https://vulnogram.org/ Most recent CVEs assigned by Tenable Network Security, Inc. (tenable). https://vulnogram.org/seaview/icons/tenable.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-103946 https://vulnogram.org/CVE-2026-103946 An SQL injection vulnerability could allow an authenticated user to read or modify data stored by Nessus. High Wed, 14 Oct 2026 16:18:25 GMT https://vulnogram.org/CVE-2026-108125 https://vulnogram.org/CVE-2026-108125 Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in wp-post-author. This issue affects wp-post-author version 4.0.0 prior to 4.1.0. High Fri, 09 Oct 2026 14:59:48 GMT https://vulnogram.org/CVE-2026-108124 https://vulnogram.org/CVE-2026-108124 Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in wp-post-author. This issue affects wp-post-author before 4.1.0. Medium Fri, 09 Oct 2026 14:51:05 GMT https://vulnogram.org/CVE-2026-106126 https://vulnogram.org/CVE-2026-106126 A command injection vulnerability in the Active Directory Events Listener of Tenable Identity Exposure (SaaS) allows an authenticated, low-privileged attacker to execute arbitrary commands as SYSTEM on the PDCe. Critical Thu, 08 Oct 2026 19:47:35 GMT https://vulnogram.org/CVE-2026-92626 https://vulnogram.org/CVE-2026-92626 Control iD iDSecure versions prior to 4.8.3.0 are affected by an unauthenticated Denial of Service. The /api/dguardintegration/dguardVersion endpoint dereferences DGuard integration login state that may be unset, raising an unhandled null reference e… High Network Exploitable Wed, 16 Sep 2026 15:23:21 GMT https://vulnogram.org/CVE-2026-92625 https://vulnogram.org/CVE-2026-92625 Control iD iDSecure versions prior to 4.8.3.0 are affected by an unauthenticated Denial of Service. The /api/license/restartService endpoint is reachable without authentication and invokes an internal routine that terminates the iDSecure service proc… High Network Exploitable Wed, 16 Sep 2026 15:23:14 GMT https://vulnogram.org/CVE-2026-84860 https://vulnogram.org/CVE-2026-84860 ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authorization Bypass Spring Security gates DWR endpoints by URL path pattern, but DWR itself dispatches method calls based on the POST body parameters c0-scriptName and c0-methodName. The cro… High Wed, 16 Sep 2026 14:52:23 GMT https://vulnogram.org/CVE-2026-84859 https://vulnogram.org/CVE-2026-84859 ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authenticated Blind SQL Injection The /api/events/search endpoint accepts a JSON body containing a sortBy array. The values in this array are concatenated directly into the SQL ORDER BY claus… Medium Wed, 16 Sep 2026 14:52:14 GMT https://vulnogram.org/CVE-2026-84858 https://vulnogram.org/CVE-2026-84858 ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authenticated Remote Code Execution via Scripting Sandbox Bypass The DWR "DataSourceEditDwr" class exposes the "validateScript" method that compiles and executes attacker-supplied JavaScript… High Wed, 16 Sep 2026 14:51:56 GMT https://vulnogram.org/CVE-2026-83492 https://vulnogram.org/CVE-2026-83492 Improper input validation vulnerability in Extend Themes Kubio AI Website Builder. This issue affects Kubio AI Website Builder: before 2.9.1. Medium Mon, 31 Aug 2026 15:53:57 GMT https://vulnogram.org/CVE-2026-82123 https://vulnogram.org/CVE-2026-82123 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Tangible Loops & Logic. Medium Network Exploitable Fri, 28 Aug 2026 06:54:43 GMT https://vulnogram.org/CVE-2026-19682 https://vulnogram.org/CVE-2026-19682 A command injection vulnerability exists in Security Center where a remote, unauthenticated attacker could exploit this issue to execute arbitrary commands on the underlying operating system with the privileges of the service account. Critical Fri, 14 Aug 2026 17:51:55 GMT https://vulnogram.org/CVE-2026-19681 https://vulnogram.org/CVE-2026-19681 An authenticated command injection vulnerability exists in Security Center related to file upload processing. An attacker could exploit this issue by uploading a specially crafted file, potentially resulting in