Tenable
98 CVEs across 35 Tenable products. Browse Tenable vulnerabilities, severities, and proof-of-concept exploits.
Tenable products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-15265 | Critical | 9.1 | 2026-07-14 | A path traversal vulnerability in Tenable Agent 11.2.0 and 11.1.3 and lower allows a privileged attacker to write arbitrary files outside the intended plugin d… |
CVE-2026-57588 | Low | 3.3 | 2026-06-25 | A SQL injection vulnerability in Nessus allows an attacker to craft a malicious scan result file that, when imported by a privileged user, injects malicious SQ… |
CVE-2026-57587 | Medium | 5.3 | 2026-06-25 | A SQL injection vulnerability in Nessus allows a remote, unauthenticated attacker who controls reverse DNS records for a scanned host to inject malicious SQL i… |
CVE-2026-13007 | High | 7.5 | 2026-06-23 | Tenable Identity Exposure contains multiple unauthenticated API endpoints under /w/api/* that expose sensitive application configuration data including clearte… |
CVE-2026-47358 | High | 7.5 | 2026-05-19 | Terrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery (SSRF) via external URL resolution in uploaded IaC templates when running in server m… |
CVE-2026-47357 | High | 7.5 | 2026-05-19 | Terrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery (SSRF) via the remote_url parameter in the remote directory scan endpoint (POST /v1/{… |
CVE-2026-47356 | High | 7.5 | 2026-05-19 | Terrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery (SSRF) via the webhook_url parameter in the file scan endpoint (POST /v1/{iac}/{iacVe… |
CVE-2026-2698 | Medium | 6.5 | 2026-02-23 | An improper access control vulnerability exists where an authenticated user could access areas outside of their authorized scope. |
CVE-2026-2697 | Medium | 6.3 | 2026-02-23 | An Indirect Object Reference (IDOR) in Security Center allows an authenticated remote attacker to escalate privileges via the 'owner' parameter. |
CVE-2026-2630 | High | 8.8 | 2026-02-17 | A Command Injection vulnerability exists where an authenticated, remote attacker could execute arbitrary code on the underlying server where Tenable Security C… |
CVE-2026-2026 | Medium | 6.1 | 2026-02-13 | A vulnerability has been identified where weak file permissions in the Nessus Agent directory on Windows hosts could allow unauthorized access, potentially per… |
CVE-2025-36640 | High | 8.8 | 2026-01-13 | A vulnerability has been identified in the installation/uninstallation of the Nessus Agent Tray App on Windows Hosts which could lead to escalation of privileg… |
CVE-2025-36636 | Medium | 4.3 | 2025-10-08 | In Tenable Security Center versions prior to 6.7.0, an improper access control vulnerability exists where an authenticated user could access areas outside of t… |
CVE-2025-36630 | High | 8.4 | 2025-07-02 | In Tenable Nessus versions prior to 10.8.5 on a Windows host, it was found that a non-administrative user could overwrite arbitrary local system files with log… |
CVE-2025-36632 | High | 7.8 | 2025-06-16 | In Tenable Agent versions prior to 10.8.5 on a Windows host, it was found that a non-administrative user could execute code with SYSTEM privilege. |
CVE-2025-36633 | High | 8.8 | 2025-06-13 | In Tenable Agent versions prior to 10.8.5 on a Windows host, it was found that a non-administrative user could arbitrarily delete local system files with SYSTE… |
CVE-2025-36631 | High | 8.4 | 2025-06-13 | In Tenable Agent versions prior to 10.8.5 on a Windows host, it was found that a non-administrative user could overwrite arbitrary local system files with log… |
CVE-2025-24917 | High | 7.8 | 2025-05-23 | In Tenable Network Monitor versions prior to 6.5.1 on a Windows host, it was found that a non-administrative user could stage files in a local directory to run… |
CVE-2025-24916 | High | 7.0 | 2025-05-23 | When installing Tenable Network Monitor to a non-default location on a Windows host, Tenable Network Monitor versions prior to 6.5.1 did not enforce secure per… |
CVE-2025-36625 | Medium | 4.3 | 2025-04-18 | In Nessus versions prior to 10.8.4, a non-authenticated attacker could alter Nessus logging entries by manipulating http requests to the application. |
CVE-2025-24914 | High | 7.8 | 2025-04-18 | When installing Nessus to a non-default location on a Windows host, Nessus versions prior to 10.8.4 did not enforce secure permissions for sub-directories. Thi… |
CVE-2025-24915 | High | 7.8 | 2025-03-21 | When installing Nessus Agent to a non-default location on a Windows host, Nessus Agent versions prior to 10.8.3 did not enforce secure permissions for sub-dire… |
