Tenable vulnerabilities
We track 47 vulnerabilities in Tenable products across 18 products. 46 are rated high or critical, and 3 have been exploited in real attacks. The most recent was published on October 8, 2026.
Latest Tenable vulnerabilities
- 8.8 High severity
Tenable.io, Tenable.sc and Nessus: Uncontrolled Search Path Element
A vulnerability was reported where through modifying the scan variables, an authenticated user in Tenable products, that has Scan Policy Configuration roles, could manipulate audit policy variables to execute arbitrary commands on credentialed scan targets.
- 8.8 High severity
Tenable.io, Tenable.sc, Nessus: Improper Privilege Management
As part of our Security Development Lifecycle, a potential privilege escalation issue was identified internally. This could allow a malicious actor with sufficient permissions to modify environment variables and abuse an impacted plugin in order to escalate pr
- 8.8 High severity
composer: Improper Neutralization of Argument Delimiters in a Command
Composer is a dependency manager for the PHP programming language. Integrators using Composer code to call `VcsDriver::getFileContent` can have a code injection vulnerability if the user can control the `$file` or `$identifier` argument. This leads to a vulner
- 7.5 High severity
moment: Improper Limitation of a Pathname to a Restricted Directory
Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directl
- 9.0 Critical severity
Apache HTTP Server-Side Request Forgery (SSRF) Exploited
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
- 6.1 Medium severity
JQuery Cross-Site Scripting (XSS) Exploited
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untr
- 9.8 Critical severity
PHP FastCGI Process Manager (FPM) Buffer Overflow Exploited
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility