# cve.now: Tenable

The newest entries naming Tenable as an affected vendor (up to 200), of 104 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-119317](https://cve.now/CVE-2026-119317.md): Incorrect Authorization (CVSS 6.5)
- [CVE-2026-103946](https://cve.now/CVE-2026-103946.md): SQL Injection (CVSS 8.3)
- [CVE-2026-106126](https://cve.now/CVE-2026-106126.md): Command Injection (CVSS 9.9)
- [CVE-2026-19682](https://cve.now/CVE-2026-19682.md): Command Injection (CVSS 9.9)
- [CVE-2026-19681](https://cve.now/CVE-2026-19681.md): Command Injection (CVSS 9.9)
- [CVE-2026-19680](https://cve.now/CVE-2026-19680.md): SQL Injection (CVSS 7.1)
- [CVE-2026-19679](https://cve.now/CVE-2026-19679.md): Improper Input Validation (CVSS 8.8)
- [CVE-2026-19639](https://cve.now/CVE-2026-19639.md): Improper Access Control (CVSS 4.3)
- [CVE-2026-19636](https://cve.now/CVE-2026-19636.md): Insuffucient Protections Lead to Brute Force (CVSS 5.3)
- [CVE-2026-19635](https://cve.now/CVE-2026-19635.md): Local Privilege Escalation (CVSS 8.8)
- [CVE-2026-19631](https://cve.now/CVE-2026-19631.md): SQL Injection (CVSS 4.9)
- [CVE-2026-19629](https://cve.now/CVE-2026-19629.md): Privilege Escalation (CVSS 8.1)
- [CVE-2026-19628](https://cve.now/CVE-2026-19628.md): Remote Code Execution (CVSS 7.2)
- [CVE-2026-19626](https://cve.now/CVE-2026-19626.md): Remote Code Execution (CVSS 9.9)
- [CVE-2026-18667](https://cve.now/CVE-2026-18667.md): Sensor Proxy Version 1.4.2 Fixes One Vulnerability (CVSS 9.6)
- [CVE-2026-64881](https://cve.now/CVE-2026-64881.md): Command Injection (CVSS 8.8)
- [CVE-2026-64880](https://cve.now/CVE-2026-64880.md): Blind SQL Injection (CVSS 7.1)
- [CVE-2026-64879](https://cve.now/CVE-2026-64879.md): Command Injection (CVSS 9.9)
- [CVE-2026-64878](https://cve.now/CVE-2026-64878.md): Command Injection (CVSS 9.9)
- [CVE-2026-64877](https://cve.now/CVE-2026-64877.md): An authenticated non-admin user can exploit a SQL injection flaw in the ticketing REST API to access sensitive data stored in the appliance (CVSS 8.4)
- [CVE-2026-15265](https://cve.now/CVE-2026-15265.md): Tenable Agent Path Traversal Leading to Remote Code Execution (CVSS 9.1)
- [CVE-2026-57588](https://cve.now/CVE-2026-57588.md): SQL Injection in Nessus via Malicious Scan Result File Import (CVSS 3.3)
- [CVE-2026-57587](https://cve.now/CVE-2026-57587.md): SQL Injection in Nessus via Reverse DNS Lookup (CVSS 5.3)
- [CVE-2026-13007](https://cve.now/CVE-2026-13007.md): Insecure Public Caching on REST API Endpoints in Tenable Identity Exposure (CVSS 7.5)
- [CVE-2026-47358](https://cve.now/CVE-2026-47358.md): Terrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery (SSRF) via external URL resolution in uploaded IaC templates when (CVSS 7.5)
- [CVE-2026-47357](https://cve.now/CVE-2026-47357.md): Terrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery (SSRF) via the remote\_url parameter in the remote directory scan e (CVSS 7.5)
- [CVE-2026-47356](https://cve.now/CVE-2026-47356.md): Terrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery (SSRF) via the webhook\_url parameter in the file scan endpoint (PO (CVSS 7.5)
- [CVE-2026-33694](https://cve.now/CVE-2026-33694.md): Junction File Manipulation (CVSS 7.4)
- [CVE-2026-4433](https://cve.now/CVE-2026-4433.md): An SSH misconfigurations exists in Tenable OT that led to the potential exfiltration of socket, port, and service information via the ostunn (CVSS 1.9)
- [CVE-2026-2698](https://cve.now/CVE-2026-2698.md): Improper Access Control (CVSS 6.5)
- [CVE-2026-2697](https://cve.now/CVE-2026-2697.md): Indirect Object Reference (IDOR) in Security Center (CVSS 6.3)
