11
CVEs
6
Critical
3
High
0
KEV
3
PoC
4
Unpatched C/H
63.6%
Patch Rate
0.8%
Avg EPSS
Severity Breakdown
CRITICAL
6
HIGH
3
MEDIUM
0
LOW
2
Monthly CVE Trend
Affected Products (30)
Nessus
52
Tenable Sc
45
Debian Linux
42
Fedora
29
PHP
23
Leap
16
Opensuse
16
Ubuntu Linux
15
Peoplesoft Enterprise Peopletools
15
Nessus Network Monitor
14
OpenSSL
12
Enterprise Manager Ops Center
11
Nessus Agent
11
Jd Edwards Enterpriseone Tools
11
Securitycenter
10
Zfs Storage Appliance Kit
10
Security Center
10
Mysql Workbench
9
Jd Edwards World Security
9
Mysql Enterprise Monitor
9
Oncommand Insight
9
Node.js
9
Log Correlation Engine
9
Clustered Data Ontap
8
Ontap Select Deploy Administration Utility
8
Oncommand Workflow Automation
8
Cloud Backup
7
Active Iq Unified Manager
7
Snapcenter
7
Http Server
7
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-19681 | Authenticated OS command injection in Tenable Security Center allows a low-privileged user to run arbitrary operating system commands by uploading a specially crafted file that is unsafely handled during upload processing. The flaw was reported by Tenable's own research team (advisory tns-2026-22) and carries a CVSS 4.0 base score of 9.4 with high impact on both the vulnerable system and subsequent systems. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low privilege bar (PR:L) combined with full code-execution impact makes this a high-priority patch for internet-facing or shared consoles. | CRITICAL | 9.4 | 2.2% | 84 |
PoC
|
| CVE-2026-19626 | Remote code execution in Tenable Security Center's report-generation subsystem allows an authenticated, non-administrative user to run arbitrary code with the privileges of the service account by submitting crafted input that is unsafely evaluated during server-side report rendering. Because Security Center is itself a centralized vulnerability-management platform holding scan data and credentials for an entire estate, compromise of the service account is high-impact. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV. | CRITICAL | 9.4 | 0.8% | 83 |
PoC
|
| CVE-2026-19682 | OS command injection in Tenable Security Center (formerly Tenable.sc) lets a remote attacker run arbitrary operating-system commands as the service account, yielding full control of the vulnerability-management console. Rated CVSS 9.4 (CVSS 4.0) with high confidentiality, integrity, and availability impact extending to the underlying host. No public exploit identified at time of analysis, and it is not listed in CISA KEV; note the vendor description says 'unauthenticated' while the published CVSS vector carries PR:L, an unresolved discrepancy affecting who can actually trigger it. | CRITICAL | 9.4 | 1.9% | 49 |
|
| CVE-2026-15265 | Arbitrary file write via path traversal in Tenable Agent 11.2.0 and 11.1.3 and earlier lets a privileged attacker escape the intended plugin directory and drop files at attacker-chosen paths, potentially escalating to remote code execution. The flaw is vendor-reported (Tenable TNS-2026-18) and affects the endpoint scanning agent that typically runs with elevated/service privileges. No public exploit identified at time of analysis and it is not listed in CISA KEV. | CRITICAL | 9.4 | 0.4% | 47 |
No patch
|
| CVE-2026-47358 | Server-Side Request Forgery in Tenable Terrascan v1.18.3 and prior allows unauthenticated remote attackers to coerce the server into fetching arbitrary URLs, including file:// URIs that enable local file disclosure. The flaw is triggered when Terrascan runs in server mode and parses uploaded ARM or CloudFormation templates whose templateLink.uri, parametersLink.uri, or AWS::CloudFormation::Stack TemplateURL fields point to attacker-controlled destinations. No public exploit identified at time of analysis, and because Terrascan was archived in August 2023, no patch will ever be released. | CRITICAL | 9.2 | 0.0% | 46 |
No patch
|
| CVE-2026-47357 | Server-Side Request Forgery in Tenable's Terrascan IaC scanner (versions 1.18.3 and prior) lets unauthenticated remote attackers read arbitrary local files and exfiltrate ~/.netrc credentials when the tool runs in server mode. Because Terrascan was archived in August 2023, no vendor patch will ever be released, and the daemon binds to 0.0.0.0 with no authentication by default. No public exploit identified at time of analysis, but the CVSS 4.0 score of 9.2 reflects trivial network-reachable abuse paired with significant confidentiality scope change. | CRITICAL | 9.2 | 0.0% | 46 |
No patch
|
| CVE-2026-19628 | Command injection in Tenable Security Center enables an authenticated administrator to achieve arbitrary OS command execution by embedding shell metacharacters in application configuration values, which are later executed unsanitized when specific backend operations are triggered. The CWE-78 root cause and the PR:H CVSS 4.0 metric confirm exploitation is gated behind administrator-level access, restricting the realistic attacker population to insiders, compromised admin credentials, or post-escalation actors. No public exploit code and no CISA KEV listing have been identified at time of analysis, though Tenable self-reported this via vulnreport@tenable.com and published advisory TNS-2026-22. | HIGH | 8.6 | 2.0% | 45 |
|
| CVE-2026-13007 | Unauthenticated information disclosure in Tenable Identity Exposure versions prior to 3.93.5 allows remote attackers to retrieve cleartext LDAP credentials, SAML configuration, user accounts, and directory settings via API endpoints under /w/api/*. The flaw is compounded by Cache-Control: public response headers that lack a Vary: Cookie directive, allowing reverse proxies and CDNs to cache and re-serve the sensitive data to other unauthenticated requesters. No public exploit identified at time of analysis, but the issue was disclosed by the vendor itself. | HIGH | 8.7 | 0.4% | 44 |
|
| CVE-2026-47356 | Server-Side Request Forgery in Terrascan up to v1.18.3 lets unauthenticated remote attackers coerce the scanner's HTTP client to POST full IaC scan results - along with an attacker-chosen Bearer token in the Authorization header - to any URL supplied via the webhook_url multipart parameter. Because Terrascan was archived by Tenable in August 2023, no vendor patch will be released, leaving every existing server-mode deployment permanently exposed. No public exploit identified at time of analysis and the CVE is not on CISA KEV, but the trivial exploit primitive (a single multipart POST) makes weaponization straightforward. | HIGH | 8.7 | 0.0% | 44 |
No patch
|
| CVE-2026-57587 | SQL injection in Tenable Nessus exposes scan-result databases to exfiltration by any remote unauthenticated attacker who controls the reverse DNS (PTR) records for a host being scanned. When Nessus resolves the hostname of a scanned target via PTR lookup, the returned value is incorporated into a SQL query without adequate sanitization, enabling read-level access to the scan results database. A proof-of-concept is indicated by the CVSS temporal metric (E:P), and Tenable has acknowledged the issue via advisory TNS-2026-17; no public active exploitation (CISA KEV) is confirmed at time of analysis. | LOW | 2.9 | 0.3% | 15 |
|
| CVE-2026-57588 | SQL injection in Tenable Nessus's scan result import functionality allows an attacker to craft a malicious scan file that, when imported by a privileged operator, injects SQL into the scan results database and exfiltrates stored scan data. The attack is entirely dependent on social engineering: the threat actor has no direct access to the Nessus instance and must convince a privileged user to import the weaponized file. A proof-of-concept exists per CVSS temporal indicator E:P, and Tenable has issued an official fix under advisory TNS-2026-17. No active exploitation is confirmed in CISA KEV. | LOW | 1.8 | 0.2% | 9 |
PoC
|