arbitrary command execution on the unde… Critical Fri, 14 Aug 2026 17:45:37 GMT https://vulnogram.org/CVE-2026-19680 https://vulnogram.org/CVE-2026-19680 A SQL injection vulnerability exists in Security Center that could allow an attacker to access unauthorized data from the application's database. High Fri, 14 Aug 2026 17:39:21 GMT https://vulnogram.org/CVE-2026-19679 https://vulnogram.org/CVE-2026-19679 An input validation vulnerability exists in Security Center's file upload handling, where insufficient sanitization of uploaded filenames could contribute to a downstream command injection issue. High Fri, 14 Aug 2026 17:35:46 GMT https://vulnogram.org/CVE-2026-19639 https://vulnogram.org/CVE-2026-19639 An improper access control vulnerability exists where an authenticated non-administrative application user could potentially view settings outside of their assigned scope. Medium Fri, 14 Aug 2026 17:28:49 GMT https://vulnogram.org/CVE-2026-19636 https://vulnogram.org/CVE-2026-19636 An issue was identified in which CSRF tokens were generated using a predictable method, potentially reducing their effectiveness as a security control. This has been addressed by improving the randomness and entropy of token generation. Medium Network Exploitable Fri, 14 Aug 2026 17:24:21 GMT https://vulnogram.org/CVE-2026-19635 https://vulnogram.org/CVE-2026-19635 A local privilege escalation vulnerability exists in Security Center. An attacker with write access to a specific configuration file could achieve arbitrary code execution with elevated privileges, without requiring further user or victim interaction… High Fri, 14 Aug 2026 17:12:52 GMT https://vulnogram.org/CVE-2026-19631 https://vulnogram.org/CVE-2026-19631 A SQL injection vulnerability exists in Security Center that could allow an authenticated administrator to execute arbitrary SQL queries, potentially resulting in unauthorized access to sensitive data, including credentials. Medium Fri, 14 Aug 2026 17:08:53 GMT https://vulnogram.org/CVE-2026-19629 https://vulnogram.org/CVE-2026-19629 A privilege escalation vulnerability exists in Tenable Security Center that allows a user with "Security Manager" role and "manage user" permission on a single group to modify users belonging to other groups. This bypasses the intended access control… High Fri, 14 Aug 2026 17:04:19 GMT https://vulnogram.org/CVE-2026-19628 https://vulnogram.org/CVE-2026-19628 A command injection vulnerability exists in Tenable Security Center. An authenticated administrator could modify application configuration values to achieve arbitrary command execution on the underlying operating system when specific backend operatio… High Fri, 14 Aug 2026 17:00:01 GMT https://vulnogram.org/CVE-2026-19626 https://vulnogram.org/CVE-2026-19626 A remote code execution vulnerability exists in Tenable Security Center's report generation functionality. An authenticated, non-administrative user could exploit this issue by supplying specially crafted input that is later processed unsafely during… Critical Fri, 14 Aug 2026 16:55:36 GMT https://vulnogram.org/CVE-2026-19657 https://vulnogram.org/CVE-2026-19657 ScadaLTS 2.7.8.1 reflects user-supplied input into an HTML response without sanitization. An unauthenticated attacker who lures a victim into visiting a crafted URL can execute arbitrary JavaScript in the context of the victim's browser session. Medium Network Exploitable Wed, 12 Aug 2026 19:14:33 GMT https://vulnogram.org/CVE-2026-19656 https://vulnogram.org/CVE-2026-19656 ScadaLTS 2.7.8.1 exposes a server-side method that lacks authorization checks, allowing any authenticated user (including one holding only low-privilege, read-only permissions) to execute arbitrary operating system commands on the host. Successful ex… Critical Wed, 12 Aug 2026 19:10:11 GMT https://vulnogram.org/CVE-2026-19579 https://vulnogram.org/CVE-2026-19579 Snipe-IT before 8.6.0 contains an authorization bypass (insecure direct object reference) in the asset checkout-request cancellation endpoint. The cancel_by_admin and requestingUser values are read from user-controlled URL path