Tenable Security Center
32 CVEs affecting Tenable Security Center. Latest disclosed: 2026-08-14. Critical: 5, High: 11.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-19682 | Critical | 9.9 | 2026-08-14 | A command injection vulnerability exists in Security Center where a remote, unauthenticated attacker could exploit this issue to execute arbitrary commands on… |
CVE-2026-19681 | Critical | 9.9 | 2026-08-14 | An authenticated command injection vulnerability exists in Security Center related to file upload processing. An attacker could exploit this issue by uploading… |
CVE-2026-19626 | Critical | 9.9 | 2026-08-14 | A remote code execution vulnerability exists in Tenable Security Center's report generation functionality. An authenticated, non-administrative user could expl… |
CVE-2026-64879 | Critical | 9.9 | 2026-07-21 | A filename supplied during file upload is not properly sanitized before being used in system command execution, allowing an attacker to inject shell metacharac… |
CVE-2026-64878 | Critical | 9.9 | 2026-07-21 | Unvalidated input in asset filter parameters allows shell metacharacters to escape command argument handling, resulting in remote code execution as a low-privi… |
CVE-2026-19679 | High | 8.8 | 2026-08-14 | An input validation vulnerability exists in Security Center's file upload handling, where insufficient sanitization of uploaded filenames could contribute to a… |
CVE-2026-19635 | High | 8.8 | 2026-08-14 | A local privilege escalation vulnerability exists in Security Center. An attacker with write access to a specific configuration file could achieve arbitrary co… |
CVE-2026-64881 | High | 8.8 | 2026-07-21 | The audit file upload handler does not sanitize filenames, allowing shell metacharacters to flow into system command execution. This input validation failure e… |
CVE-2018-1154 | High | 8.8 | 2018-08-02 | In SecurityCenter versions prior to 5.7.0, a username enumeration issue could allow an unauthenticated attacker to automate the discovery of username aliases v… |
CVE-2017-11508 | High | 8.8 | 2017-11-02 | SecurityCenter versions 5.5.0, 5.5.1 and 5.5.2 contain a SQL Injection vulnerability that could be exploited by an authenticated user with sufficient privilege… |
CVE-2026-64877 | High | 8.4 | 2026-07-21 | An authenticated non-admin user can exploit a SQL injection flaw in the ticketing REST API to access sensitive data stored in the appliance database. |
CVE-2026-19629 | High | 8.1 | 2026-08-14 | A privilege escalation vulnerability exists in Tenable Security Center that allows a user with "Security Manager" role and "manage user" permission on a single… |
CVE-2026-19628 | High | 7.2 | 2026-08-14 | A command injection vulnerability exists in Tenable Security Center. An authenticated administrator could modify application configuration values to achieve ar… |
CVE-2024-1367 | High | 7.2 | 2024-02-14 | A command injection vulnerability exists where an authenticated, remote attacker with administrator privileges on the Security Center application could modify… |
CVE-2026-19680 | High | 7.1 | 2026-08-14 | A SQL injection vulnerability exists in Security Center that could allow an attacker to access unauthorized data from the application's database. |
CVE-2026-64880 | High | 7.1 | 2026-07-21 | Unsanitized user-supplied input in report filtering parameters is concatenated directly into SQL queries without proper escaping or parameterized queries, enab… |
CVE-2026-2698 | Medium | 6.5 | 2026-02-23 | An improper access control vulnerability exists where an authenticated user could access areas outside of their authorized scope. |
CVE-2019-11049 | Medium | 6.5 | 2019-12-23 | In PHP versions 7.3.x below 7.3.13 and 7.4.0 on Windows, when supplying custom headers to mail() function, due to mistake introduced in commit 78f4b4a2dcf92ddb… |
CVE-2026-2697 | Medium | 6.3 | 2026-02-23 | An Indirect Object Reference (IDOR) in Security Center allows an authenticated remote attacker to escalate privileges via the 'owner' parameter. |
CVE-2023-2005 | Medium | 6.3 | 2023-06-26 | Vulnerability in Tenable Tenable.Io, Tenable Nessus, Tenable Security Center.This issue affects Tenable.Io: before Plugin Feed ID #202306261202 ; Nessus: befor… |