CVE Search

ID	Description	Severity
CVE-2026-341807	Tenable Identity Exposure leverages third-party software to help provide underlying functionality. Several of the third-party components (.NET Windows Server Hosting, NodeJS, Erlang OTP, SQL Server, OpenSSL, Curl) were found to contain vulnerabilities, and updated versions have been made available by the providers.Out of caution and in line with best practice, Tenable has opted to upgrade these components to address the potential impact of the issues. Tenable Identity Exposure version 3.93.5 updates .NET Windows Server Hosting to version 8.0.28.26269, NodeJS to version 20.20.2.0, Erlang OTP to version 26.2.5.21, SQL Server to version 15.0.4470.1, OpenSSL to version 4.0.1, and Curl to version 8.19.0 to address the identified vulnerabilities.Tenable Identity Exposure version v3.93.5 also resolves a vulnerability related to API endpoints returning information to unauthenticated GET requests (CVE-2026-13007). p.subtitle { display: none; } table { border-collapse: collapse; width: 100%; } th { background: #1a1a2e; color: #fff; padding: 8px 10px; text-align: left; font-size: 12px; letter-spacing: 0.04em; white-space: nowrap; } td { padding: 6px 10px; border-bottom: 1px solid #e5e7eb; vertical-align: top; } tr:hover td { background: #f5f7ff; } .cve-id { white-space: nowrap; } .vector { font-size: 11px; color: #444; word-break: break-all; } .score { font-weight: 600; white-space: nowrap; } .lozenge.critical { color: #fff; } .critical { color: #b91c1c; } .high { color: #c2410c; } .medium { color: #b45309; } .low { color: #15803d; } .badge { display: inline-block; padding: 1px 6px; border-radius: 3px; font-size: 11px; font-weight: 600; margin-right: 4px; } .badge.critical { background: #fee2e2; color: #991b1b; } .badge.high { background: #ffedd5; color: #9a3412; } .badge.medium { background: #fef9c3; color: #854d0e; } .badge.low { background: #dcfce7; color: #166534; } .cwe { font-size: 12px; } .empty { color: #aaa; } .new-row td { background: #f0fdf4; } .new-row:hover td { background: #dcfce7; }  CVE IDBase ScoreTemporal ScoreCVSSv3 VectorCVSSv4 Base ScoreCVSSv4 VectorCWEMEDIUMCVE-2025-111876.15.3CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H/E:U/RL:O/RC:C——CWE-121: Stack-based Buffer OverflowMEDIUMCVE-2025-130345.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C——CWE-345: Insufficient Verification of Data AuthenticityMEDIUMCVE-2025-140176.35.5CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-416: Use After FreeMEDIUMCVE-2025-145245.34.6CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2025-148195.34.6CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2025-150795.34.6CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorLOWCVE-2025-152243.12.7CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2025-154678.87.6CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-416: Use After FreeMEDIUMCVE-2025-154685.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2025-154695.54.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlCRITICALCVE-2025-551309.17.9CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-287: Improper AuthenticationHIGHCVE-2025-551317.16.2CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C——CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')MEDIUMCVE-2025-551325.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C4.8CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:NCWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2025-552477.36.3CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-269: Improper Privilege ManagementMEDIUMCVE-2025-552485.75CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorCRITICALCVE-2025-553159.98.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L/E:U/RL:O/RC:C——CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')HIGHCVE-2025-594657.56.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2025-594667.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2025-661995.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2025-681604.74.1CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2025-6941843.5CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2025-694197.46.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationHIGHCVE-2025-694207.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2025-694217.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-19656.55.7CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlMEDIUMCVE-2026-26736.55.7CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:U/RL:O/RC:C——CWE-284: Improper Access ControlMEDIUMCVE-2026-37835.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-37846.55.7CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-38057.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-48735.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-55456.55.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2026-57737.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-62535.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-62767.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-64295.34.6CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-70095.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-71685.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-73838.17CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationHIGHCVE-2026-90767.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-130077.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:NCWE-306: Missing Authentication for Critical Function; CWE-524: Use of Cache Containing Sensitive InformationHIGHCVE-2026-212187.56.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:NCWE-284: Improper Access ControlHIGHCVE-2026-212628.87.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2026-216377.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-217107.56.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-217135.95.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-217145.34.6CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionLOWCVE-2026-217153.32.9CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorLOWCVE-2026-217163.32.9CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlMEDIUMCVE-2026-217175.95.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-227955.54.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-227965.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-261307.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-261717.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-283867.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-125: Out-of-bounds ReadHIGHCVE-2026-283878.17CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationHIGHCVE-2026-283887.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-283897.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-283907.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionCRITICALCVE-2026-317899.88.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-119: Improper Restriction of Operations within the Bounds of a Memory BufferHIGHCVE-2026-317907.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-321677.86.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')MEDIUMCVE-2026-321754.33.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2026-321767.86.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')HIGHCVE-2026-321777.36.3CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C——CWE-269: Improper Privilege ManagementHIGHCVE-2026-321787.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-322037.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-331167.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-331208.87.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-822: Untrusted Pointer DereferenceHIGHCVE-2026-341807.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-341817.46.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationCRITICALCVE-2026-341829.17.9CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-287: Improper AuthenticationHIGHCVE-2026-341837.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-3518854.4CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-354337.36.3CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C——CWE-269: Improper Privilege ManagementHIGHCVE-2026-403708.87.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-73: External Control of File Name or PathHIGHCVE-2026-427647.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-427657.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-427665.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-427675.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionLOWCVE-2026-427683.73.2CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-427695.34.6CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorLOWCVE-2026-427703.73.2CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-427716.25.4CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-427894.84.2CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C7CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:NCWE-295: Improper Certificate ValidationHIGHCVE-2026-427908.17CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C7.6CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:NCWE-295: Improper Certificate ValidationHIGHCVE-2026-428997.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-454457.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-454464.84.2CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationHIGHCVE-2026-454478.87.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-287: Improper AuthenticationHIGHCVE-2026-454907.86.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-269: Improper Privilege ManagementMEDIUMCVE-2026-454915.54.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2026-455917.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource Consumption Tenable has released Tenable Identity Exposure version 3.93.5 to address these issues. The installation files can be obtained from the Tenable Downloads Portal: https://www.tenable.com/downloads/identity-exposure	high
CVE-2026-3518854	Tenable Identity Exposure leverages third-party software to help provide underlying functionality. Several of the third-party components (.NET Windows Server Hosting, NodeJS, Erlang OTP, SQL Server, OpenSSL, Curl) were found to contain vulnerabilities, and updated versions have been made available by the providers.Out of caution and in line with best practice, Tenable has opted to upgrade these components to address the potential impact of the issues. Tenable Identity Exposure version 3.93.5 updates .NET Windows Server Hosting to version 8.0.28.26269, NodeJS to version 20.20.2.0, Erlang OTP to version 26.2.5.21, SQL Server to version 15.0.4470.1, OpenSSL to version 4.0.1, and Curl to version 8.19.0 to address the identified vulnerabilities.Tenable Identity Exposure version v3.93.5 also resolves a vulnerability related to API endpoints returning information to unauthenticated GET requests (CVE-2026-13007). p.subtitle { display: none; } table { border-collapse: collapse; width: 100%; } th { background: #1a1a2e; color: #fff; padding: 8px 10px; text-align: left; font-size: 12px; letter-spacing: 0.04em; white-space: nowrap; } td { padding: 6px 10px; border-bottom: 1px solid #e5e7eb; vertical-align: top; } tr:hover td { background: #f5f7ff; } .cve-id { white-space: nowrap; } .vector { font-size: 11px; color: #444; word-break: break-all; } .score { font-weight: 600; white-space: nowrap; } .lozenge.critical { color: #fff; } .critical { color: #b91c1c; } .high { color: #c2410c; } .medium { color: #b45309; } .low { color: #15803d; } .badge { display: inline-block; padding: 1px 6px; border-radius: 3px; font-size: 11px; font-weight: 600; margin-right: 4px; } .badge.critical { background: #fee2e2; color: #991b1b; } .badge.high { background: #ffedd5; color: #9a3412; } .badge.medium { background: #fef9c3; color: #854d0e; } .badge.low { background: #dcfce7; color: #166534; } .cwe { font-size: 12px; } .empty { color: #aaa; } .new-row td { background: #f0fdf4; } .new-row:hover td { background: #dcfce7; }  CVE IDBase ScoreTemporal ScoreCVSSv3 VectorCVSSv4 Base ScoreCVSSv4 VectorCWEMEDIUMCVE-2025-111876.15.3CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H/E:U/RL:O/RC:C——CWE-121: Stack-based Buffer OverflowMEDIUMCVE-2025-130345.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C——CWE-345: Insufficient Verification of Data AuthenticityMEDIUMCVE-2025-140176.35.5CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-416: Use After FreeMEDIUMCVE-2025-145245.34.6CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2025-148195.34.6CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2025-150795.34.6CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorLOWCVE-2025-152243.12.7CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2025-154678.87.6CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-416: Use After FreeMEDIUMCVE-2025-154685.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2025-154695.54.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlCRITICALCVE-2025-551309.17.9CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-287: Improper AuthenticationHIGHCVE-2025-551317.16.2CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C——CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')MEDIUMCVE-2025-551325.