CVE-2025-1091 | Medium | 4.3 | 2025-02-26 | A Broken Authorization schema exists where any authenticated user could download IOA script and configuration files if the URL is known. |
CVE-2025-0760 | Low | 2.7 | 2025-02-26 | A Credential Disclosure vulnerability exists where an administrator could extract the stored SMTP account credentials due to lack of encryption. |
CVE-2024-12174 | Low | 2.7 | 2024-12-09 | An Improper Certificate Validation vulnerability exists in Tenable Security Center where an authenticated, privileged attacker could intercept email messages s… |
CVE-2024-9158 | High | 8.4 | 2024-09-30 | A stored cross site scripting vulnerability exists in Nessus Network Monitor where an authenticated, privileged local attacker could inject arbitrary code into… |
CVE-2024-3232 | High | 7.6 | 2024-07-16 | A formula injection vulnerability exists in Tenable Identity Exposure where an authenticated remote attacker with administrative privileges could manipulate ap… |
CVE-2024-5759 | Medium | 5.4 | 2024-06-12 | An improper privilege management vulnerability exists in Tenable Security Center where an authenticated, remote attacker could view unauthorized objects and la… |
CVE-2024-1891 | Low | 3.5 | 2024-06-12 | A stored cross site scripting vulnerability exists in Tenable Security Center where an authenticated, remote attacker could inject HTML code into a web applica… |
CVE-2024-3292 | High | 8.2 | 2024-05-17 | A race condition vulnerability exists where an authenticated, local attacker on a Windows Nessus Agent host could modify installation parameters at installatio… |
CVE-2024-3291 | High | 7.8 | 2024-05-17 | When installing Nessus Agent to a directory outside of the default location on a Windows host, Nessus Agent versions prior to 10.6.4 did not enforce secure per… |
CVE-2024-3290 | High | 8.2 | 2024-05-17 | A race condition vulnerability exists where an authenticated, local attacker on a Windows Nessus host could modify installation parameters at installation time… |
CVE-2024-3289 | High | 7.8 | 2024-05-17 | When installing Nessus to a directory outside of the default location on a Windows host, Nessus versions prior to 10.7.3 did not enforce secure permissions for… |
CVE-2024-2390 | High | 7.8 | 2024-03-18 | As a part of Tenable’s vulnerability disclosure program, a vulnerability in a Nessus plugin was identified and reported. This vulnerability could allow a mali… |
CVE-2024-1683 | High | 7.3 | 2024-02-23 | A DLL injection vulnerability exists where an authenticated, low-privileged local attacker could modify application files on the TIE Secure Relay host, which… |
CVE-2024-1471 | Medium | 5.9 | 2024-02-14 | An HTML injection vulnerability exists where an authenticated, remote attacker with administrator privileges on the Security Center application could modify R… |
CVE-2024-1367 | High | 7.2 | 2024-02-14 | A command injection vulnerability exists where an authenticated, remote attacker with administrator privileges on the Security Center application could modify… |
CVE-2024-0971 | Medium | 6.5 | 2024-02-07 | A SQL injection vulnerability exists where an authenticated, low-privileged remote attacker could potentially alter scan DB content. |
CVE-2024-0955 | Medium | 4.8 | 2024-02-07 | A stored XSS vulnerability exists where an authenticated, remote attacker with administrator privileges on the Nessus application could alter Nessus proxy set… |
CVE-2023-6178 | Medium | 6.8 | 2023-11-20 | An arbitrary file write vulnerability exists where an authenticated attacker with privileges on the managing application could alter Nessus Rules variables to… |
CVE-2023-6062 | Medium | 6.8 | 2023-11-20 | An arbitrary file write vulnerability exists where an authenticated, remote attacker with administrator privileges on the Nessus application could alter Nessu… |
CVE-2023-5847 | Medium | 6.7 | 2023-11-01 | Under certain conditions, a low privileged attacker could load a specially crafted file during installation or upgrade to escalate privileges on Windows and L… |
CVE-2023-5624 | High | 7.2 | 2023-10-26 | Under certain conditions, Nessus Network Monitor was found to not properly enforce input validation. This could allow an admin user to alter parameters that c… |
CVE-2023-5623 | High | 7.0 | 2023-10-26 | NNM failed to properly set ACLs on its installation directory, which could allow a low privileged user to run arbitrary code with SYSTEM privileges where NNM… |