- [CVE-2026-2630](https://cve.now/CVE-2026-2630.md): \[R1\] Stand-alone Security Patches Available for Tenable Security Center versions 6.5.1, 6.6.0 and 6.7.2: SC-202602.1 + SC-202602.2 (CVSS 8.8)
- [CVE-2026-2026](https://cve.now/CVE-2026-2026.md): Improper Access Control Allows Denial of Service (CVSS 5.4)
- [CVE-2025-36640](https://cve.now/CVE-2025-36640.md): Local Privilege Escalation (CVSS 7.3)
- [CVE-2025-36636](https://cve.now/CVE-2025-36636.md): Improper Access Control (CVSS 4.3)
- [CVE-2025-36630](https://cve.now/CVE-2025-36630.md): Local Privilege Escalation (CVSS 8.4)
- [CVE-2025-36632](https://cve.now/CVE-2025-36632.md): Local Privilege Escalation (CVSS 7.8)
- [CVE-2025-36631](https://cve.now/CVE-2025-36631.md): Local Privilege Escalation (CVSS 8.4)
- [CVE-2025-36633](https://cve.now/CVE-2025-36633.md): Local Privilege Escalation (CVSS 8.8)
- [CVE-2025-24917](https://cve.now/CVE-2025-24917.md): Improper Access Control leads to Local Privilege Escalation (CVSS 7.8)
- [CVE-2025-24916](https://cve.now/CVE-2025-24916.md): Improper Access Control leads to Local Priviledge Escalation (CVSS 7.0)
- [CVE-2025-36625](https://cve.now/CVE-2025-36625.md): Log Poisoning in Nessus (CVSS 4.3)
- [CVE-2025-24914](https://cve.now/CVE-2025-24914.md): Local Priviledge Escalation (CVSS 7.8)
- [CVE-2025-24915](https://cve.now/CVE-2025-24915.md): When installing Nessus Agent to a non-default location on a Windows host, Nessus Agent versions prior to 10.8.3 did not enforce secure permi (CVSS 7.8)
- [CVE-2025-0760](https://cve.now/CVE-2025-0760.md): Stored Credential Disclosure Vulnerability (CVSS 2.7)
- [CVE-2025-1091](https://cve.now/CVE-2025-1091.md): Broken Authorization Schema (CVSS 4.3)
- [CVE-2024-12174](https://cve.now/CVE-2024-12174.md): An Improper Certificate Validation vulnerability exists in Tenable Security Center where an authenticated, privileged attacker could interce (CVSS 2.7)
- [CVE-2024-9158](https://cve.now/CVE-2024-9158.md): XSS (CVSS 8.4)
- [CVE-2024-3232](https://cve.now/CVE-2024-3232.md): Formula Injection Vulnerability (CVSS 7.6)
- [CVE-2024-5759](https://cve.now/CVE-2024-5759.md): Improper privilege management (CVSS 5.4)
- [CVE-2024-1891](https://cve.now/CVE-2024-1891.md): Stored Cross Site Scripting (CVSS 3.5)
- [CVE-2024-3292](https://cve.now/CVE-2024-3292.md): Race Condition (CVSS 8.2)
- [CVE-2024-3291](https://cve.now/CVE-2024-3291.md): Privilege Escalation (CVSS 7.8)
- [CVE-2024-3290](https://cve.now/CVE-2024-3290.md): Race Condition (CVSS 8.2)
- [CVE-2024-3289](https://cve.now/CVE-2024-3289.md): When installing Nessus to a directory outside of the default location on a Windows host, Nessus versions prior to 10.7.3 did not enforce sec (CVSS 7.8)
- [CVE-2024-2390](https://cve.now/CVE-2024-2390.md): Local Privilege Escalation (CVSS 7.8)
- [CVE-2024-1683](https://cve.now/CVE-2024-1683.md): DLL Injection in Tenable Identity Exposure Secure Relay (CVSS 7.3)
- [CVE-2024-1471](https://cve.now/CVE-2024-1471.md): HTML Injection Vulnerability (CVSS 5.9)
- [CVE-2024-1367](https://cve.now/CVE-2024-1367.md): Command Injection Vulnerability in Tenable Security Center (CVSS 7.2)
- [CVE-2024-0971](https://cve.now/CVE-2024-0971.md): A SQL injection vulnerability exists where an authenticated, low-privileged remote attacker could potentially alter scan DB content. (CVSS 6.5)
- [CVE-2024-0955](https://cve.now/CVE-2024-0955.md): Stored XSS vulnerability (CVSS 4.8)
- [CVE-2023-6178](https://cve.now/CVE-2023-6178.md): An arbitrary file write vulnerability exists where an authenticated attacker with privileges on the managing application could alter Nessus (CVSS 6.8)
- [CVE-2023-6062](https://cve.now/CVE-2023-6062.md): Arbitrary File Write (CVSS 6.8)
