149
CVEs
20
Critical
51
High
3
KEV
39
PoC
28
Unpatched C/H
53.7%
Patch Rate
8.2%
Avg EPSS
Severity Breakdown
CRITICAL
20
HIGH
51
MEDIUM
73
LOW
5
Monthly CVE Trend
Affected Products (30)
Nessus
52
Tenable Sc
45
Debian Linux
42
Fedora
29
PHP
23
Leap
16
Opensuse
16
Ubuntu Linux
15
Peoplesoft Enterprise Peopletools
15
Nessus Network Monitor
14
OpenSSL
12
Enterprise Manager Ops Center
11
Nessus Agent
11
Jd Edwards Enterpriseone Tools
11
Securitycenter
10
Zfs Storage Appliance Kit
10
Security Center
10
Mysql Workbench
9
Jd Edwards World Security
9
Mysql Enterprise Monitor
9
Oncommand Insight
9
Node.js
9
Log Correlation Engine
9
Clustered Data Ontap
8
Ontap Select Deploy Administration Utility
8
Oncommand Workflow Automation
8
Cloud Backup
7
Active Iq Unified Manager
7
Snapcenter
7
Http Server
7
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2019-11043 | In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 99.5% | 233 |
KEV
PoC
No patch
|
| CVE-2021-40438 | A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user.4.48 and earlier. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, no authentication required. This Server-Side Request Forgery (SSRF) vulnerability could allow attackers to make the server perform requests to unintended internal or external resources. | CRITICAL | 9.0 | 100.0% | 215 |
KEV
PoC
|
| CVE-2017-8051 | Tenable Appliance 3.5 - 4.4.0, and possibly prior versions, contains a flaw in the simpleupload.py script in the Web UI. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 53.1%. | CRITICAL | 9.8 | 53.1% | 122 |
PoC
|
| CVE-2021-41182 | jQuery-UI is the official jQuery user interface library. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available. | MEDIUM | 6.1 | 42.2% | 93 |
PoC
|
| CVE-2026-19681 | Authenticated OS command injection in Tenable Security Center allows a low-privileged user to run arbitrary operating system commands by uploading a specially crafted file that is unsafely handled during upload processing. The flaw was reported by Tenable's own research team (advisory tns-2026-22) and carries a CVSS 4.0 base score of 9.4 with high impact on both the vulnerable system and subsequent systems. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low privilege bar (PR:L) combined with full code-execution impact makes this a high-priority patch for internet-facing or shared consoles. | CRITICAL | 9.4 | 2.2% | 84 |
PoC
|
| CVE-2026-19626 | Remote code execution in Tenable Security Center's report-generation subsystem allows an authenticated, non-administrative user to run arbitrary code with the privileges of the service account by submitting crafted input that is unsafely evaluated during server-side report rendering. Because Security Center is itself a centralized vulnerability-management platform holding scan data and credentials for an entire estate, compromise of the service account is high-impact. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV. | CRITICAL | 9.4 | 0.8% | 83 |
PoC
|
| CVE-2022-0778 | The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available. | HIGH | 7.5 | 7.8% | 75 |
PoC
|
| CVE-2021-41184 | jQuery-UI is the official jQuery user interface library. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users. | MEDIUM | 6.1 | 44.5% | 75 |
|
| CVE-2021-44790 | A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available. | CRITICAL | 9.8 | 97.1% | 69 |
PoC
|
| CVE-2020-7059 | When using fgetss() function to read data with stripping tags, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will cause this function. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available. | CRITICAL | 9.1 | 7.1% | 66 |
PoC
|
| CVE-2020-7060 | When using certain mbstring functions to convert multibyte encodings, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will cause. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available. | CRITICAL | 9.1 | 8.9% | 66 |
PoC
|
| CVE-2020-7061 | In PHP versions 7.3.x below 7.3.15 and 7.4.x below 7.4.3, while extracting PHAR files on Windows using phar extension, certain content inside PHAR file could lead to one-byte read past the allocated. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available. | CRITICAL | 9.1 | 4.0% | 66 |
PoC
|
| CVE-2020-7065 | In PHP versions 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while using mb_strtolower() function with UTF-32LE encoding, certain invalid strings could cause PHP to overwrite stack-allocated buffer. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available. | HIGH | 8.8 | 4.8% | 64 |
PoC
|
| CVE-2019-11044 | In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 on Windows, PHP link() function accepts filenames with embedded \0 byte and treats them as terminating at that byte. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 7.5 | 5.1% | 63 |
PoC
No patch
|
| CVE-2019-11050 | When PHP EXIF extension is parsing EXIF information from an image, e.g. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 6.5 | 7.6% | 60 |
PoC
No patch
|