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C4.8CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:NCWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2025-552477.36.3CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-269: Improper Privilege ManagementMEDIUMCVE-2025-552485.75CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorCRITICALCVE-2025-553159.98.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L/E:U/RL:O/RC:C——CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')HIGHCVE-2025-594657.56.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2025-594667.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2025-661995.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2025-681604.74.1CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2025-6941843.5CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2025-694197.46.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationHIGHCVE-2025-694207.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2025-694217.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-19656.55.7CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlMEDIUMCVE-2026-26736.55.7CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:U/RL:O/RC:C——CWE-284: Improper Access ControlMEDIUMCVE-2026-37835.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-37846.55.7CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-38057.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-48735.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-55456.55.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2026-57737.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-62535.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-62767.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-64295.34.6CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-70095.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-71685.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-73838.17CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationHIGHCVE-2026-90767.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-130077.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:NCWE-306: Missing Authentication for Critical Function; CWE-524: Use of Cache Containing Sensitive InformationHIGHCVE-2026-212187.56.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:NCWE-284: Improper Access ControlHIGHCVE-2026-212628.87.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2026-216377.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-217107.56.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-217135.95.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-217145.34.6CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionLOWCVE-2026-217153.32.9CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorLOWCVE-2026-217163.32.9CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlMEDIUMCVE-2026-217175.95.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-227955.54.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-227965.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-261307.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-261717.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-283867.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-125: Out-of-bounds ReadHIGHCVE-2026-283878.17CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationHIGHCVE-2026-283887.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-283897.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-283907.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionCRITICALCVE-2026-317899.88.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-119: Improper Restriction of Operations within the Bounds of a Memory BufferHIGHCVE-2026-317907.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-321677.86.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')MEDIUMCVE-2026-321754.33.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2026-321767.86.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')HIGHCVE-2026-321777.36.3CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C——CWE-269: Improper Privilege ManagementHIGHCVE-2026-321787.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-322037.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-331167.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-331208.87.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-822: Untrusted Pointer DereferenceHIGHCVE-2026-341807.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-341817.46.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationCRITICALCVE-2026-341829.17.9CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-287: Improper AuthenticationHIGHCVE-2026-341837.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-3518854.4CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-354337.36.3CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C——CWE-269: Improper Privilege ManagementHIGHCVE-2026-403708.87.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-73: External Control of File Name or PathHIGHCVE-2026-427647.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-427657.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-427665.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-427675.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionLOWCVE-2026-427683.73.2CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-427695.34.6CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorLOWCVE-2026-427703.73.2CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-427716.25.4CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-427894.84.2CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C7CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:NCWE-295: Improper Certificate ValidationHIGHCVE-2026-427908.17CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C7.6CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:NCWE-295: Improper Certificate ValidationHIGHCVE-2026-428997.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-454457.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-454464.84.2CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationHIGHCVE-2026-454478.87.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-287: Improper AuthenticationHIGHCVE-2026-454907.86.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-269: Improper Privilege ManagementMEDIUMCVE-2026-454915.54.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2026-455917.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource Consumption Tenable has released Tenable Identity Exposure version 3.93.5 to address these issues. The installation files can be obtained from the Tenable Downloads Portal: https://www.tenable.com/downloads/identity-exposure	high
CVE-2026-427657	Tenable Identity Exposure leverages third-party software to help provide underlying functionality. Several of the third-party components (.NET Windows Server Hosting, NodeJS, Erlang OTP, SQL Server, OpenSSL, Curl) were found to contain vulnerabilities, and updated versions have been made available by the providers.Out of caution and in line with best practice, Tenable has opted to upgrade these components to address the potential impact of the issues. Tenable Identity Exposure version 3.93.5 updates .NET Windows Server Hosting to version 8.0.28.26269, NodeJS to version 20.20.2.0, Erlang OTP to version 26.2.5.21, SQL Server to version 15.0.4470.1, OpenSSL to version 4.0.1, and Curl to version 8.19.0 to address the identified vulnerabilities.Tenable Identity Exposure version v3.93.5 also resolves a vulnerability related to API endpoints returning information to unauthenticated GET requests (CVE-2026-13007). p.subtitle { display: none; } table { border-collapse: collapse; width: 100%; } th { background: #1a1a2e; color: #fff; padding: 8px 10px; text-align: left; font-size: 12px; letter-spacing: 0.04em; white-space: nowrap; } td { padding: 6px 10px; border-bottom: 1px solid #e5e7eb; vertical-align: top; } tr:hover td { background: #f5f7ff; } .cve-id { white-space: nowrap; } .vector { font-size: 11px; color: #444; word-break: break-all; } .score { font-weight: 600; white-space: nowrap; } .lozenge.critical { color: #fff; } .critical { color: #b91c1c; } .high { color: #c2410c; } .medium { color: #b45309; } .low { color: #15803d; } .badge { display: inline-block; padding: 1px 6px; border-radius: 3px; font-size: 11px; font-weight: 600; margin-right: 4px; } .badge.critical { background: #fee2e2; color: #991b1b; } .badge.high { background: #ffedd5; color: #9a3412; } .badge.medium { background: #fef9c3; color: #854d0e; } .badge.low { background: #dcfce7; color: #166534; } .cwe { font-size: 12px; } .empty { color: #aaa; } .new-row td { background: #f0fdf4; } .new-row:hover td { background: #dcfce7; }  CVE IDBase ScoreTemporal ScoreCVSSv3 VectorCVSSv4 Base ScoreCVSSv4 VectorCWEMEDIUMCVE-2025-111876.15.3CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H/E:U/RL:O/RC:C——CWE-121: Stack-based Buffer OverflowMEDIUMCVE-2025-130345.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C——CWE-345: Insufficient Verification of Data AuthenticityMEDIUMCVE-2025-140176.35.5CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-416: Use After FreeMEDIUMCVE-2025-145245.34.6CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2025-148195.34.6CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2025-150795.34.6CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorLOWCVE-2025-152243.12.7CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2025-154678.87.6CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-416: Use After FreeMEDIUMCVE-2025-154685.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2025-154695.54.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlCRITICALCVE-2025-551309.17.9CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-287: Improper AuthenticationHIGHCVE-2025-551317.16.2CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C——CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')MEDIUMCVE-2025-551325.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C4.8CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:NCWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2025-552477.36.3CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-269: Improper Privilege ManagementMEDIUMCVE-2025-552485.75CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorCRITICALCVE-2025-553159.98.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L/E:U/RL:O/RC:C——CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')HIGHCVE-2025-594657.56.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2025-594667.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2025-661995.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2025-681604.74.1CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2025-6941843.5CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2025-694197.46.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationHIGHCVE-2025-694207.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2025-694217.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-19656.55.7CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlMEDIUMCVE-2026-26736.55.7CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:U/RL:O/RC:C——CWE-284: Improper Access ControlMEDIUMCVE-2026-37835.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-37846.55.7CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-38057.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-48735.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-55456.55.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2026-57737.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-62535.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-62767.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-64295.34.6CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-70095.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-71685.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-73838.17CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationHIGHCVE-2026-90767.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-130077.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:NCWE-306: Missing Authentication for Critical Function; CWE-524: Use of Cache Containing Sensitive InformationHIGHCVE-2026-212187.56.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:NCWE-284: Improper Access ControlHIGHCVE-2026-212628.87.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2026-216377.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-217107.56.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-217135.95.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-217145.34.6CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionLOWCVE-2026-217153.32.9CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorLOWCVE-2026-217163.32.9CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlMEDIUMCVE-2026-217175.95.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-227955.54.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-227965.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-261307.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-261717.