Tenable, Inc. Security Center
16 CVEs affecting Tenable, Inc. Security Center. Latest disclosed: 2026-08-14. Critical: 5, High: 8.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-19682 | Critical | 9.9 | 2026-08-14 | A command injection vulnerability exists in Security Center where a remote, unauthenticated attacker could exploit this issue to execute arbitrary commands on… |
CVE-2026-19681 | Critical | 9.9 | 2026-08-14 | An authenticated command injection vulnerability exists in Security Center related to file upload processing. An attacker could exploit this issue by uploading… |
CVE-2026-19626 | Critical | 9.9 | 2026-08-14 | A remote code execution vulnerability exists in Tenable Security Center's report generation functionality. An authenticated, non-administrative user could expl… |
CVE-2026-64879 | Critical | 9.9 | 2026-07-21 | A filename supplied during file upload is not properly sanitized before being used in system command execution, allowing an attacker to inject shell metacharac… |
CVE-2026-64878 | Critical | 9.9 | 2026-07-21 | Unvalidated input in asset filter parameters allows shell metacharacters to escape command argument handling, resulting in remote code execution as a low-privi… |
CVE-2026-19679 | High | 8.8 | 2026-08-14 | An input validation vulnerability exists in Security Center's file upload handling, where insufficient sanitization of uploaded filenames could contribute to a… |
CVE-2026-19635 | High | 8.8 | 2026-08-14 | A local privilege escalation vulnerability exists in Security Center. An attacker with write access to a specific configuration file could achieve arbitrary co… |
CVE-2026-64881 | High | 8.8 | 2026-07-21 | The audit file upload handler does not sanitize filenames, allowing shell metacharacters to flow into system command execution. This input validation failure e… |
CVE-2026-64877 | High | 8.4 | 2026-07-21 | An authenticated non-admin user can exploit a SQL injection flaw in the ticketing REST API to access sensitive data stored in the appliance database. |
CVE-2026-19629 | High | 8.1 | 2026-08-14 | A privilege escalation vulnerability exists in Tenable Security Center that allows a user with "Security Manager" role and "manage user" permission on a single… |
CVE-2026-19628 | High | 7.2 | 2026-08-14 | A command injection vulnerability exists in Tenable Security Center. An authenticated administrator could modify application configuration values to achieve ar… |
CVE-2026-19680 | High | 7.1 | 2026-08-14 | A SQL injection vulnerability exists in Security Center that could allow an attacker to access unauthorized data from the application's database. |
CVE-2026-64880 | High | 7.1 | 2026-07-21 | Unsanitized user-supplied input in report filtering parameters is concatenated directly into SQL queries without proper escaping or parameterized queries, enab… |
CVE-2026-19636 | Medium | 5.3 | 2026-08-14 | An issue was identified in which CSRF tokens were generated using a predictable method, potentially reducing their effectiveness as a security control. This ha… |
CVE-2026-19631 | Medium | 4.9 | 2026-08-14 | A SQL injection vulnerability exists in Security Center that could allow an authenticated administrator to execute arbitrary SQL queries, potentially resulting… |
CVE-2026-19639 | Medium | 4.3 | 2026-08-14 | An improper access control vulnerability exists where an authenticated non-administrative application user could potentially view settings outside of their ass… |