TI-2026-46387 CVE-2026-64881 · GHSA-737x-8xqc-h3gh
Command injection in Tenable Security Center
Priority MEDIUM 44
The audit file upload handler does not sanitize filenames, allowing shell metacharacters to flow into system command execution.
Vulnerabilities
5 records
TI-2026-46386 CVE-2026-64880 · GHSA-xjp8-j4mm-q4h6
Blind SQL injection in Tenable Security Center
Priority LOW 31
Unsanitized user-supplied input in report filtering parameters is concatenated directly into SQL queries without proper escaping or parameterized queries, enabling blind SQL injection and unauthorized database read acces…
TI-2026-46385 CVE-2026-64879 · GHSA-x2v3-fq4f-vvjj
Command injection in Tenable Security Center
Priority MEDIUM 47
A filename supplied during file upload is not properly sanitized before being used in system command execution, allowing an attacker to inject shell metacharacters and achieve command injection via the audit file upload…
TI-2026-46384 CVE-2026-64878 · GHSA-c67m-vcwh-5fgw
Command injection in Tenable Security Center
Priority MEDIUM 44
Unvalidated input in asset filter parameters allows shell metacharacters to escape command argument handling, resulting in remote code execution as a low-privileged OS user via the Analysis REST endpoint.
TI-2026-46383 CVE-2026-64877 · GHSA-7gcr-c8qh-g7jj
Improper input validation in Tenable Security Center
Priority MEDIUM 42
An authenticated non-admin user can exploit a SQL injection flaw in the ticketing REST API to access sensitive data stored in the appliance database.