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-283867.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-125: Out-of-bounds ReadHIGHCVE-2026-283878.17CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationHIGHCVE-2026-283887.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-283897.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-283907.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionCRITICALCVE-2026-317899.88.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-119: Improper Restriction of Operations within the Bounds of a Memory BufferHIGHCVE-2026-317907.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-321677.86.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')MEDIUMCVE-2026-321754.33.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2026-321767.86.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')HIGHCVE-2026-321777.36.3CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C——CWE-269: Improper Privilege ManagementHIGHCVE-2026-321787.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-322037.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-331167.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-331208.87.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-822: Untrusted Pointer DereferenceHIGHCVE-2026-341807.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-341817.46.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationCRITICALCVE-2026-341829.17.9CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-287: Improper AuthenticationHIGHCVE-2026-341837.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-3518854.4CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-354337.36.3CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C——CWE-269: Improper Privilege ManagementHIGHCVE-2026-403708.87.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-73: External Control of File Name or PathHIGHCVE-2026-427647.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-427657.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-427665.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-427675.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionLOWCVE-2026-427683.73.2CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-427695.34.6CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorLOWCVE-2026-427703.73.2CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-427716.25.4CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-427894.84.2CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C7CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:NCWE-295: Improper Certificate ValidationHIGHCVE-2026-427908.17CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C7.6CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:NCWE-295: Improper Certificate ValidationHIGHCVE-2026-428997.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-454457.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-454464.84.2CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationHIGHCVE-2026-454478.87.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-287: Improper AuthenticationHIGHCVE-2026-454907.86.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-269: Improper Privilege ManagementMEDIUMCVE-2026-454915.54.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2026-455917.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource Consumption Tenable has released Tenable Identity Exposure version 3.93.5 to address these issues. The installation files can be obtained from the Tenable Downloads Portal: https://www.tenable.com/downloads/identity-exposure	high
CVE-2026-427908	Tenable Identity Exposure leverages third-party software to help provide underlying functionality. Several of the third-party components (.NET Windows Server Hosting, NodeJS, Erlang OTP, SQL Server, OpenSSL, Curl) were found to contain vulnerabilities, and updated versions have been made available by the providers.Out of caution and in line with best practice, Tenable has opted to upgrade these components to address the potential impact of the issues. Tenable Identity Exposure version 3.93.5 updates .NET Windows Server Hosting to version 8.0.28.26269, NodeJS to version 20.20.2.0, Erlang OTP to version 26.2.5.21, SQL Server to version 15.0.4470.1, OpenSSL to version 4.0.1, and Curl to version 8.19.0 to address the identified vulnerabilities.Tenable Identity Exposure version v3.93.5 also resolves a vulnerability related to API endpoints returning information to unauthenticated GET requests (CVE-2026-13007). p.subtitle { display: none; } table { border-collapse: collapse; width: 100%; } th { background: #1a1a2e; color: #fff; padding: 8px 10px; text-align: left; font-size: 12px; letter-spacing: 0.04em; white-space: nowrap; } td { padding: 6px 10px; border-bottom: 1px solid #e5e7eb; vertical-align: top; } tr:hover td { background: #f5f7ff; } .cve-id { white-space: nowrap; } .vector { font-size: 11px; color: #444; word-break: break-all; } .score { font-weight: 600; white-space: nowrap; } .lozenge.critical { color: #fff; } .critical { color: #b91c1c; } .high { color: #c2410c; } .medium { color: #b45309; } .low { color: #15803d; } .badge { display: inline-block; padding: 1px 6px; border-radius: 3px; font-size: 11px; font-weight: 600; margin-right: 4px; } .badge.critical { background: #fee2e2; color: #991b1b; } .badge.high { background: #ffedd5; color: #9a3412; } .badge.medium { background: #fef9c3; color: #854d0e; } .badge.low { background: #dcfce7; color: #166534; } .cwe { font-size: 12px; } .empty { color: #aaa; } .new-row td { background: #f0fdf4; } .new-row:hover td { background: #dcfce7; }  CVE IDBase ScoreTemporal ScoreCVSSv3 VectorCVSSv4 Base ScoreCVSSv4 VectorCWEMEDIUMCVE-2025-111876.15.3CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H/E:U/RL:O/RC:C——CWE-121: Stack-based Buffer OverflowMEDIUMCVE-2025-130345.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C——CWE-345: Insufficient Verification of Data AuthenticityMEDIUMCVE-2025-140176.35.5CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-416: Use After FreeMEDIUMCVE-2025-145245.34.6CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2025-148195.34.6CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2025-150795.34.6CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorLOWCVE-2025-152243.12.7CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2025-154678.87.6CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-416: Use After FreeMEDIUMCVE-2025-154685.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2025-154695.54.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlCRITICALCVE-2025-551309.17.9CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-287: Improper AuthenticationHIGHCVE-2025-551317.16.2CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C——CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')MEDIUMCVE-2025-551325.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C4.8CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:NCWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2025-552477.36.3CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-269: Improper Privilege ManagementMEDIUMCVE-2025-552485.75CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorCRITICALCVE-2025-553159.98.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L/E:U/RL:O/RC:C——CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')HIGHCVE-2025-594657.56.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2025-594667.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2025-661995.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2025-681604.74.1CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2025-6941843.5CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2025-694197.46.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationHIGHCVE-2025-694207.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2025-694217.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-19656.55.7CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlMEDIUMCVE-2026-26736.55.7CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:U/RL:O/RC:C——CWE-284: Improper Access ControlMEDIUMCVE-2026-37835.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-37846.55.7CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-38057.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-48735.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-55456.55.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2026-57737.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-62535.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-62767.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-64295.34.6CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-70095.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-71685.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-73838.17CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationHIGHCVE-2026-90767.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-130077.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:NCWE-306: Missing Authentication for Critical Function; CWE-524: Use of Cache Containing Sensitive InformationHIGHCVE-2026-212187.56.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:NCWE-284: Improper Access ControlHIGHCVE-2026-212628.87.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2026-216377.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-217107.56.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-217135.95.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-217145.34.6CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionLOWCVE-2026-217153.32.9CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorLOWCVE-2026-217163.32.9CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlMEDIUMCVE-2026-217175.95.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-227955.54.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-227965.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-261307.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-261717.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-283867.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-125: Out-of-bounds ReadHIGHCVE-2026-283878.17CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationHIGHCVE-2026-283887.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-283897.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-283907.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionCRITICALCVE-2026-317899.88.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-119: Improper Restriction of Operations within the Bounds of a Memory BufferHIGHCVE-2026-317907.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-321677.86.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')MEDIUMCVE-2026-321754.33.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2026-321767.86.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')HIGHCVE-2026-321777.36.3CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C——CWE-269: Improper Privilege ManagementHIGHCVE-2026-321787.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-322037.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-331167.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-331208.87.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-822: Untrusted Pointer DereferenceHIGHCVE-2026-341807.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-341817.46.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationCRITICALCVE-2026-341829.17.9CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-287: Improper AuthenticationHIGHCVE-2026-341837.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-3518854.4CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-354337.36.3CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C——CWE-269: Improper Privilege ManagementHIGHCVE-2026-403708.87.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-73: External Control of File Name or PathHIGHCVE-2026-427647.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-427657.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-427665.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-427675.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionLOWCVE-2026-427683.73.2CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-427695.34.6CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorLOWCVE-2026-427703.73.2CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-427716.25.4CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-427894.84.2CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C7CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:NCWE-295: Improper Certificate ValidationHIGHCVE-2026-427908.17CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C7.6CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:NCWE-295: Improper Certificate ValidationHIGHCVE-2026-428997.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-454457.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-454464.84.2CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationHIGHCVE-2026-454478.87.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-287: Improper AuthenticationHIGHCVE-2026-454907.86.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-269: Improper Privilege ManagementMEDIUMCVE-2026-454915.54.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2026-455917.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource Consumption Tenable has released Tenable Identity Exposure version 3.93.5 to address these issues. The installation files can be obtained from the Tenable Downloads Portal: https://www.tenable.com/downloads/identity-exposure	high