segments and used with… Medium Tue, 11 Aug 2026 20:25:02 GMT https://vulnogram.org/CVE-2026-18667 https://vulnogram.org/CVE-2026-18667 A vulnerability in Tenable Sensor Proxy allows a remote attacker to execute code with elevated privileges by inducing an operator to connect the sensor to an attacker-controlled host. Critical Network Exploitable Mon, 03 Aug 2026 22:27:29 GMT https://vulnogram.org/CVE-2026-18197 https://vulnogram.org/CVE-2026-18197 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Link Library allows Cross-Site Scripting (XSS). This issue affects Link Library: before 7.9.4. Medium Network Exploitable Wed, 29 Jul 2026 06:53:36 GMT https://vulnogram.org/CVE-2026-64881 https://vulnogram.org/CVE-2026-64881 The audit file upload handler does not sanitize filenames, allowing shell metacharacters to flow into system command execution. This input validation failure enables command injection when chained with a related vulnerability. High Tue, 21 Jul 2026 20:09:50 GMT https://vulnogram.org/CVE-2026-64880 https://vulnogram.org/CVE-2026-64880 Unsanitized user-supplied input in report filtering parameters is concatenated directly into SQL queries without proper escaping or parameterized queries, enabling blind SQL injection and unauthorized database read access. High Tue, 21 Jul 2026 20:01:28 GMT https://vulnogram.org/CVE-2026-64879 https://vulnogram.org/CVE-2026-64879 A filename supplied during file upload is not properly sanitized before being used in system command execution, allowing an attacker to inject shell metacharacters and achieve command injection via the audit file upload functionality. Critical Tue, 21 Jul 2026 19:54:06 GMT https://vulnogram.org/CVE-2026-64878 https://vulnogram.org/CVE-2026-64878 Unvalidated input in asset filter parameters allows shell metacharacters to escape command argument handling, resulting in remote code execution as a low-privileged OS user via the Analysis REST endpoint. Critical Tue, 21 Jul 2026 19:41:36 GMT https://vulnogram.org/CVE-2026-64877 https://vulnogram.org/CVE-2026-64877 An authenticated non-admin user can exploit a SQL injection flaw in the ticketing REST API to access sensitive data stored in the appliance database. Critical Tue, 21 Jul 2026 18:06:22 GMT https://vulnogram.org/CVE-2026-15265 https://vulnogram.org/CVE-2026-15265 A path traversal vulnerability in Tenable Agent 11.2.0 and 11.1.3 and lower allows a privileged attacker to write arbitrary files outside the intended plugin directory, potentially leading to remote code execution. Critical Tue, 14 Jul 2026 15:02:37 GMT https://vulnogram.org/CVE-2026-57588 https://vulnogram.org/CVE-2026-57588 A SQL injection vulnerability in Nessus allows an attacker to craft a malicious scan result file that, when imported by a privileged user, injects malicious SQL into the scan results database, potentially enabling exfiltration of scan-result data. Low Thu, 25 Jun 2026 13:47:27 GMT https://vulnogram.org/CVE-2026-57587 https://vulnogram.org/CVE-2026-57587 A SQL injection vulnerability in Nessus allows a remote, unauthenticated attacker who controls reverse DNS records for a scanned host to inject malicious SQL into the scan results database, potentially enabling exfiltration of scan-result data. Medium Thu, 25 Jun 2026 13:47:27 GMT https://vulnogram.org/CVE-2026-13007 https://vulnogram.org/CVE-2026-13007 Tenable Identity Exposure contains multiple unauthenticated API endpoints under /w/api/* that expose sensitive application configuration data including cleartext LDAP credentials, SAML configuration, user accounts, and directory settings to unauthent… High Tue, 23 Jun 2026 15:59:50 GMT https://vulnogram.org/CVE-2026-9646 https://vulnogram.org/CVE-2026-9646 A reflected cross-site scripting issue exists in URL handling. Medium Network Exploitable Thu, 28 May 2026 20:32:27 GMT https://vulnogram.org/CVE-2026-9645 https://vulnogram.org/CVE-2026-9645 Exposed methods allow authenticated users to create and execute arbitrary JavaScript code on the server. The scripts execute with full access, enabling complete system compromise as commands