CVE-2019-11049

CVE-2019-11049 affects PHP 7.3.x with versions below 7.3.13 and PHP 7.4.0 on Windows. The issue arises when supplying custom headers to mail() with the header in lowercase, which can cause double-free of memory locations. There are no exploitation details in the provided documents beyond this des...

CVE-2019-11050

CVE-2019-11050 concerns the PHP EXIF extension: when parsing EXIF data via exif_read_data(), PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13, and 7.4.0 allow data to read beyond the allocated buffer, leading to potential information disclosure or a crash. Connected advisories confirm the vuln...

CVE-2019-11045

In PHP, DirectoryIterator vulnerability CVE-2019-11045 affects PHP 7.2.x < 7.2.26, 7.3.x

CVE-2019-11046

Summary (CVE-2019-11046) : PHP versions affected are 7.2.x below 7.2.26, 7.3.x below 7.3.13, and 7.4.0. The vulnerability is in the bcmath extension where a string containing characters identified as numeric by the OS but not ASCII digits can cause reading beyond allocated space, potentially disc...

CVE-2019-11044

The CVE-2019-11044 issue affects PHP when running on Windows, where the link() function accepts filenames with embedded null bytes and treats them as terminating at that byte. Affected PHP versions are 7.2.x below 7.2.26, 7.3.x below 7.3.13, and 7.4.0 on Windows. The underlying cause is null-byte...

CVE-2026-19626

CVE-2026-19626 is a remote code execution vulnerability affecting Tenable Security Center via its report generation functionality. An authenticated, non-administrative user can supply specially crafted input that is processed unsafely during server-side report rendering, leading to arbitrary code...

CVE-2024-1891

The CVE-2024-1891 entry describes a stored cross-site scripting vulnerability in Tenable Security Center. A authenticated, remote attacker could inject HTML code into a web application scan result page due to inadequate input handling in the affected component/file. Relevant details show impact c...

CVE-2024-5759

CVE-2024-5759 affects Tenable Security Center. It is an improper privilege management vulnerability where an authenticated, remote attacker could view unauthorized objects and initiate scans without the required privileges. The issue is addressed in Security Center 6.4.0 (upgrade to 6.4.0 or late...

CVE-2017-11508

SecurityCenter 5.5.0–5.5.2 contain a SQL Injection vulnerability exploitable by an authenticated user with sufficient privileges to run diagnostic scans. An attacker could insert a crafted SQL query into the password field of a diagnostic scan, potentially gaining unauthorized access to the Secur...

CVE-2026-19681

CVE-2026-19681 is an authenticated command-injection vulnerability in Security Center tied to file upload processing. The issue could allow arbitrary OS command execution after uploading a crafted file, with impact on confidentiality, integrity, and availability reported as High. Tenable’s adviso...

CVE-2026-64877

CVE-2026-64877 is an authenticated, non-admin SQL injection vulnerability in the appliance’s ticketing REST API that can lead to access to sensitive data stored in the appliance database. The CVSS v3.1 base score is 9.6 (CRITICAL) with network attack vector, low attack complexity, and privileges ...

CVE-2026-19682

CVE-2026-19682 is an OS command injection in Security Center. The CVE description states a remote, unauthenticated attacker can execute arbitrary commands on the underlying OS with the service account privileges. The Tenable advisory for Security Center 6.9.0 notes this vulnerability among others...

CVE-2024-1471

CVE-2024-1471 is an HTML injection vulnerability affecting Tenable Security Center (prior to 6.3.0). An authenticated administrator could modify Repository parameters, potentially causing HTML redirection. Impact is described as Medium (per CVSS metrics: AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N or I:L...

CVE-2013-5911

The CVE-2013-5911 entry describes a cross-site scripting (XSS) vulnerability in Tenable SecurityCenter’s devform.php, affecting versions 4.6 through 4.7. The underlying cause is improper validation of user-supplied input to the message parameter, allowing an attacker to inject arbitrary HTML/Java...

CVE-2018-1154

The CVE-2018-1154 issue affects SecurityCenter prior to version 5.7.0, where an unauthenticated attacker could enumerate username aliases by brute-forcing responses, potentially leading to unauthorized access. The issue’s root cause is a username enumeration mechanism; mitigation configured in th...

CVE-2024-1367

Summary: CVE-2024-1367 is a command-injection vulnerability in Tenable Security Center. An authenticated, remote attacker with administrator privileges could modify Logging parameters, potentially executing arbitrary code on the Security Center host. The issue is mitigated by the Security Center ...