CVE-2026-454478	Tenable Identity Exposure leverages third-party software to help provide underlying functionality. Several of the third-party components (.NET Windows Server Hosting, NodeJS, Erlang OTP, SQL Server, OpenSSL, Curl) were found to contain vulnerabilities, and updated versions have been made available by the providers.Out of caution and in line with best practice, Tenable has opted to upgrade these components to address the potential impact of the issues. Tenable Identity Exposure version 3.93.5 updates .NET Windows Server Hosting to version 8.0.28.26269, NodeJS to version 20.20.2.0, Erlang OTP to version 26.2.5.21, SQL Server to version 15.0.4470.1, OpenSSL to version 4.0.1, and Curl to version 8.19.0 to address the identified vulnerabilities.Tenable Identity Exposure version v3.93.5 also resolves a vulnerability related to API endpoints returning information to unauthenticated GET requests (CVE-2026-13007). p.subtitle { display: none; } table { border-collapse: collapse; width: 100%; } th { background: #1a1a2e; color: #fff; padding: 8px 10px; text-align: left; font-size: 12px; letter-spacing: 0.04em; white-space: nowrap; } td { padding: 6px 10px; border-bottom: 1px solid #e5e7eb; vertical-align: top; } tr:hover td { background: #f5f7ff; } .cve-id { white-space: nowrap; } .vector { font-size: 11px; color: #444; word-break: break-all; } .score { font-weight: 600; white-space: nowrap; } .lozenge.critical { color: #fff; } .critical { color: #b91c1c; } .high { color: #c2410c; } .medium { color: #b45309; } .low { color: #15803d; } .badge { display: inline-block; padding: 1px 6px; border-radius: 3px; font-size: 11px; font-weight: 600; margin-right: 4px; } .badge.critical { background: #fee2e2; color: #991b1b; } .badge.high { background: #ffedd5; color: #9a3412; } .badge.medium { background: #fef9c3; color: #854d0e; } .badge.low { background: #dcfce7; color: #166534; } .cwe { font-size: 12px; } .empty { color: #aaa; } .new-row td { background: #f0fdf4; } .new-row:hover td { background: #dcfce7; }  CVE IDBase ScoreTemporal ScoreCVSSv3 VectorCVSSv4 Base ScoreCVSSv4 VectorCWEMEDIUMCVE-2025-111876.15.3CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H/E:U/RL:O/RC:C——CWE-121: Stack-based Buffer OverflowMEDIUMCVE-2025-130345.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C——CWE-345: Insufficient Verification of Data AuthenticityMEDIUMCVE-2025-140176.35.5CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-416: Use After FreeMEDIUMCVE-2025-145245.34.6CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2025-148195.34.6CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2025-150795.34.6CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorLOWCVE-2025-152243.12.7CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2025-154678.87.6CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-416: Use After FreeMEDIUMCVE-2025-154685.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2025-154695.54.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlCRITICALCVE-2025-551309.17.9CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-287: Improper AuthenticationHIGHCVE-2025-551317.16.2CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C——CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')MEDIUMCVE-2025-551325.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C4.8CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:NCWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2025-552477.36.3CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-269: Improper Privilege ManagementMEDIUMCVE-2025-552485.75CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorCRITICALCVE-2025-553159.98.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L/E:U/RL:O/RC:C——CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')HIGHCVE-2025-594657.56.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2025-594667.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2025-661995.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2025-681604.74.1CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2025-6941843.5CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2025-694197.46.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationHIGHCVE-2025-694207.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2025-694217.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-19656.55.7CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlMEDIUMCVE-2026-26736.55.7CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:U/RL:O/RC:C——CWE-284: Improper Access ControlMEDIUMCVE-2026-37835.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-37846.55.7CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-38057.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-48735.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-55456.55.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2026-57737.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-62535.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-62767.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-64295.34.6CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-70095.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-71685.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-73838.17CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationHIGHCVE-2026-90767.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-130077.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:NCWE-306: Missing Authentication for Critical Function; CWE-524: Use of Cache Containing Sensitive InformationHIGHCVE-2026-212187.56.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:NCWE-284: Improper Access ControlHIGHCVE-2026-212628.87.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2026-216377.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-217107.56.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-217135.95.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-217145.34.6CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionLOWCVE-2026-217153.32.9CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorLOWCVE-2026-217163.32.9CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlMEDIUMCVE-2026-217175.95.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-227955.54.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-227965.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-261307.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-261717.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-283867.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-125: Out-of-bounds ReadHIGHCVE-2026-283878.17CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationHIGHCVE-2026-283887.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-283897.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-283907.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionCRITICALCVE-2026-317899.88.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-119: Improper Restriction of Operations within the Bounds of a Memory BufferHIGHCVE-2026-317907.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-321677.86.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')MEDIUMCVE-2026-321754.33.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2026-321767.86.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')HIGHCVE-2026-321777.36.3CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C——CWE-269: Improper Privilege ManagementHIGHCVE-2026-321787.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-322037.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-331167.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-331208.87.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-822: Untrusted Pointer DereferenceHIGHCVE-2026-341807.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-341817.46.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationCRITICALCVE-2026-341829.17.9CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-287: Improper AuthenticationHIGHCVE-2026-341837.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-3518854.4CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-354337.36.3CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C——CWE-269: Improper Privilege ManagementHIGHCVE-2026-403708.87.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-73: External Control of File Name or PathHIGHCVE-2026-427647.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-427657.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-427665.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-427675.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionLOWCVE-2026-427683.73.2CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-427695.34.6CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorLOWCVE-2026-427703.73.2CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-427716.25.4CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-427894.84.2CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C7CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:NCWE-295: Improper Certificate ValidationHIGHCVE-2026-427908.17CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C7.6CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:NCWE-295: Improper Certificate ValidationHIGHCVE-2026-428997.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-454457.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-454464.84.2CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationHIGHCVE-2026-454478.87.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-287: Improper AuthenticationHIGHCVE-2026-454907.86.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-269: Improper Privilege ManagementMEDIUMCVE-2026-454915.54.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2026-455917.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource Consumption Tenable has released Tenable Identity Exposure version 3.93.5 to address these issues. The installation files can be obtained from the Tenable Downloads Portal: https://www.tenable.com/downloads/identity-exposure	high
CVE-2026-62767	Tenable Identity Exposure leverages third-party software to help provide underlying functionality. Several of the third-party components (.NET Windows Server Hosting, NodeJS, Erlang OTP, SQL Server, OpenSSL, Curl) were found to contain vulnerabilities, and updated versions have been made available by the providers.Out of caution and in line with best practice, Tenable has opted to upgrade these components to address the potential impact of the issues. Tenable Identity Exposure version 3.93.5 updates .NET Windows Server Hosting to version 8.0.28.26269, NodeJS to version 20.20.2.0, Erlang OTP to version 26.2.5.21, SQL Server to version 15.0.4470.1, OpenSSL to version 4.0.1, and Curl to version 8.19.0 to address the identified vulnerabilities.Tenable Identity Exposure version v3.93.5 also resolves a vulnerability related to API endpoints returning information to unauthenticated GET requests (CVE-2026-13007). p.subtitle { display: none; } table { border-collapse: collapse; width: 100%; } th { background: #1a1a2e; color: #fff; padding: 8px 10px; text-align: left; font-size: 12px; letter-spacing: 0.04em; white-space: nowrap; } td { padding: 6px 10px; border-bottom: 1px solid #e5e7eb; vertical-align: top; } tr:hover td { background: #f5f7ff; } .cve-id { white-space: nowrap; } .vector { font-size: 11px; color: #444; word-break: break-all; } .score { font-weight: 600; white-space: nowrap; } .lozenge.critical { color: #fff; } .critical { color: #b91c1c; } .high { color: #c2410c; } .medium { color: #b45309; } .low { color: #15803d; } .badge { display: inline-block; padding: 1px 6px; border-radius: 3px; font-size: 11px; font-weight: 600; margin-right: 4px; } .badge.critical { background: #fee2e2; color: #991b1b; } .badge.high { background: #ffedd5; color: #9a3412; } .badge.medium { background: #fef9c3; color: #854d0e; } .badge.low { background: #dcfce7; color: #166534; } .cwe { font-size: 12px; } .empty { color: #aaa; } .new-row td { background: #f0fdf4; } .new-row:hover td { background: #dcfce7; }  CVE IDBase ScoreTemporal ScoreCVSSv3 VectorCVSSv4 Base ScoreCVSSv4 VectorCWEMEDIUMCVE-2025-111876.15.3CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H/E:U/RL:O/RC:C——CWE-121: Stack-based Buffer OverflowMEDIUMCVE-2025-130345.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C——CWE-345: Insufficient Verification of Data AuthenticityMEDIUMCVE-2025-140176.35.5CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-416: Use After FreeMEDIUMCVE-2025-145245.34.6CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2025-148195.34.6CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2025-150795.34.6CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorLOWCVE-2025-152243.12.7CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2025-154678.87.6CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-416: Use After FreeMEDIUMCVE-2025-154685.