CVEs.

Vulnerabilities published in the last two years in software made by the companies on the wall: clients, SDKs, agents and self-hosted editions. A CVE here does not mean the hosted service was affected or breached.

NVD data refreshed 32 min ago

Severity of matching CVEs

CVSS base severity, as scored in NVD

Critical: 9100%
High: 00%
Medium: 00%
Low or not scored: 00%

Matching CVEs: 9; Last two years
Critical: 9; CVSS 9.0 and above
High: 0; CVSS 7.0 to 8.9
Known exploited: 0; On CISA's KEV list

Matching CVEs published

By month, last two years

Peak 4 · July 2026

Most CVEs

In each company's software, last two years

Matching CVEs

9.4Crit
CVE-2026-19682 (opens in a new tab)
A command injection vulnerability exists in Security Center where a remote, unauthenticated attacker could exploit this issue to execute arbitrary commands on the underlying operating system with the privileges of the service account.
Tenable· Aug 14, 2026
9.4Crit
CVE-2026-19681 (opens in a new tab)
An authenticated command injection vulnerability exists in Security Center related to file upload processing. An attacker could exploit this issue by uploading a specially crafted file, potentially resulting in arbitrary command execution on the underlying operating system.
Tenable· Aug 14, 2026
9.4Crit
CVE-2026-19626 (opens in a new tab)
A remote code execution vulnerability exists in Tenable Security Center's report generation functionality. An authenticated, non-administrative user could exploit this issue by supplying specially crafted input that is later processed unsafely during server-side report rendering, resulting in arbitrary code execution with the privileges of the service account.
Tenable· Aug 14, 2026
9.4Crit
CVE-2026-64879 (opens in a new tab)
A filename supplied during file upload is not properly sanitized before being used in system command execution, allowing an attacker to inject shell metacharacters and achieve command injection via the audit file upload functionality.
Tenable· Jul 21, 2026
9.4Crit
CVE-2026-64878 (opens in a new tab)
Unvalidated input in asset filter parameters allows shell metacharacters to escape command argument handling, resulting in remote code execution as a low-privileged OS user via the Analysis REST endpoint.
Tenable· Jul 21, 2026
9.4Crit
CVE-2026-64877 (opens in a new tab)
An authenticated non-admin user can exploit a SQL injection flaw in the ticketing REST API to access sensitive data stored in the appliance database.
Tenable· Jul 21, 2026
9.4Crit
CVE-2026-15265 (opens in a new tab)
A path traversal vulnerability in Tenable Agent 11.2.0 and 11.1.3 and lower allows a privileged attacker to write arbitrary files outside the intended plugin directory, potentially leading to remote code execution.
Tenable· Jul 14, 2026
9.2Crit
CVE-2026-47358 (opens in a new tab)
Terrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery (SSRF) via external URL resolution in uploaded IaC templates when running in server mode. When Terrascan parses uploaded ARM templates or CloudFormation templates, it resolves external URLs referenced within those templates via hashicorp/go-getter with all default detectors enabled, including FileDetector. An unauthenticated remote attacker can upload an ARM template containing a templateLink.uri or parametersLink.uri field, or a CloudFormation template containing an AWS::CloudFormation::Stack TemplateURL field, pointing
Tenable· May 19, 2026
9.2Crit
CVE-2026-47357 (opens in a new tab)
Terrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery (SSRF) via the remote_url parameter in the remote directory scan endpoint (POST /v1/{iac}/{iacVersion}/{cloud}/remote/dir/scan) when running in server mode. An unauthenticated remote attacker can supply an attacker-controlled HTTP URL as remote_url with remote_type set to "http". The URL is passed directly to hashicorp/go-getter (v1.7.5) without validation. Go-getter's HttpGetter supports the X-Terraform-Get response header, allowing the attacker's server to redirect the download to a file:// URL, enabling local file rea
Tenable· May 19, 2026

Public information only

Everything on this page was already published by the companies themselves or by public bodies. statuswall gathers it in one place, links every item to its original, and adds nothing from private or leaked sources.

Sources

National Vulnerability Database (opens in a new tab): CVE IDs, descriptions, publication dates and CVSS severity, published by the U.S. government (NIST)
CISA Known Exploited Vulnerabilities catalog (opens in a new tab): the "Known exploited" flag

How fresh it is

New and changed CVEs: pulled from NVD every two hours; last run 32 min ago
Known-exploited flags: updated from CISA in the same run
Window: the last two years; older entries drop off automatically

Source: the U.S. National Vulnerability Database, refreshed daily, with the known-exploited flag from CISA's KEV catalog. Descriptions are NVD's. A CVE is listed under a company when NVD names that company's product as affected, or when the company's own CVE authority assigned it; companies whose names are common words are matched only by explicit rules, so some CVEs will be missing. This product uses NVD data but is not endorsed or certified by the NVD. CVE is a registered trademark of The MITRE Corporation.

statuswall is independent and is not affiliated with, sponsored by or endorsed by any company named here. Company and product names are used only to identify whose public information is being referred to. The information is provided as is, for general reference, with no guarantee that it is complete, current or free of error; it is not security, legal or purchasing advice. Where this page and an official source differ, the official source is right.