CVE-2026-77899

Use after free in Windows Security Center allows an authorized attacker to elevate privileges locally...

EUVD-2026-73291

Use after free in Windows Security Center allows an authorized attacker to elevate privileges locally...

CVE-2026-77899

CVE-2026-77899 is a use-after-free vulnerability in Windows Security Center that allows an authorized attacker to escalate privileges locally . The CVSS v3.1 score is 7.0 (HIGH) with a vector of AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting the need for low privileges and high attack complexity...

OWN-Defender

OWN-Defender — Windows Security Center COM Research OWN-Defender is a Windows security research project focused on understanding how Windows Security Center WSC represents and manages antivirus security products through its COM interfaces. The project began as an investigation into the behavior...

Tenable Security Center SCAP Audit File Command Injection

This is a Metasploit module that demonstrates how Tenable Security Center versions prior to 6.9.0 allow an authenticated user to achieve command execution as the web service account tns via the SCAP audit file upload flow. This module requires Metasploit: https://metasploit.com/download Current...

Tenable Security Center < 6.9.0 Multiple Vulnerabilities (TNS-2026-22)

According to its self-reported version, the Tenable Security Center running on the remote host is prior to 6.9.0. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2026-22 advisory. - libcurl might in some circumstances reuse the wrong connection for SMBS transfers...

CVE-2026-19680

A SQL injection vulnerability exists in Security Center that could allow an attacker to access unauthorized data from the application's database...

CVE-2026-19682

A command injection vulnerability exists in Security Center where a remote, unauthenticated attacker could exploit this issue to execute arbitrary commands on the underlying operating system with the privileges of the service account...

CVE-2026-19681

An authenticated command injection vulnerability exists in Security Center related to file upload processing. An attacker could exploit this issue by uploading a specially crafted file, potentially resulting in arbitrary command execution on the underlying operating system...

CVE-2026-19679

An input validation vulnerability exists in Security Center's file upload handling, where insufficient sanitization of uploaded filenames could contribute to a downstream command injection issue...

CVE-2026-19631

A SQL injection vulnerability exists in Security Center that could allow an authenticated administrator to execute arbitrary SQL queries, potentially resulting in unauthorized access to sensitive data, including credentials...

CVE-2026-19629

A privilege escalation vulnerability exists in Tenable Security Center that allows a user with "Security Manager" role and "manage user" permission on a single group to modify users belonging to other groups. This bypasses the intended access control restrictions and enables unauthorized...

CVE-2026-19635

A local privilege escalation vulnerability exists in Security Center. An attacker with write access to a specific configuration file could achieve arbitrary code execution with elevated privileges, without requiring further user or victim interaction...

CVE-2026-19682

CVE-2026-19682 is an OS command injection in Security Center. The CVE description states a remote, unauthenticated attacker can execute arbitrary commands on the underlying OS with the service account privileges. The Tenable advisory for Security Center 6.9.0 notes this vulnerability among others...

CVE-2026-19682 Command Injection

A command injection vulnerability exists in Security Center where a remote, unauthenticated attacker could exploit this issue to execute arbitrary commands on the underlying operating system with the privileges of the service account...

CVE-2026-19682 Command Injection

A command injection vulnerability exists in Security Center where a remote, unauthenticated attacker could exploit this issue to execute arbitrary commands on the underlying operating system with the privileges of the service account...

CVE-2026-19682

A command injection vulnerability exists in Security Center where a remote, unauthenticated attacker could exploit this issue to execute arbitrary commands on the underlying operating system with the privileges of the service account...

EUVD-2026-58748

A command injection vulnerability exists in Security Center where a remote, unauthenticated attacker could exploit this issue to execute arbitrary commands on the underlying operating system with the privileges of the service account...

CVE-2026-19681

An authenticated command injection vulnerability exists in Security Center related to file upload processing. An attacker could exploit this issue by uploading a specially crafted file, potentially resulting in arbitrary command execution on the underlying operating system...

EUVD-2026-58745

An authenticated command injection vulnerability exists in Security Center related to file upload processing. An attacker could exploit this issue by uploading a specially crafted file, potentially resulting in arbitrary command execution on the underlying operating system...