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2025-154695.54.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlCRITICALCVE-2025-551309.17.9CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-287: Improper AuthenticationHIGHCVE-2025-551317.16.2CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C——CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')MEDIUMCVE-2025-551325.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C4.8CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:NCWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2025-552477.36.3CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-269: Improper Privilege ManagementMEDIUMCVE-2025-552485.75CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorCRITICALCVE-2025-553159.98.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L/E:U/RL:O/RC:C——CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')HIGHCVE-2025-594657.56.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2025-594667.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2025-661995.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2025-681604.74.1CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2025-6941843.5CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2025-694197.46.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationHIGHCVE-2025-694207.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2025-694217.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-19656.55.7CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlMEDIUMCVE-2026-26736.55.7CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:U/RL:O/RC:C——CWE-284: Improper Access ControlMEDIUMCVE-2026-37835.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-37846.55.7CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-38057.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-48735.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-55456.55.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2026-57737.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-62535.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-62767.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-64295.34.6CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-70095.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-71685.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-73838.17CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationHIGHCVE-2026-90767.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-130077.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:NCWE-306: Missing Authentication for Critical Function; CWE-524: Use of Cache Containing Sensitive InformationHIGHCVE-2026-212187.56.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:NCWE-284: Improper Access ControlHIGHCVE-2026-212628.87.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2026-216377.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-217107.56.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-217135.95.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-217145.34.6CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionLOWCVE-2026-217153.32.9CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorLOWCVE-2026-217163.32.9CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlMEDIUMCVE-2026-217175.95.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-227955.54.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-227965.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-261307.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-261717.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-283867.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-125: Out-of-bounds ReadHIGHCVE-2026-283878.17CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationHIGHCVE-2026-283887.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-283897.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-283907.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionCRITICALCVE-2026-317899.88.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-119: Improper Restriction of Operations within the Bounds of a Memory BufferHIGHCVE-2026-317907.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-321677.86.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')MEDIUMCVE-2026-321754.33.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2026-321767.86.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')HIGHCVE-2026-321777.36.3CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C——CWE-269: Improper Privilege ManagementHIGHCVE-2026-321787.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-322037.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-331167.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-331208.87.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-822: Untrusted Pointer DereferenceHIGHCVE-2026-341807.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-341817.46.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationCRITICALCVE-2026-341829.17.9CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-287: Improper AuthenticationHIGHCVE-2026-341837.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-3518854.4CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-354337.36.3CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C——CWE-269: Improper Privilege ManagementHIGHCVE-2026-403708.87.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-73: External Control of File Name or PathHIGHCVE-2026-427647.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-427657.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-427665.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-427675.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionLOWCVE-2026-427683.73.2CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-427695.34.6CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorLOWCVE-2026-427703.73.2CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-427716.25.4CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-427894.84.2CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C7CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:NCWE-295: Improper Certificate ValidationHIGHCVE-2026-427908.17CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C7.6CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:NCWE-295: Improper Certificate ValidationHIGHCVE-2026-428997.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-454457.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-454464.84.2CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationHIGHCVE-2026-454478.87.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-287: Improper AuthenticationHIGHCVE-2026-454907.86.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-269: Improper Privilege ManagementMEDIUMCVE-2026-454915.54.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2026-455917.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource Consumption Tenable has released Tenable Identity Exposure version 3.93.5 to address these issues. The installation files can be obtained from the Tenable Downloads Portal: https://www.tenable.com/downloads/identity-exposure	high
CVE-2026-70095	Tenable Identity Exposure leverages third-party software to help provide underlying functionality. Several of the third-party components (.NET Windows Server Hosting, NodeJS, Erlang OTP, SQL Server, OpenSSL, Curl) were found to contain vulnerabilities, and updated versions have been made available by the providers.Out of caution and in line with best practice, Tenable has opted to upgrade these components to address the potential impact of the issues. Tenable Identity Exposure version 3.93.5 updates .NET Windows Server Hosting to version 8.0.28.26269, NodeJS to version 20.20.2.0, Erlang OTP to version 26.2.5.21, SQL Server to version 15.0.4470.1, OpenSSL to version 4.0.1, and Curl to version 8.19.0 to address the identified vulnerabilities.Tenable Identity Exposure version v3.93.5 also resolves a vulnerability related to API endpoints returning information to unauthenticated GET requests (CVE-2026-13007). p.subtitle { display: none; } table { border-collapse: collapse; width: 100%; } th { background: #1a1a2e; color: #fff; padding: 8px 10px; text-align: left; font-size: 12px; letter-spacing: 0.04em; white-space: nowrap; } td { padding: 6px 10px; border-bottom: 1px solid #e5e7eb; vertical-align: top; } tr:hover td { background: #f5f7ff; } .cve-id { white-space: nowrap; } .vector { font-size: 11px; color: #444; word-break: break-all; } .score { font-weight: 600; white-space: nowrap; } .lozenge.critical { color: #fff; } .critical { color: #b91c1c; } .high { color: #c2410c; } .medium { color: #b45309; } .low { color: #15803d; } .badge { display: inline-block; padding: 1px 6px; border-radius: 3px; font-size: 11px; font-weight: 600; margin-right: 4px; } .badge.critical { background: #fee2e2; color: #991b1b; } .badge.high { background: #ffedd5; color: #9a3412; } .badge.medium { background: #fef9c3; color: #854d0e; } .badge.low { background: #dcfce7; color: #166534; } .cwe { font-size: 12px; } .empty { color: #aaa; } .new-row td { background: #f0fdf4; } .new-row:hover td { background: #dcfce7; }  CVE IDBase ScoreTemporal ScoreCVSSv3 VectorCVSSv4 Base ScoreCVSSv4 VectorCWEMEDIUMCVE-2025-111876.15.3CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H/E:U/RL:O/RC:C——CWE-121: Stack-based Buffer OverflowMEDIUMCVE-2025-130345.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C——CWE-345: Insufficient Verification of Data AuthenticityMEDIUMCVE-2025-140176.35.5CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-416: Use After FreeMEDIUMCVE-2025-145245.34.6CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2025-148195.34.6CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2025-150795.34.6CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorLOWCVE-2025-152243.12.7CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2025-154678.87.6CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-416: Use After FreeMEDIUMCVE-2025-154685.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2025-154695.54.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlCRITICALCVE-2025-551309.17.9CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-287: Improper AuthenticationHIGHCVE-2025-551317.16.2CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C——CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')MEDIUMCVE-2025-551325.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C4.8CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:NCWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2025-552477.36.3CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-269: Improper Privilege ManagementMEDIUMCVE-2025-552485.75CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorCRITICALCVE-2025-553159.98.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L/E:U/RL:O/RC:C——CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')HIGHCVE-2025-594657.56.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2025-594667.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2025-661995.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2025-681604.74.1CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2025-6941843.5CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2025-694197.46.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationHIGHCVE-2025-694207.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2025-694217.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-19656.55.7CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlMEDIUMCVE-2026-26736.55.7CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:U/RL:O/RC:C——CWE-284: Improper Access ControlMEDIUMCVE-2026-37835.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-37846.55.7CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-38057.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-48735.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-55456.55.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2026-57737.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-62535.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-62767.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-64295.34.6CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-70095.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-71685.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-73838.17CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationHIGHCVE-2026-90767.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-130077.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:NCWE-306: Missing Authentication for Critical Function; CWE-524: Use of Cache Containing Sensitive InformationHIGHCVE-2026-212187.56.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:NCWE-284: Improper Access ControlHIGHCVE-2026-212628.87.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2026-216377.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-217107.56.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-217135.95.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-217145.34.6CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionLOWCVE-2026-217153.32.9CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorLOWCVE-2026-217163.32.9CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlMEDIUMCVE-2026-217175.95.