Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-64879 | 9.4 critical | 2.0% | tenable, security_center | A filename supplied during file upload is not properly sanitized before being used in system command execution, allowing an attacker to inject shell metacharacters and achieve command injection via the audit file upload functionality. | Sat 24 Oct |
| CVE-2026-64881 | 8.7 high | 2.0% | tenable, security_center | The audit file upload handler does not sanitize filenames, allowing shell metacharacters to flow into system command execution. This input validation failure enables command injection when chained with a related vulnerability. | Sat 24 Oct |
| CVE-2026-64878 | 9.4 critical | 1.0% | tenable, security_center | Unvalidated input in asset filter parameters allows shell metacharacters to escape command argument handling, resulting in remote code execution as a low-privileged OS user via the Analysis REST endpoint. | Sat 24 Oct |
| CVE-2026-55727 | 7.5 high | 1.0% | no CPE yet | A flaw in the authentication mechanism for video stream requests in Genetec Security Center 5.14.0.0 prior to build 5.14.178.18 may allow an unauthenticated attacker to access live video streams. | Sun 25 Oct |
| CVE-2025-43027 | 9.8 critical | 0.00% | no CPE yet | A critical severity vulnerability has been identified in the ALPR Manager role of Security Center that could allow attackers to gain administrative access to the Genetec Security Center system. The Genetec engineering team discovered this issue internally. There is currently no evidence that this vulnerability has been exploited in the wild. | 8 Oct |
| CVE-2026-64877 | 9.4 critical | 0.00% | tenable, security_center | An authenticated non-admin user can exploit a SQL injection flaw in the ticketing REST API to access sensitive data stored in the appliance database. | Sat 24 Oct |
| CVE-2026-64880 | 7.1 high | 0.00% | tenable, security_center | Unsanitized user-supplied input in report filtering parameters is concatenated directly into SQL queries without proper escaping or parameterized queries, enabling blind SQL injection and unauthorized database read access. | Sat 24 Oct |
| CVE-2026-71347 | 7.0 high | 0.00% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Security Center allows an authorized attacker to elevate privileges locally. | 9 h ago |
| CVE-2026-70212 | 7.0 high | 0.00% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Improper restriction of communication channel to intended endpoints in Windows Security Center allows an authorized attacker to elevate privileges locally. | 10 h ago |
| CVE-2025-36636 | 4.3 medium | 0.00% | no CPE yet | In Tenable Security Center versions prior to 6.7.0, an improper access control vulnerability exists where an authenticated user could access areas outside of their authorized scope. | 8 Oct |
10 of 10
Download these 10 as CSV · subscribe to this list.
EPSS scores: 2026-10-28. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.