CVE-2018-1155

Tenable SecurityCenter (pre-5.7.0) is affected by an XSS vulnerability in the Reports feature: an authenticated attacker can inject JavaScript via the image filename parameter due to insufficient input validation. The issue is addressed in versions 5.7.0 and later through updated input validation...

CVE-2023-2005

This CVE affects Tenable.Io, Nessus, and Tenable Security Center prior to Plugin Feed ID #202306261202. The issue enables a user with scan-target permissions to place a binary in a specific filesystem location to escalate privileges via the impacted plugin. Remediation per PT-2023-17405 recommend...

CVE-2026-2697

CVE-2026-2697 is an IDOR vulnerability in Tenable Security Center prior to 6.8.0 where an authenticated remote attacker can escalate privileges via the owner parameter. Multiple sources (NVD, Red Hat, CVE listings, and Tenable advisory) confirm the issue and its association with Security Center. ...

CVE-2026-19628

CVE-2026-19628: A command injection vulnerability exists in Tenable Security Center. An authenticated administrator could modify application configuration values to achieve arbitrary command execution on the underlying OS when specific backend operations are triggered. Supported metrics show a Hi...

CVE-2026-19629

CVE-2026-19629 describes a privilege-escalation in Tenable Security Center where a user with the Security Manager role and “manage user” permission on a single group can modify users in other groups, bypassing cross-group access controls. The issue affects the Security Center component and is cla...

CVE-2026-19639

CVE-2026-19639 is an Improper Access Control vulnerability affecting Tenable Security Center. The issue allows an authenticated non-administrative application user to view settings outside their assigned scope. Tenable’s advisory (TENABLE:20EF43...) indicates the fix is delivered with Security Ce...

CVE-2026-19680

CVE-2026-19680 is a SQL injection vulnerability in Security Center that could allow an attacker to access unauthorized data from the application's database. The public records show a high-severity impact with CVSS metrics indicating network access and low privileges required. Tenable’s advisory f...

CVE-2026-19679

Affects Security Center; CVE-2026-19679 is described as an input validation issue in the file-upload handling where insufficient sanitization of filenames could contribute to a downstream command injection. Tenable’s advisory for Security Center version 6.9.0 notes fixes that upgrade core compone...

CVE-2026-2698

CVE-2026-2698 is an improper access control vulnerability described across multiple sources as allowing an authenticated user to access areas outside their authorized scope. Connected documents tie the issue to Tenable Security Center (and its 6.8.0 fix) and Red Hat/NVD entries, all noting the sa...

CVE-2026-64881

CVE-2026-64881 involves an audit file upload handler that fails to sanitize filenames, allowing shell metacharacters to flow into system command execution. This input validation failure enables command injection when chained with a related vulnerability. The CVSS scores indicate high impact to co...

CVE-2026-64878

CVE-2026-64878 is a command-injection vulnerability described as unvalidated input in asset filter parameters that allows shell metacharacters to escape command argument handling, enabling remote code execution on a low-privileged OS user via the Analysis REST endpoint. The connected Tenable advi...

CVE-2026-19635

CVE-2026-19635 is a local privilege escalation in Security Center. The advisory states: an attacker with write access to a specific configuration file can achieve arbitrary code execution with elevated privileges, without user interaction. The entry is listed in the Tenable advisory for Security ...

CVE-2026-64879

Technical details about CVE-2026-64879 are not publicly available in the provided documents. Monitor for updates.

CVE-2026-19631

CVE-2026-19631 describes a SQL injection vulnerability in Security Center that could allow an authenticated administrator to execute arbitrary SQL queries and access sensitive data, including credentials. Tenable’s advisory indicates Security Center 6.9.0 fixes multiple vulnerabilities and lists ...

CVE-2026-19636

The CVE-2026-19636 issue concerns CSRF token generation using a predictable method. The connected documents confirm a fix that increases randomness and entropy in token generation, addressing the vulnerability. The description does not specify affected products, versions, or exploit details. The ...

CVE-2026-64880

CVE-2026-64880 corresponds to a blind SQL injection in Tenable Security Center, caused by unsanitized user input in report filtering parameters that is concatenated into SQL queries. This can enable unauthorized database read access. The CVE is listed with a base score of 7.1 (HIGH) on CVSS v3.1/...