Threat database

CVE-2026-18667 is a critical vulnerability in Tenable Sensor Proxy that allows remote code execution with elevated privileges. The attack requires an operator to connect the sensor to a host controlled by an attacker, which then enables the attacker to execute arbitrary code. The vulnerability is classified under CWE-94 (Improper Control of Generation of Code). No patch or official remediation information is currently available.

The audit file upload handler does not sanitize filenames, allowing shell metacharacters to flow into system command execution. This input validation failure enables command injection when chained with a related vulnerability.

CVE-2026-64880 is a high-severity SQL injection vulnerability in Tenable, Inc.'s Security Center. It arises from unsanitized user input in report filtering parameters being directly concatenated into SQL queries without proper escaping or parameterization. This flaw allows an attacker with low privileges to perform blind SQL injection, potentially leading to unauthorized read access to the database. No specific affected versions or patches are currently identified. The vulnerability does not require user interaction and has no known exploits in the wild as of the publication date.

A filename supplied during file upload is not properly sanitized before being used in system command execution, allowing an attacker to inject shell metacharacters and achieve command injection via the audit file upload functionality.

Unvalidated input in asset filter parameters allows shell metacharacters to escape command argument handling, resulting in remote code execution as a low-privileged OS user via the Analysis REST endpoint.

An authenticated non-admin user can exploit a SQL injection flaw in the ticketing REST API to access sensitive data stored in the appliance database.

CVE-2026-33694 is a high-severity vulnerability in Tenable Nessus and Nessus Agent involving improper link resolution before file access (CWE-59). It allows an attacker to create a junction that can lead to deletion of arbitrary files with SYSTEM privileges. This flaw potentially enables arbitrary code execution with elevated SYSTEM privileges. No official patch or remediation guidance is currently provided by the vendor. Exploits in the wild are not known at this time.

An SSH misconfigurations exists in Tenable OT that led to the potential exfiltration of socket, port, and service information via the ostunnel user and GatewayPorts. This could be used to potentially glean information about the underlying system and give an attacker information that could be used to attempt to compromise the host.