- [CVE-2023-5847](https://cve.now/CVE-2023-5847.md): Under certain conditions, a low privileged attacker could load a specially crafted file during installation or upgrade to escalate privileg (CVSS 6.7)
- [CVE-2023-5624](https://cve.now/CVE-2023-5624.md): Blind SQL Injection (CVSS 7.2)
- [CVE-2023-5623](https://cve.now/CVE-2023-5623.md): Privilege Escalation (CVSS 7.0)
- [CVE-2023-5622](https://cve.now/CVE-2023-5622.md): Privilege Escalation (CVSS 7.1)
- [CVE-2023-3253](https://cve.now/CVE-2023-3253.md): Improper authorization in Nessus (CVSS 4.3)
- [CVE-2023-3252](https://cve.now/CVE-2023-3252.md): Arbitrary File Write (CVSS 6.8)
- [CVE-2023-3251](https://cve.now/CVE-2023-3251.md): Pass-back vulnerability in Nessus (CVSS 4.1)
- [CVE-2023-2005](https://cve.now/CVE-2023-2005.md): Tenable Plugin Feed ID #202306261202 Fixes Privilege Escalation Vulnerability (CVSS 6.3)
- [CVE-2022-33757](https://cve.now/CVE-2022-33757.md): An authenticated attacker could read Nessus Debug Log file attachments from the web UI without having the correct privileges to do so. (CVSS 6.5)
- [CVE-2021-21371](https://cve.now/CVE-2021-21371.md): Execution of untrusted code through config file (CVSS 5.0)
- [CVE-2020-5756](https://cve.now/CVE-2020-5756.md): Grandstream GWN7000 firmware version 1.0.9.4 and below allows authenticated remote users to modify the system's crontab via undocumented API (no CVSS)
- [CVE-2019-3962](https://cve.now/CVE-2019-3962.md): Content Injection vulnerability in Tenable Nessus prior to 8.5.0 may allow an authenticated, local attacker to exploit this vulnerability by (no CVSS)
- [CVE-2019-3961](https://cve.now/CVE-2019-3961.md): Nessus versions 8.4.0 and earlier were found to contain a reflected XSS vulnerability due to improper validation of user-supplied input. (no CVSS)
- [CVE-2019-3922](https://cve.now/CVE-2019-3922.md): The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 is vulnerable to a stack buffer overflow via crafted HTTP POST re (no CVSS)
- [CVE-2019-3921](https://cve.now/CVE-2019-3921.md): The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 is vulnerable to a stack buffer overflow via crafted HTTP POST re (no CVSS)
- [CVE-2019-3920](https://cve.now/CVE-2019-3920.md): The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 is vulnerable to authenticated command injection via crafted HTTP (no CVSS)
- [CVE-2019-3919](https://cve.now/CVE-2019-3919.md): The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 is vulnerable to command injection via crafted HTTP request sent (no CVSS)
- [CVE-2019-3918](https://cve.now/CVE-2019-3918.md): The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 contains multiple hard coded credentials for the Telnet and SSH i (no CVSS)
- [CVE-2019-3917](https://cve.now/CVE-2019-3917.md): The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 allows a remote, unauthenticated attacker to enable telnetd on th (no CVSS)
- [CVE-2019-3924](https://cve.now/CVE-2019-3924.md): MikroTik RouterOS before 6.43.12 (stable) and 6.42.12 (long-term) is vulnerable to an intermediary vulnerability. (no CVSS)
- [CVE-2019-3923](https://cve.now/CVE-2019-3923.md): Nessus versions 8.2.1 and earlier were found to contain a stored XSS vulnerability due to improper validation of user-supplied input. (no CVSS)
- [CVE-2019-3913](https://cve.now/CVE-2019-3913.md): Command manipulation in LabKey Server Community Edition before 18.3.0-61806.763 allows an authenticated remote attacker to unmount any drive (no CVSS)
- [CVE-2019-3912](https://cve.now/CVE-2019-3912.md): An open redirect vulnerability in LabKey Server Community Edition before 18.3.0-61806.763 via the /\_\_r1/ returnURL parameter allows an unaut (no CVSS)