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-227955.54.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-227965.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-261307.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-261717.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-283867.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-125: Out-of-bounds ReadHIGHCVE-2026-283878.17CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationHIGHCVE-2026-283887.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-283897.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-283907.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionCRITICALCVE-2026-317899.88.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-119: Improper Restriction of Operations within the Bounds of a Memory BufferHIGHCVE-2026-317907.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-321677.86.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')MEDIUMCVE-2026-321754.33.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2026-321767.86.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')HIGHCVE-2026-321777.36.3CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C——CWE-269: Improper Privilege ManagementHIGHCVE-2026-321787.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-322037.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-331167.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-331208.87.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-822: Untrusted Pointer DereferenceHIGHCVE-2026-341807.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-341817.46.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationCRITICALCVE-2026-341829.17.9CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-287: Improper AuthenticationHIGHCVE-2026-341837.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-3518854.4CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-354337.36.3CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C——CWE-269: Improper Privilege ManagementHIGHCVE-2026-403708.87.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-73: External Control of File Name or PathHIGHCVE-2026-427647.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-427657.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-427665.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-427675.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionLOWCVE-2026-427683.73.2CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-427695.34.6CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorLOWCVE-2026-427703.73.2CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-427716.25.4CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-427894.84.2CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C7CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:NCWE-295: Improper Certificate ValidationHIGHCVE-2026-427908.17CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C7.6CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:NCWE-295: Improper Certificate ValidationHIGHCVE-2026-428997.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-454457.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-454464.84.2CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationHIGHCVE-2026-454478.87.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-287: Improper AuthenticationHIGHCVE-2026-454907.86.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-269: Improper Privilege ManagementMEDIUMCVE-2026-454915.54.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2026-455917.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource Consumption Tenable has released Tenable Identity Exposure version 3.93.5 to address these issues. The installation files can be obtained from the Tenable Downloads Portal: https://www.tenable.com/downloads/identity-exposure	high
CVE-2026-71685	Tenable Identity Exposure leverages third-party software to help provide underlying functionality. Several of the third-party components (.NET Windows Server Hosting, NodeJS, Erlang OTP, SQL Server, OpenSSL, Curl) were found to contain vulnerabilities, and updated versions have been made available by the providers.Out of caution and in line with best practice, Tenable has opted to upgrade these components to address the potential impact of the issues. Tenable Identity Exposure version 3.93.5 updates .NET Windows Server Hosting to version 8.0.28.26269, NodeJS to version 20.20.2.0, Erlang OTP to version 26.2.5.21, SQL Server to version 15.0.4470.1, OpenSSL to version 4.0.1, and Curl to version 8.19.0 to address the identified vulnerabilities.Tenable Identity Exposure version v3.93.5 also resolves a vulnerability related to API endpoints returning information to unauthenticated GET requests (CVE-2026-13007). p.subtitle { display: none; } table { border-collapse: collapse; width: 100%; } th { background: #1a1a2e; color: #fff; padding: 8px 10px; text-align: left; font-size: 12px; letter-spacing: 0.04em; white-space: nowrap; } td { padding: 6px 10px; border-bottom: 1px solid #e5e7eb; vertical-align: top; } tr:hover td { background: #f5f7ff; } .cve-id { white-space: nowrap; } .vector { font-size: 11px; color: #444; word-break: break-all; } .score { font-weight: 600; white-space: nowrap; } .lozenge.critical { color: #fff; } .critical { color: #b91c1c; } .high { color: #c2410c; } .medium { color: #b45309; } .low { color: #15803d; } .badge { display: inline-block; padding: 1px 6px; border-radius: 3px; font-size: 11px; font-weight: 600; margin-right: 4px; } .badge.critical { background: #fee2e2; color: #991b1b; } .badge.high { background: #ffedd5; color: #9a3412; } .badge.medium { background: #fef9c3; color: #854d0e; } .badge.low { background: #dcfce7; color: #166534; } .cwe { font-size: 12px; } .empty { color: #aaa; } .new-row td { background: #f0fdf4; } .new-row:hover td { background: #dcfce7; }  CVE IDBase ScoreTemporal ScoreCVSSv3 VectorCVSSv4 Base ScoreCVSSv4 VectorCWEMEDIUMCVE-2025-111876.15.3CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H/E:U/RL:O/RC:C——CWE-121: Stack-based Buffer OverflowMEDIUMCVE-2025-130345.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C——CWE-345: Insufficient Verification of Data AuthenticityMEDIUMCVE-2025-140176.35.5CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-416: Use After FreeMEDIUMCVE-2025-145245.34.6CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2025-148195.34.6CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2025-150795.34.6CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorLOWCVE-2025-152243.12.7CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2025-154678.87.6CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-416: Use After FreeMEDIUMCVE-2025-154685.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2025-154695.54.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlCRITICALCVE-2025-551309.17.9CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-287: Improper AuthenticationHIGHCVE-2025-551317.16.2CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C——CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')MEDIUMCVE-2025-551325.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C4.8CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:NCWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2025-552477.36.3CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-269: Improper Privilege ManagementMEDIUMCVE-2025-552485.75CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorCRITICALCVE-2025-553159.98.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L/E:U/RL:O/RC:C——CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')HIGHCVE-2025-594657.56.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2025-594667.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2025-661995.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2025-681604.74.1CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2025-6941843.5CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2025-694197.46.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationHIGHCVE-2025-694207.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2025-694217.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-19656.55.7CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlMEDIUMCVE-2026-26736.55.7CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:U/RL:O/RC:C——CWE-284: Improper Access ControlMEDIUMCVE-2026-37835.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-37846.55.7CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-38057.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-48735.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-55456.55.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2026-57737.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-62535.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-62767.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-64295.34.6CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-70095.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-71685.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-73838.17CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationHIGHCVE-2026-90767.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-130077.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:NCWE-306: Missing Authentication for Critical Function; CWE-524: Use of Cache Containing Sensitive InformationHIGHCVE-2026-212187.56.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:NCWE-284: Improper Access ControlHIGHCVE-2026-212628.87.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2026-216377.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-217107.56.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-217135.95.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-217145.34.6CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionLOWCVE-2026-217153.32.9CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorLOWCVE-2026-217163.32.9CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlMEDIUMCVE-2026-217175.95.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-227955.54.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-227965.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-261307.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-261717.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-283867.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-125: Out-of-bounds ReadHIGHCVE-2026-283878.17CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationHIGHCVE-2026-283887.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-283897.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-283907.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionCRITICALCVE-2026-317899.88.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-119: Improper Restriction of Operations within the Bounds of a Memory BufferHIGHCVE-2026-317907.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-321677.86.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')MEDIUMCVE-2026-321754.33.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2026-321767.86.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')HIGHCVE-2026-321777.36.3CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C——CWE-269: Improper Privilege ManagementHIGHCVE-2026-321787.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-322037.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-331167.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-331208.87.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-822: Untrusted Pointer DereferenceHIGHCVE-2026-341807.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-341817.46.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationCRITICALCVE-2026-341829.17.9CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-287: Improper AuthenticationHIGHCVE-2026-341837.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-3518854.4CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-354337.36.3CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C——CWE-269: Improper Privilege ManagementHIGHCVE-2026-403708.87.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-73: External Control of File Name or PathHIGHCVE-2026-427647.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-427657.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-427665.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-427675.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionLOWCVE-2026-427683.73.2CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-427695.34.6CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorLOWCVE-2026-427703.73.2CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-427716.25.4CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-427894.84.2CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C7CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:NCWE-295: Improper Certificate ValidationHIGHCVE-2026-427908.17CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C7.6CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:NCWE-295: Improper Certificate ValidationHIGHCVE-2026-428997.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-454457.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-454464.84.2CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationHIGHCVE-2026-454478.87.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-287: Improper AuthenticationHIGHCVE-2026-454907.86.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-269: Improper Privilege ManagementMEDIUMCVE-2026-454915.54.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2026-455917.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource Consumption Tenable has released Tenable Identity Exposure version 3.93.5 to address these issues. The installation files can be obtained from the Tenable Downloads Portal: https://www.tenable.com/downloads/identity-exposure	high
