysis, and it is not listed in CISA KEV. | HIGH | 8.7 | 1.4% | 45 |
|
| CVE-2026-19629 | Privilege escalation in Tenable Security Center allows an authenticated Security Manager to manage users outside their authorized group scope, bypassing the platform's intended group-based access controls. The flaw affects all Security Center versions prior to 6.9.0 and is exploitable over the network by any user holding the Security Manager role with at least one 'manage user' permission grant. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, though the vendor has self-reported it and released a patch via advisory TNS-2026-22. | HIGH | 8.6 | 0.4% | 43 |
|
| CVE-2026-19635 | Command injection (CWE-78) in Tenable Security Center versions prior to 6.9.0 enables a local attacker with write access to a specific configuration file to achieve arbitrary code execution at elevated privilege levels, with no user interaction required after file modification. Self-disclosed by Tenable and remediated in Security Center 6.9.0, as documented in advisory TNS-2026-22. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog at time of analysis. | HIGH | 8.5 | 0.2% | 43 |
|
| CVE-2026-19680 | SQL injection in Tenable Security Center exposes unauthorized database records to authenticated low-privilege users over the network. The CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N vector confirms straightforward network exploitation with high confidentiality impact and limited integrity exposure. No public exploit code or CISA KEV listing has been identified at time of analysis; the vendor has published advisory TNS-2026-22. | HIGH | 7.1 | 0.3% | 36 |
|
| CVE-2026-64880 | Blind SQL injection in Tenable Security Center (formerly Tenable.sc/SecurityCenter) lets an authenticated, low-privileged user manipulate report filtering parameters to read unauthorized data from the backend database. Because the vulnerable manager aggregates vulnerability, asset, and scan data across the enterprise, a successful attacker can exfiltrate sensitive security posture information belonging to other users and organizations. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; it was self-reported by Tenable under advisory TNS-2026-19. | HIGH | 7.1 | 0.2% | 36 |
|
| CVE-2026-19631 | SQL injection in Tenable Security Center permits an authenticated administrator to execute arbitrary SQL queries against the underlying database, exposing sensitive data including stored credentials. The CVSS vector (PR:H) confirms exploitation requires existing administrator-level access, placing this squarely in the insider threat and compromised-admin scenario space. No public exploit code or active exploitation has been identified at time of analysis, but the 'Authentication Bypass' tag signals that extracted credentials could enable downstream privilege escalation or lateral movement into connected systems managed by Security Center. | MEDIUM | 6.9 | 0.4% | 35 |
|
| CVE-2026-19636 | Predictable CSRF token generation in Tenable Security Center allows a network-accessible attacker to forge authenticated requests on behalf of a victim user, resulting in high-integrity impact with no confidentiality or availability loss. The CWE-1270 root cause - generation of incorrect security tokens - means the anti-CSRF control was structurally weakened by insufficient entropy, not absent; attackers who can observe or predict token patterns can bypass it. No public exploit code or CISA KEV listing has been identified at time of analysis; Tenable has released a fix documented in advisory TNS-2026-22. | MEDIUM | 6.0 | 0.3% | 30 |
|
| CVE-2026-19639 | Improper access control in Tenable Security Center enables authenticated non-administrative users to read application settings that fall outside their assigned organizational or role-based scope, constituting an unauthorized information disclosure. The vulnerability requires only a low-privileged authenticated account and is exploitable over a network with no user interaction or special triggering conditions, per the CVSS 4.0 vector (AV:N/AC:L/PR:L). No public exploit code has been identified and Tenable has published advisory TNS-2026-22; the CVSS 4.0 score of 5.3 (Medium) reflects the limited, read-only nature of the exposure. | MEDIUM | 5.3 | 0.3% | 27 |
|