are executed as root. Critical Thu, 28 May 2026 20:30:13 GMT https://vulnogram.org/CVE-2026-8359 https://vulnogram.org/CVE-2026-8359 When processing a request with a URL path starting with /status or /sysinfo, WOSHttpStatusModule.dll is to be loaded to handle such URL patterns. The WOSBin_LoadHttpModule function in the dll would be called to set up a "module" object for that modul… High Network Exploitable Wed, 27 May 2026 19:49:18 GMT https://vulnogram.org/CVE-2026-8360 https://vulnogram.org/CVE-2026-8360 Function calls to WOSCommonUtil.dll!WOSSysInfoGetDeviceInterface() in various DLLs (i.e., WOSProfileMgrModule.dll, WOSWebDavModule.dll) can return a NULL pointer (i.e., when no user is logged into the Triofox Server Agent Management Console). The ret… High Network Exploitable Wed, 27 May 2026 19:47:29 GMT https://vulnogram.org/CVE-2026-8361 https://vulnogram.org/CVE-2026-8361 A path traversal vulnerability exists in WOSDefaultHttpModule.dll when processing a URL path starting with /woshome High Network Exploitable Wed, 27 May 2026 19:44:38 GMT https://vulnogram.org/CVE-2026-8362 https://vulnogram.org/CVE-2026-8362 A stack-based buffer overflow condition exists in WOSDefaultHttpModule.dll when processing a long URL path starting with /woshome Critical Network Exploitable Wed, 27 May 2026 19:42:08 GMT https://vulnogram.org/CVE-2026-8363 https://vulnogram.org/CVE-2026-8363 A stack-based buffer overflow condition exists in WOSDeviceDropFolder.dll when processing a long URL path starting with /resources: Critical Network Exploitable Wed, 27 May 2026 19:40:33 GMT https://vulnogram.org/CVE-2026-8364 https://vulnogram.org/CVE-2026-8364 Gladinet Triofox Cloud Server Agent Access Service (GladServerAgentService.exe) listens on TCP port 7878 and processes remote HTTP messages with URL paths starting with /resources, /status, /sysinfo, /woshome, /Settings, /schedule, or /DavCache. Critical Network Exploitable Wed, 27 May 2026 19:38:01 GMT https://vulnogram.org/CVE-2026-9065 https://vulnogram.org/CVE-2026-9065 SureCart version prior to 4.2.1 are vulnerable to authenticated SQL injection via multiple parameters ('model_name', 'model_id', 'integration_id', 'provider') on the REST API endpoint '/surecart/v1/integrations/{id}'. The root cause is a flawed escap… Critical Wed, 20 May 2026 08:23:55 GMT https://vulnogram.org/CVE-2026-9059 https://vulnogram.org/CVE-2026-9059 NextGEN Gallery version prior to 4.2.1 are vulnerable to authenticated SQL injection via the 'orderby' parameter on the REST API endpoints '/imagely/v1/galleries' and '/imagely/v1/albums'. The root cause is an insufficient sanitization function ('_cl… Critical Wed, 20 May 2026 07:41:28 GMT https://vulnogram.org/CVE-2026-47358 https://vulnogram.org/CVE-2026-47358 Terrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery (SSRF) via external URL resolution in uploaded IaC templates when running in server mode. When Terrascan parses uploaded ARM templates or CloudFormation templates, it resolves… Critical Tue, 19 May 2026 15:53:09 GMT https://vulnogram.org/CVE-2026-47357 https://vulnogram.org/CVE-2026-47357 Terrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery (SSRF) via the remote_url parameter in the remote directory scan endpoint (POST /v1/{iac}/{iacVersion}/{cloud}/remote/dir/scan) when running in server mode. An unauthenticated… Critical Tue, 19 May 2026 15:53:05 GMT https://vulnogram.org/CVE-2026-47356 https://vulnogram.org/CVE-2026-47356 Terrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery (SSRF) via the webhook_url parameter in the file scan endpoint (POST /v1/{iac}/{iacVersion}/{cloud}/local/file/scan) when running in server mode. An unauthenticated remote atta… High Tue, 19 May 2026 15:53:04 GMT https://vulnogram.org/CVE-2026-8367 https://vulnogram.org/CVE-2026-8367 aria2c accepts a server certificate with incorrect Extended Key Usage (EKU). If the attackers compromise a certificate (with the associated private key) issued for a different purpose, they may be able to reuse it for TLS server authentication. Medium Network Exploitable Wed, 13 May 2026 14:55:09 GMT