CVE-2023-5622 | High | 7.1 | 2023-10-26 | Under certain conditions, Nessus Network Monitor could allow a low privileged user to escalate privileges to NT AUTHORITY\SYSTEM on Windows hosts by replacing… |
CVE-2023-3253 | Medium | 4.3 | 2023-08-29 | An improper authorization vulnerability exists where an authenticated, low privileged remote attacker could view a list of all the users available in the app… |
CVE-2023-3252 | Medium | 6.8 | 2023-08-29 | An arbitrary file write vulnerability exists where an authenticated, remote attacker with administrator privileges could alter logging variables to overwrite… |
CVE-2023-3251 | Medium | 4.1 | 2023-08-29 | A pass-back vulnerability exists where an authenticated, remote attacker with administrator privileges could uncover stored SMTP credentials within the Nessus… |
CVE-2023-2005 | Medium | 6.3 | 2023-06-26 | Vulnerability in Tenable Tenable.Io, Tenable Nessus, Tenable Security Center.This issue affects Tenable.Io: before Plugin Feed ID #202306261202 ; Nessus: befor… |
CVE-2022-4313 | High | 8.8 | 2023-03-15 | A vulnerability was reported where through modifying the scan variables, an authenticated user in Tenable products, that has Scan Policy Configuration roles, c… |
CVE-2023-0524 | High | 8.8 | 2023-02-01 | As part of our Security Development Lifecycle, a potential privilege escalation issue was identified internally. This could allow a malicious actor with suffic… |
CVE-2023-24495 | Medium | 6.5 | 2023-01-26 | A Server Side Request Forgery (SSRF) vulnerability exists in Tenable.sc due to improper validation of session & user-accessible input data. A privileged, authe… |
CVE-2023-24494 | Medium | 5.4 | 2023-01-26 | A stored cross-site scripting (XSS) vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning it to users. An authe… |
CVE-2023-24493 | Medium | 5.7 | 2023-01-26 | A formula injection vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning it to users. An authenticated attacke… |
CVE-2023-0476 | Medium | 6.5 | 2023-01-26 | A LDAP injection vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning it to users. An authenticated attacker c… |
CVE-2023-0101 | High | 8.8 | 2023-01-20 | A privilege escalation vulnerability was identified in Nessus versions 8.10.1 through 8.15.8 and 10.0.0 through 10.4.1. An authenticated attacker could potenti… |
CVE-2022-3499 | Medium | 6.5 | 2022-10-31 | An authenticated attacker could utilize the identical agent and cluster node linking keys to potentially allow for a scenario where unauthorized disclosure of… |
CVE-2022-33757 | Medium | 6.5 | 2022-10-25 | An authenticated attacker could read Nessus Debug Log file attachments from the web UI without having the correct privileges to do so. This may lead to the dis… |
CVE-2022-28291 | Medium | 6.5 | 2022-10-17 | Insufficiently Protected Credentials: An authenticated user with debug privileges can retrieve stored Nessus policy credentials from the “nessusd” process in c… |
CVE-2022-32974 | Medium | 6.5 | 2022-06-21 | An authenticated attacker could read arbitrary files from the underlying operating system of the scanner using a custom crafted compliance audit file without p… |
CVE-2022-32973 | High | 8.8 | 2022-06-21 | An authenticated attacker could create an audit file that bypasses PowerShell cmdlet checks and executes commands with administrator privileges. |
CVE-2022-24828 | High | 8.3 | 2022-04-13 | Composer is a dependency manager for the PHP programming language. Integrators using Composer code to call `VcsDriver::getFileContent` can have a code injectio… |
CVE-2022-24785 | High | 7.5 | 2022-04-04 | Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users o… |
CVE-2022-0778 | High | 7.5 | 2022-03-15 | The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this functi… |
CVE-2022-23990 | High | 7.5 | 2022-01-26 | Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function. |
CVE-2022-23852 | Critical | 9.8 | 2022-01-24 | Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES. |
CVE-2022-0130 | High | 8.1 | 2022-01-14 | Tenable.sc versions 5.14.0 through 5.19.1 were found to contain a remote code execution vulnerability which could allow a remote, unauthenticated attacker to e… |
CVE-2022-22827 | High | 8.8 | 2022-01-10 | storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. |
CVE-2022-22826 | High | 8.8 | 2022-01-10 | nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. |
CVE-2022-22825 | High | 8.8 | 2022-01-10 | lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. |
