SC
Product
Security Center
32
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 6High 14Medium 11Low 0
Watch
Add Security Center to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-19682 | 9.9 | Aug 14 | Command Injection Affected: before 6.9.0 |
| CVE-2026-19681 | 9.9 | Aug 14 | Command Injection Affected: before 6.9.0 |
| CVE-2026-19626 | 9.9 | Aug 14 | Remote Code Execution Affected: before 6.9.0 |
| CVE-2026-64879 | 9.9 | Jul 21 | Command Injection Affected: 6.6.0 through 6.8.0 |
| CVE-2026-64878 | 9.9 | Jul 21 | Command Injection Affected: 6.6.0 through 6.8.0 |
| CVE-2019-11049 | 9.8 | Dec 23 | In PHP versions 7.3.x below 7.3.13 and 7.4.0 on Windows, when supplying custom headers to mail() function, due to mistake introduced in commit… Affected: before 5.19.0 |
| CVE-2026-19679 | 8.8 | Aug 14 | Improper Input Validation Affected: before 6.9.0 |
| CVE-2026-19635 | 8.8 | Aug 14 | Local Privilege Escalation Affected: before 6.9.0 |
| CVE-2026-64881 | 8.8 | Jul 21 | Command Injection Affected: 6.6.0 through 6.8.0 |
| CVE-2026-2697 | 8.8 | Feb 23 | An Indirect Object Reference (IDOR) in Security Center allows an authenticated remote attacker to escalate privileges via the 'owner' parameter Affected: before 6.8.0 |
| CVE-2023-2005 | 8.8 | Jun 26 | Vulnerability in Tenable Tenable.Io, Tenable Nessus, Tenable Security Center.This issue affects Tenable.Io: before Plugin Feed ID #202306261202 ; Nessus: before Plugin Feed ID… Affected: All versions, or not specified |
| CVE-2018-1154 | 8.8 | Aug 2 | In SecurityCenter versions prior to 5.7.0, a username enumeration issue could allow an unauthenticated attacker to automate the discovery of username aliases via brute force,… Affected: before 5.7.0 |
| CVE-2017-11508 | 8.8 | Nov 2 | SecurityCenter versions 5.5.0, 5.5.1 and 5.5.2 contain a SQL Injection vulnerability that could be exploited by an authenticated user with sufficient privileges to run diagnostic… Affected: 5.5.0; 5.5.1; 5.5.2 |
| CVE-2026-64877 | 8.4 | Jul 21 | An authenticated non-admin user can exploit a SQL injection flaw in the ticketing REST API to access sensitive data stored in the appliance database Affected: 6.6.0 through 6.8.0 |
| CVE-2026-19629 | 8.1 | Aug 14 | Privilege Escalation Affected: before 6.9.0 |
| CVE-2019-11044 | 7.5 | Dec 23 | In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 on Windows, PHP link() function accepts filenames with embedded \0 byte and treats them as terminating at that… Affected: before 5.19.0 |
| CVE-2026-19628 | 7.2 | Aug 14 | Remote Code Execution Affected: before 6.9.0 |
| CVE-2024-1367 | 7.2 | Feb 14 | A command injection vulnerability exists where an authenticated, remote attacker with administrator privileges on the Security Center application could modify Logging parameters,… Affected: before 6.3.0 |
| CVE-2026-19680 | 7.1 | Aug 14 | SQL Injection Affected: before 6.9.0 |
| CVE-2026-64880 | 7.1 | Jul 21 | Blind SQL Injection Affected: 6.6.0 through 6.8.0 |
| CVE-2026-2698 | 6.5 | Feb 23 | An improper access control vulnerability exists where an authenticated user could access areas outside of their authorized scope Affected: before 6.8.0 |
| CVE-2019-11050 | 6.5 | Dec 23 | When PHP EXIF extension is parsing EXIF information from an image, e.g Affected: before 5.19.0 |
| CVE-2024-5759 | 6.3 | Jun 12 | An improper privilege management vulnerability exists in Tenable Security Center where an authenticated, remote attacker could view unauthorized objects and launch scans without… Affected: through 6.3.0 |
| CVE-2019-11045 | 5.9 | Dec 23 | In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP DirectoryIterator class accepts filenames with embedded \0 byte and treats them as terminating at that byte Affected: before 5.19.0 |
| CVE-2024-1891 | 5.4 | Jun 12 | A stored cross site scripting vulnerability exists in Tenable Security Center where an authenticated, remote attacker could inject HTML code into a web application scan result… Affected: before 6.4.0 |
| CVE-2018-1155 | 5.4 | Aug 2 | In SecurityCenter versions prior to 5.7.0, a cross-site scripting (XSS) issue could allow an authenticated attacker to inject JavaScript code into an image filename parameter… Affected: before 5.7.0 |
| CVE-2026-19636 | 5.3 | Aug 14 | Insuffucient Protections Lead to Brute Force Affected: before 6.9.0 |
| CVE-2019-11046 | 5.3 | Dec 23 | In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP bcmath extension functions on some systems, including Windows, can be tricked into reading beyond the… Affected: before 5.19.0 |
| CVE-2026-19631 | 4.9 | Aug 14 | SQL Injection Affected: before 6.9.0 |
| CVE-2024-1471 | 4.8 | Feb 14 | An HTML injection vulnerability exists where an authenticated, remote attacker with administrator privileges on the Security Center application could modify Repository parameters,… Affected: before 6.3.0 |
| CVE-2026-19639 | 4.3 | Aug 14 | Improper Access Control Affected: before 6.9.0 |
| CVE-2013-5911 | – | Sep 24 | Cross-site scripting (XSS) vulnerability in devform.php in Tenable SecurityCenter 4.6 through 4.7 allows remote attackers to inject arbitrary web script or HTML via the message… Affected: 4.6; 4.7 |
Showing 32