CVE-2026-90767	Tenable Identity Exposure leverages third-party software to help provide underlying functionality. Several of the third-party components (.NET Windows Server Hosting, NodeJS, Erlang OTP, SQL Server, OpenSSL, Curl) were found to contain vulnerabilities, and updated versions have been made available by the providers.Out of caution and in line with best practice, Tenable has opted to upgrade these components to address the potential impact of the issues. Tenable Identity Exposure version 3.93.5 updates .NET Windows Server Hosting to version 8.0.28.26269, NodeJS to version 20.20.2.0, Erlang OTP to version 26.2.5.21, SQL Server to version 15.0.4470.1, OpenSSL to version 4.0.1, and Curl to version 8.19.0 to address the identified vulnerabilities.Tenable Identity Exposure version v3.93.5 also resolves a vulnerability related to API endpoints returning information to unauthenticated GET requests (CVE-2026-13007). p.subtitle { display: none; } table { border-collapse: collapse; width: 100%; } th { background: #1a1a2e; color: #fff; padding: 8px 10px; text-align: left; font-size: 12px; letter-spacing: 0.04em; white-space: nowrap; } td { padding: 6px 10px; border-bottom: 1px solid #e5e7eb; vertical-align: top; } tr:hover td { background: #f5f7ff; } .cve-id { white-space: nowrap; } .vector { font-size: 11px; color: #444; word-break: break-all; } .score { font-weight: 600; white-space: nowrap; } .lozenge.critical { color: #fff; } .critical { color: #b91c1c; } .high { color: #c2410c; } .medium { color: #b45309; } .low { color: #15803d; } .badge { display: inline-block; padding: 1px 6px; border-radius: 3px; font-size: 11px; font-weight: 600; margin-right: 4px; } .badge.critical { background: #fee2e2; color: #991b1b; } .badge.high { background: #ffedd5; color: #9a3412; } .badge.medium { background: #fef9c3; color: #854d0e; } .badge.low { background: #dcfce7; color: #166534; } .cwe { font-size: 12px; } .empty { color: #aaa; } .new-row td { background: #f0fdf4; } .new-row:hover td { background: #dcfce7; }  CVE IDBase ScoreTemporal ScoreCVSSv3 VectorCVSSv4 Base ScoreCVSSv4 VectorCWEMEDIUMCVE-2025-111876.15.3CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H/E:U/RL:O/RC:C——CWE-121: Stack-based Buffer OverflowMEDIUMCVE-2025-130345.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C——CWE-345: Insufficient Verification of Data AuthenticityMEDIUMCVE-2025-140176.35.5CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-416: Use After FreeMEDIUMCVE-2025-145245.34.6CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2025-148195.34.6CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2025-150795.34.6CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorLOWCVE-2025-152243.12.7CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2025-154678.87.6CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-416: Use After FreeMEDIUMCVE-2025-154685.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2025-154695.54.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlCRITICALCVE-2025-551309.17.9CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-287: Improper AuthenticationHIGHCVE-2025-551317.16.2CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C——CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')MEDIUMCVE-2025-551325.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C4.8CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:NCWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2025-552477.36.3CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-269: Improper Privilege ManagementMEDIUMCVE-2025-552485.75CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorCRITICALCVE-2025-553159.98.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L/E:U/RL:O/RC:C——CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')HIGHCVE-2025-594657.56.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2025-594667.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2025-661995.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2025-681604.74.1CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2025-6941843.5CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2025-694197.46.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationHIGHCVE-2025-694207.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2025-694217.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-19656.55.7CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlMEDIUMCVE-2026-26736.55.7CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:U/RL:O/RC:C——CWE-284: Improper Access ControlMEDIUMCVE-2026-37835.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-37846.55.7CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-38057.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-48735.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-55456.55.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2026-57737.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-62535.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-62767.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-64295.34.6CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-70095.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-71685.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-73838.17CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationHIGHCVE-2026-90767.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-130077.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:NCWE-306: Missing Authentication for Critical Function; CWE-524: Use of Cache Containing Sensitive InformationHIGHCVE-2026-212187.56.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:NCWE-284: Improper Access ControlHIGHCVE-2026-212628.87.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2026-216377.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-217107.56.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-217135.95.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-217145.34.6CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionLOWCVE-2026-217153.32.9CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorLOWCVE-2026-217163.32.9CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlMEDIUMCVE-2026-217175.95.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-227955.54.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-227965.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-261307.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-261717.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-283867.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-125: Out-of-bounds ReadHIGHCVE-2026-283878.17CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationHIGHCVE-2026-283887.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-283897.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-283907.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionCRITICALCVE-2026-317899.88.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-119: Improper Restriction of Operations within the Bounds of a Memory BufferHIGHCVE-2026-317907.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-321677.86.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')MEDIUMCVE-2026-321754.33.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2026-321767.86.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')HIGHCVE-2026-321777.36.3CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C——CWE-269: Improper Privilege ManagementHIGHCVE-2026-321787.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-322037.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-331167.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-331208.87.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-822: Untrusted Pointer DereferenceHIGHCVE-2026-341807.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-341817.46.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationCRITICALCVE-2026-341829.17.9CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-287: Improper AuthenticationHIGHCVE-2026-341837.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-3518854.4CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-354337.36.3CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C——CWE-269: Improper Privilege ManagementHIGHCVE-2026-403708.87.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-73: External Control of File Name or PathHIGHCVE-2026-427647.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-427657.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-427665.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-427675.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionLOWCVE-2026-427683.73.2CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-427695.34.6CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorLOWCVE-2026-427703.73.2CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-427716.25.4CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-427894.84.2CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C7CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:NCWE-295: Improper Certificate ValidationHIGHCVE-2026-427908.17CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C7.6CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:NCWE-295: Improper Certificate ValidationHIGHCVE-2026-428997.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-454457.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-454464.84.2CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationHIGHCVE-2026-454478.87.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-287: Improper AuthenticationHIGHCVE-2026-454907.86.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-269: Improper Privilege ManagementMEDIUMCVE-2026-454915.54.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2026-455917.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource Consumption Tenable has released Tenable Identity Exposure version 3.93.5 to address these issues. The installation files can be obtained from the Tenable Downloads Portal: https://www.tenable.com/downloads/identity-exposure	high
CVE-2011-2856	Google V8, as used in Google Chrome before 14.0.835.163, allows remote attackers to bypass the Same Origin Policy via unspecified vectors.	high
CVE-2011-1193	Google V8, as used in Google Chrome before 10.0.648.127, allows remote attackers to bypass the Same Origin Policy via unspecified vectors.	critical
CVE-2026-19546	A flaw was found in DBI. This is a fix for a partial fix for CVE-2026-14380 for RHEL 9.8.z and 10.2.z. For a detailed Statement, Description and Mitigation please reffer to the original https://access.redhat.com/security/cve/cve-2026-19546.	high
CVE-2016-1642	Multiple unspecified vulnerabilities in Google Chrome before 49.0.2623.75 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.	critical
CVE-2013-2886	Multiple unspecified vulnerabilities in Google Chrome before 28.0.1500.95 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.	critical
CVE-2026-42494	[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields without validating them: * The directory loop itself assumes a good record length. This is CVE-2026-42494. * The calculation of the System Use area may underflow. This is CVE-2026-42495. * The Rock Ridge extension loop assumes a good (inner) record length. This is CVE-2026-62423. * The Rock Ridge NM record processing assumes a good entry length. This is CVE-2026-62424. * The Rock Ridge CE record processing assumes a good size and offset. This is CVE-2026-62425.	medium
CVE-2026-47215	Automatic update for singularity-ce-4.4.2-1.fc45. ##### Changelog ``` * Wed Jun 10 2026 David Trudgian <[email protected]> - 4.4.2-1 - Upgrade to 4.4.2 upstream version. - Fix rhbz#2453093 - Fix rhbz#2458933 - Fix CVE-2026-47215 ```	medium
CVE-2015-1210	The V8ThrowException::createDOMException function in bindings/core/v8/V8ThrowException.cpp in the V8 bindings in Blink, as used in Google Chrome before 40.0.2214.111 on Windows, OS X, and Linux and before 40.0.2214.109 on Android, does not properly consider frame access restrictions during the throwing of an exception, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.	high
CVE-2021-31314	File upload vulnerability in ejinshan v8+ terminal security system allows attackers to upload arbitrary files to arbitrary locations on the server.	critical
CVE-2011-2332	Google V8, as used in Google Chrome before 12.0.742.91, allows remote attackers to bypass the Same Origin Policy via unspecified vectors.	high
CVE-2021-37991	Race in V8 in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.	high