CVE-2022-22824 | Critical | 9.8 | 2022-01-10 | defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. |
CVE-2022-22823 | Critical | 9.8 | 2022-01-10 | build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. |
CVE-2022-22822 | Critical | 9.8 | 2022-01-10 | addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. |
CVE-2021-46143 | High | 8.1 | 2022-01-06 | In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize. |
CVE-2021-45960 | High | 8.8 | 2022-01-01 | In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., alloca… |
CVE-2021-44790 | Critical | 9.8 | 2021-12-20 | A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is… |
CVE-2021-44224 | High | 8.2 | 2021-12-20 | A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward… |
CVE-2021-21707 | Medium | 5.3 | 2021-11-29 | In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, certain XML parsing functions, like simplexml_load_file(), URL-decode the filena… |
CVE-2021-20135 | Medium | 6.7 | 2021-11-03 | Nessus versions 8.15.2 and earlier were found to contain a local privilege escalation vulnerability which could allow an authenticated, local administrator to… |
CVE-2021-41184 | Medium | 6.5 | 2021-10-26 | jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from untrust… |
CVE-2021-41183 | Medium | 6.5 | 2021-10-26 | jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various `*Text` options of the Datepicker widget from… |
CVE-2021-41182 | Medium | 6.5 | 2021-10-26 | jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `altField` option of the Datepicker widget from un… |
CVE-2021-41116 | High | 8.2 | 2021-10-05 | Composer is an open source dependency manager for the PHP language. In affected versions windows users running Composer to install untrusted dependencies are s… |
CVE-2021-40438 | Critical | 9.0 | 2021-09-16 | A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4… |
CVE-2021-34798 | High | 7.5 | 2021-09-16 | Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier. |
CVE-2021-20118 | Medium | 6.7 | 2021-09-09 | Nessus Agent 8.3.0 and earlier was found to contain a local privilege escalation vulnerability which could allow an authenticated, local administrator to run s… |
CVE-2021-20117 | Medium | 6.7 | 2021-09-09 | Nessus Agent 8.3.0 and earlier was found to contain a local privilege escalation vulnerability which could allow an authenticated, local administrator to run s… |
CVE-2021-3712 | High | 7.4 | 2021-08-24 | ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buf… |
CVE-2021-3711 | Critical | 9.8 | 2021-08-24 | In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function… |
CVE-2021-33193 | High | 7.5 | 2021-08-16 | A crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead to request splitting or cache poisoning. This issue a… |
CVE-2021-20106 | Medium | 6.5 | 2021-07-21 | Nessus Agent versions 8.2.5 and earlier were found to contain a privilege escalation vulnerability which could allow a Nessus administrator user to upload a sp… |
CVE-2021-20079 | Medium | 6.7 | 2021-06-29 | Nessus versions 8.13.2 and earlier were found to contain a privilege escalation vulnerability which could allow a Nessus administrator user to upload a special… |
CVE-2021-20100 | Medium | 6.7 | 2021-06-28 | Nessus Agent 8.2.4 and earlier for Windows were found to contain multiple local privilege escalation vulnerabilities which could allow an authenticated, local… |
CVE-2021-20099 | Medium | 6.7 | 2021-06-28 | Nessus Agent 8.2.4 and earlier for Windows were found to contain multiple local privilege escalation vulnerabilities which could allow an authenticated, local… |
CVE-2021-23358 | Low | 3.3 | 2021-03-29 | The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, pa… |
CVE-2021-3450 | High | 7.4 | 2021-03-25 | The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting from… |
CVE-2021-3449 | Medium | 5.9 | 2021-03-25 | An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the… |
CVE-2021-20077 | Medium | 6.7 | 2021-03-19 | Nessus Agent versions 7.2.0 through 8.2.2 were found to inadvertently capture the IAM role security token on the local host during initial linking of the Nessu… |
CVE-2021-21371 | Medium | 5.0 | 2021-03-10 | Tenable for Jira Cloud is an open source project designed to pull Tenable.io vulnerability data, then generate Jira Tasks and sub-tasks based on the vulnerabil… |
CVE-2021-20076 | High | 8.8 | 2021-03-03 | Tenable.sc and Tenable.sc Core versions 5.13.0 through 5.17.0 were found to contain a vulnerability that could allow an authenticated, unprivileged user to per… |