Skip to content
Noroxi

Tenable records

185 published records for vendor tenable.

Researcher profile

Entered KEV
3 · 1.6%
Weaponized
5 · 2.7%
Pre-auth RCE
7
With a fix record
54.6%
Median publish → KEV
879 days

Records by year

  1. 17
  2. 18
  3. 19
  4. 20
  5. 21
  6. 22
  7. 23
  8. 24
  9. 25
  10. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

Bug bounty scope

The product’s vendor appears in a public program. Matched by name; verify the scope text in the program.

All records

185 records
  • CVE-2019-11043
    99Now

    Underflow in PHP-FPM can lead to RCE

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    php · phpOct 28, 2019

  • CVE-2021-40438
    96Now

    A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user.

    CriticalCVSS 9.0KEVWeaponizedEPSS 100%

    resf · rocky linuxSep 16, 2021

  • CVE-2020-11023
    79This week

    Potential XSS vulnerability in jQuery

    MediumCVSS 6.1KEVWeaponizedEPSS 85%

    jquery · jqueryApr 29, 2020

  • CVE-2021-44790
    68This week

    Possible buffer overflow when parsing multipart content in mod_lua of Apache HTTP Server 2.4.51 and earlier

    CriticalCVSS 9.8Proof of conceptEPSS 97%

    apache · http serverDec 20, 2021

  • CVE-2021-3711
    65This week

    SM2 Decryption Buffer Overflow

    CriticalCVSS 9.8No exploitEPSS 88%

    openssl · opensslAug 24, 2021

  • CVE-2021-44224
    57Plan

    Possible NULL dereference or SSRF in forward proxy configurations in Apache HTTP Server 2.4.51 and earlier

    HighCVSS 8.2No exploitEPSS 82%

    apache · http serverDec 20, 2021

  • CVE-2020-11022
    54Plan

    jQuery has a potential XSS vulnerability

    MediumCVSS 6.1Proof of conceptEPSS 99%

    jquery · jqueryApr 29, 2020

  • CVE-2022-0778
    52Plan

    Infinite loop in BN_mod_sqrt() reachable when parsing certificates

    HighCVSS 7.5Proof of conceptEPSS 73%

    openssl · opensslMar 15, 2022

  • CVE-2021-34798
    49Plan

    NULL pointer dereference in httpd core

    HighCVSS 7.5No exploitEPSS 65%

    apache · http serverSep 16, 2021

  • CVE-2020-1967
    46Plan

    Segmentation fault in SSL_check_chain

    HighCVSS 7.5Proof of conceptEPSS 53%

    openssl · opensslApr 21, 2020

  • CVE-2021-23840
    45Plan

    Integer overflow in CipherUpdate

    HighCVSS 7.5Proof of conceptEPSS 51%

    openssl · opensslFeb 16, 2021

  • CVE-2021-3712
    44Plan

    Read buffer overruns processing ASN.1 strings

    HighCVSS 7.4Proof of conceptEPSS 50%

    openssl · opensslAug 24, 2021

  • CVE-2021-33193
    44Plan

    Request splitting via HTTP/2 method injection and mod_proxy

    HighCVSS 7.5No exploitEPSS 46%

    debian · debian linuxAug 16, 2021

  • CVE-2017-8051
    44Plan

    Tenable Appliance 3.5 - 4.4.0, and possibly prior versions, contains a flaw in the simpleupload.py script in the Web UI.

    CriticalCVSS 9.8Proof of conceptEPSS 16%

    tenable · applianceApr 21, 2017

  • CVE-2021-3449
    42Plan

    NULL pointer deref in signature_algorithms processing

    MediumCVSS 5.9Proof of conceptEPSS 64%

    openssl · opensslMar 25, 2021

  • CVE-2020-11656
    41Plan

    In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER BY clause that belongs to a compo

    CriticalCVSS 9.8No exploitEPSS 8%

    sqlite · sqliteApr 8, 2020

  • CVE-2019-19919
    41Plan

    Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution.

    CriticalCVSS 9.8Proof of conceptEPSS 7%

    handlebars.js project · handlebars.jsDec 20, 2019

  • CVE-2016-4448
    41Plan

    Format string vulnerability in libxml2 before 2.9.4 allows attackers to have unspecified impact via format string specifiers in unknown vect

    CriticalCVSS 9.8No exploitEPSS 7%

    hp · icewall federation agentJun 9, 2016

  • CVE-2019-19646
    41Plan

    pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integrity_check PRAGMA command in certain cases of generated columns.

    CriticalCVSS 9.8No exploitEPSS 5%

    sqlite · sqliteDec 9, 2019

  • CVE-2026-19681
    40Plan

    An authenticated command injection vulnerability exists in Security Center related to file upload processing.

    CriticalCVSS 9.4WeaponizedEPSS 10%

    tenable · security centerAug 14, 2026

  • CVE-2022-22822
    40Plan

    addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

    CriticalCVSS 9.8Proof of conceptEPSS 5%

    libexpat project · libexpatJan 10, 2022

  • CVE-2022-23852
    40Plan

    Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.

    CriticalCVSS 9.8Proof of conceptEPSS 5%

    libexpat project · libexpatJan 23, 2022

  • CVE-2019-11049
    40Plan

    mail() may release string with refcount==1 twice

    CriticalCVSS 9.8No exploitEPSS 4%

    php · phpDec 22, 2019

  • CVE-2022-22823
    40Plan

    build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

    CriticalCVSS 9.8No exploitEPSS 3%

    libexpat project · libexpatJan 10, 2022

  • CVE-2022-22824
    40Plan

    defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

    CriticalCVSS 9.8No exploitEPSS 3%

    libexpat project · libexpatJan 10, 2022