Detections
Analytics
CVEs
Tenable maintains a list of Common Vulnerabilities and Exposures (CVEs) and their affected products. Tenable augments the data to include related Tenable Plugins that detect each vulnerability. 327736 CVEs are indexed from NVD.
RSS Feeds
Search
Vulnerability Watch ›
CVE-2025-14847
highVulnerability of Interest
Exploitation of this MongoDB vulnerability have been reported and exploit code has been publicly released. Immediate patching is recommended.
CVE-2025-37164
criticalVulnerability of Interest
This HPE OneView RCE was assigned the maximum CVSS score of 10. Exploitation has been reported by CISA and a PoC has been released. Immediate patching is recommended.
CVE-2020-12812
criticalVulnerability of Interest
This improper authentication vulnerability affecting Fortinet devices is exploitable in certain configurations. Exploitation has been observed and patching is recommended.
CVE-2026-21877
criticalVulnerability Being Monitored
This RCE in n8n has received the maximum CVSS score of 10. Immediate patching is recommended.
CVE-2026-21858
criticalVulnerability Being Monitored
This RCE in n8n has received the maximum CVSS score of 10. Immediate patching is recommended.
CVE-2026-20029
mediumVulnerability Being Monitored
Public exploit code has been released. While no exploitation has been reported, immediate patching of this Cisco Identity Services Engine (ISE) flaw is recommended.
CVE-2025-52691
criticalVulnerability Being Monitored
While no evidence of exploitation has been observed, this RCE in SmarterMail should be patched as soon as possible. It was assigned the maximum CVSS score of 10
CVE-2025-13915
criticalVulnerability Being Monitored
This critical authentication bypass vulnerability affecting IBM API Connect should be patched as soon as possible.
Newest ›
CVE-2025-9222
high
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2.2 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated user to achieve stored cross-site scripting by exploiting GitLab Flavored Markdown.
CVE-2025-64093
critical
Remote Code Execution vulnerability that allows unauthenticated attackers to inject arbitrary commands into the hostname of the device.
CVE-2025-64092
high
This vulnerability allows unauthenticated attackers to inject an SQL request into GET request parameters and directly query the underlying database.
CVE-2025-64091
high
This vulnerability allows authenticated attackers to execute commands via the NTP-configuration of the device.
CVE-2025-64090
critical
This vulnerability allows authenticated attackers to execute commands via the hostname of the device.
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.3 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed a user to leak certain information by referencing specially crafted images that bypass asset proxy protection.
CVE-2025-13900
medium
The WP Popup Magic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter of the [wppum_end] shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2025-13895
medium
The Top Position Google Finance plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to, and including, 0.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVE-2025-13853
medium
The Nearby Now Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data_tech' parameter of the nn-tech shortcode in all versions up to, and including, 5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2025-13781
medium
GitLab has remediated an issue in GitLab EE affecting all versions from 18.5 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated user to modify instance-wide AI feature provider settings by exploiting missing authorization checks in GraphQL mutations.
Updated ›
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Monaco Skin allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Monaco Skin: 1.45, 1.44, 1.43, 1.39.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - GrowthExperiments Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - GrowthExperiments Extension: 1.45, 1.44, 1.43, 1.39.
Improper Encoding or Escaping of Output due to magic word replacement in ParserAfterTidy vulnerability in The Wikimedia Foundation Mediawiki - ApprovedRevs Extension allows Input Data Manipulation.This issue affects Mediawiki - ApprovedRevs Extension: 1.45, 1.44, 1.43, 1.39.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Wikibase Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Wikibase Extension: 1.45, 1.44, 1.43, 1.39.
CVE-2026-22636
No Score
Rejected reason: Not used
CVE-2026-22635
No Score
Rejected reason: Not used
CVE-2026-22634
No Score
Rejected reason: Not used
CVE-2026-22633
No Score
Rejected reason: Not used
CVE-2026-22632
No Score
Rejected reason: Not used
CVE-2026-22631
No Score
Rejected reason: Not used