- [CVE-2019-3911](https://cve.now/CVE-2019-3911.md): Reflected cross-site scripting (XSS) vulnerability in LabKey Server Community Edition before 18.3.0-61806.763 allows an unauthenticated remo (no CVSS)
- [CVE-2018-15699](https://cve.now/CVE-2018-15699.md): ASUSTOR Data Master 3.1.5 and below makes an HTTP request for a configuration file that is vulnerable to XSS. (no CVSS)
- [CVE-2018-15698](https://cve.now/CVE-2018-15698.md): ASUSTOR Data Master 3.1.5 and below allows authenticated remote non-administrative users to read any file on the file system when providing (no CVSS)
- [CVE-2018-15697](https://cve.now/CVE-2018-15697.md): ASUSTOR Data Master 3.1.5 and below allows authenticated remote non-administrative users to read any file on a share by providing the full p (no CVSS)
- [CVE-2018-15696](https://cve.now/CVE-2018-15696.md): ASUSTOR Data Master 3.1.5 and below allows authenticated remote non-administrative users to enumerate all user accounts via user.cgi. (no CVSS)
- [CVE-2018-15695](https://cve.now/CVE-2018-15695.md): ASUSTOR Data Master 3.1.5 and below allows authenticated remote non-administrative users to delete any file on the file system due to a path (no CVSS)
- [CVE-2018-15694](https://cve.now/CVE-2018-15694.md): ASUSTOR Data Master 3.1.5 and below allows authenticated remote non-administrative users to upload files to arbitrary locations due to a pat (no CVSS)
- [CVE-2018-1155](https://cve.now/CVE-2018-1155.md): In SecurityCenter versions prior to 5.7.0, a cross-site scripting (XSS) issue could allow an authenticated attacker to inject JavaScript cod (no CVSS)
- [CVE-2018-1154](https://cve.now/CVE-2018-1154.md): In SecurityCenter versions prior to 5.7.0, a username enumeration issue could allow an unauthenticated attacker to automate the discovery of (no CVSS)
- [CVE-2018-1153](https://cve.now/CVE-2018-1153.md): Burp Suite Community Edition 1.7.32 and 1.7.33 fail to validate the server certificate in a couple of HTTPS requests which allows a man in t (no CVSS)
- [CVE-2018-1152](https://cve.now/CVE-2018-1152.md): libjpeg-turbo 1.5.90 is vulnerable to a denial of service vulnerability caused by a divide by zero when processing a crafted BMP image. (no CVSS)
- [CVE-2018-1148](https://cve.now/CVE-2018-1148.md): In Nessus before 7.1.0, Session Fixation exists due to insufficient session management within the application. (no CVSS)
- [CVE-2018-1147](https://cve.now/CVE-2018-1147.md): In Nessus before 7.1.0, a XSS vulnerability exists due to improper input validation. (no CVSS)
- [CVE-2018-1142](https://cve.now/CVE-2018-1142.md): Tenable Appliance versions 4.6.1 and earlier have been found to contain a single XSS vulnerability. (no CVSS)
- [CVE-2018-1141](https://cve.now/CVE-2018-1141.md): When installing Nessus to a directory outside of the default location, Nessus versions prior to 7.0.3 did not enforce secure permissions for (no CVSS)
- [CVE-2017-11507](https://cve.now/CVE-2017-11507.md): A cross site scripting (XSS) vulnerability exists in Check\_MK versions 1.2.8x prior to 1.2.8p25 and 1.4.0x prior to 1.4.0p9, allowing an una (no CVSS)
- [CVE-2017-11508](https://cve.now/CVE-2017-11508.md): SecurityCenter versions 5.5.0, 5.5.1 and 5.5.2 contain a SQL Injection vulnerability that could be exploited by an authenticated user with s (no CVSS)
- [CVE-2017-11506](https://cve.now/CVE-2017-11506.md): When linking a Nessus scanner or agent to Tenable.io or other manager, Nessus 6.x before 6.11 does not verify the manager's TLS certificate (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/tenable
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.