CVE-2026-62425	[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields without validating them: * The directory loop itself assumes a good record length. This is CVE-2026-42494. * The calculation of the System Use area may underflow. This is CVE-2026-42495. * The Rock Ridge extension loop assumes a good (inner) record length. This is CVE-2026-62423. * The Rock Ridge NM record processing assumes a good entry length. This is CVE-2026-62424. * The Rock Ridge CE record processing assumes a good size and offset. This is CVE-2026-62425.	medium
CVE-2010-0657	Google Chrome before 4.0.249.78 on Windows does not perform the expected encoding, escaping, and quoting for the URL in the --app argument in a desktop shortcut, which allows user-assisted remote attackers to execute arbitrary programs or obtain sensitive information by tricking a user into creating a crafted shortcut.	high
CVE-2012-2862	Use-after-free vulnerability in the PDF functionality in Google Chrome before 21.0.1180.75 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted document.	high
CVE-2012-2895	The PDF functionality in Google Chrome before 22.0.1229.79 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger out-of-bounds write operations.	critical
CVE-2025-152243	Tenable Identity Exposure leverages third-party software to help provide underlying functionality. Several of the third-party components (.NET Windows Server Hosting, NodeJS, Erlang OTP, SQL Server, OpenSSL, Curl) were found to contain vulnerabilities, and updated versions have been made available by the providers.Out of caution and in line with best practice, Tenable has opted to upgrade these components to address the potential impact of the issues. Tenable Identity Exposure version 3.93.5 updates .NET Windows Server Hosting to version 8.0.28.26269, NodeJS to version 20.20.2.0, Erlang OTP to version 26.2.5.21, SQL Server to version 15.0.4470.1, OpenSSL to version 4.0.1, and Curl to version 8.19.0 to address the identified vulnerabilities.Tenable Identity Exposure version v3.93.5 also resolves a vulnerability related to API endpoints returning information to unauthenticated GET requests (CVE-2026-13007). p.subtitle { display: none; } table { border-collapse: collapse; width: 100%; } th { background: #1a1a2e; color: #fff; padding: 8px 10px; text-align: left; font-size: 12px; letter-spacing: 0.04em; white-space: nowrap; } td { padding: 6px 10px; border-bottom: 1px solid #e5e7eb; vertical-align: top; } tr:hover td { background: #f5f7ff; } .cve-id { white-space: nowrap; } .vector { font-size: 11px; color: #444; word-break: break-all; } .score { font-weight: 600; white-space: nowrap; } .lozenge.critical { color: #fff; } .critical { color: #b91c1c; } .high { color: #c2410c; } .medium { color: #b45309; } .low { color: #15803d; } .badge { display: inline-block; padding: 1px 6px; border-radius: 3px; font-size: 11px; font-weight: 600; margin-right: 4px; } .badge.critical { background: #fee2e2; color: #991b1b; } .badge.high { background: #ffedd5; color: #9a3412; } .badge.medium { background: #fef9c3; color: #854d0e; } .badge.low { background: #dcfce7; color: #166534; } .cwe { font-size: 12px; } .empty { color: #aaa; } .new-row td { background: #f0fdf4; } .new-row:hover td { background: #dcfce7; }  CVE IDBase ScoreTemporal ScoreCVSSv3 VectorCVSSv4 Base ScoreCVSSv4 VectorCWEMEDIUMCVE-2025-111876.15.3CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H/E:U/RL:O/RC:C——CWE-121: Stack-based Buffer OverflowMEDIUMCVE-2025-130345.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C——CWE-345: Insufficient Verification of Data AuthenticityMEDIUMCVE-2025-140176.35.5CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-416: Use After FreeMEDIUMCVE-2025-145245.34.6CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2025-148195.34.6CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2025-150795.34.6CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorLOWCVE-2025-152243.12.7CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2025-154678.87.6CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-416: Use After FreeMEDIUMCVE-2025-154685.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2025-154695.54.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlCRITICALCVE-2025-551309.17.9CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-287: Improper AuthenticationHIGHCVE-2025-551317.16.2CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C——CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')MEDIUMCVE-2025-551325.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C4.8CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:NCWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2025-552477.36.3CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-269: Improper Privilege ManagementMEDIUMCVE-2025-552485.75CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorCRITICALCVE-2025-553159.98.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L/E:U/RL:O/RC:C——CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')HIGHCVE-2025-594657.56.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2025-594667.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2025-661995.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2025-681604.74.1CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2025-6941843.5CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2025-694197.46.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationHIGHCVE-2025-694207.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2025-694217.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-19656.55.7CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlMEDIUMCVE-2026-26736.55.7CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:U/RL:O/RC:C——CWE-284: Improper Access ControlMEDIUMCVE-2026-37835.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-37846.55.7CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-38057.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-48735.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-55456.55.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2026-57737.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-62535.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-62767.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-64295.34.6CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-70095.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-71685.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-73838.17CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationHIGHCVE-2026-90767.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-130077.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:NCWE-306: Missing Authentication for Critical Function; CWE-524: Use of Cache Containing Sensitive InformationHIGHCVE-2026-212187.56.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:NCWE-284: Improper Access ControlHIGHCVE-2026-212628.87.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2026-216377.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-217107.56.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-217135.95.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-217145.34.6CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionLOWCVE-2026-217153.32.9CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorLOWCVE-2026-217163.32.9CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlMEDIUMCVE-2026-217175.95.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-227955.54.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-227965.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-261307.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-261717.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-283867.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-125: Out-of-bounds ReadHIGHCVE-2026-283878.17CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationHIGHCVE-2026-283887.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-283897.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-283907.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionCRITICALCVE-2026-317899.88.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-119: Improper Restriction of Operations within the Bounds of a Memory BufferHIGHCVE-2026-317907.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-321677.86.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')MEDIUMCVE-2026-321754.33.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2026-321767.86.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')HIGHCVE-2026-321777.36.3CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C——CWE-269: Improper Privilege ManagementHIGHCVE-2026-321787.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-322037.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-331167.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-331208.87.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-822: Untrusted Pointer DereferenceHIGHCVE-2026-341807.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-341817.46.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationCRITICALCVE-2026-341829.17.9CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-287: Improper AuthenticationHIGHCVE-2026-341837.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-3518854.4CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-354337.36.3CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C——CWE-269: Improper Privilege ManagementHIGHCVE-2026-403708.87.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-73: External Control of File Name or PathHIGHCVE-2026-427647.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-427657.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-427665.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-427675.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionLOWCVE-2026-427683.73.2CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-427695.34.6CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorLOWCVE-2026-427703.73.2CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-427716.25.4CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-427894.84.2CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C7CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:NCWE-295: Improper Certificate ValidationHIGHCVE-2026-427908.17CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C7.6CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:NCWE-295: Improper Certificate ValidationHIGHCVE-2026-428997.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-454457.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-454464.84.2CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationHIGHCVE-2026-454478.87.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-287: Improper AuthenticationHIGHCVE-2026-454907.86.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-269: Improper Privilege ManagementMEDIUMCVE-2026-454915.54.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2026-455917.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource Consumption Tenable has released Tenable Identity Exposure version 3.93.5 to address these issues. The installation files can be obtained from the Tenable Downloads Portal: https://www.tenable.com/downloads/identity-exposure	high
CVE-2025-551309	Tenable Identity Exposure leverages third-party software to help provide underlying functionality. Several of the third-party components (.NET Windows Server Hosting, NodeJS, Erlang OTP, SQL Server, OpenSSL, Curl) were found to contain vulnerabilities, and updated versions have been made available by the providers.Out of caution and in line with best practice, Tenable has opted to upgrade these components to address the potential impact of the issues. Tenable Identity Exposure version 3.93.5 updates .NET Windows Server Hosting to version 8.0.28.26269, NodeJS to version 20.20.2.0, Erlang OTP to version 26.2.5.21, SQL Server to version 15.0.4470.1, OpenSSL to version 4.0.1, and Curl to version 8.19.0 to address the identified vulnerabilities.Tenable Identity Exposure version v3.93.5 also resolves a vulnerability related to API endpoints returning information to unauthenticated GET requests (CVE-2026-13007). p.subtitle { display: none; } table { border-collapse: collapse; width: 100%; } th { background: #1a1a2e; color: #fff; padding: 8px 10px; text-align: left; font-size: 12px; letter-spacing: 0.04em; white-space: nowrap; } td { padding: 6px 10px; border-bottom: 1px solid #e5e7eb; vertical-align: top; } tr:hover td { background: #f5f7ff; } .cve-id { white-space: nowrap; } .vector { font-size: 11px; color: #444; word-break: break-all; } .score { font-weight: 600; white-space: nowrap; } .lozenge.critical { color: #fff; } .critical { color: #b91c1c; } .high { color: #c2410c; } .medium { color: #b45309; } .low { color: #15803d; } .badge { display: inline-block; padding: 1px 6px; border-radius: 3px; font-size: 11px; font-weight: 600; margin-right: 4px; } .badge.critical { background: #fee2e2; color: #991b1b; } .badge.high { background: #ffedd5; color: #9a3412; } .badge.medium { background: #fef9c3; color: #854d0e; } .badge.low { background: #dcfce7; color: #166534; } .cwe { font-size: 12px; } .empty { color: #aaa; } .new-row td { background: #f0fdf4; } .new-row:hover td { background: #dcfce7; }  CVE IDBase ScoreTemporal ScoreCVSSv3 VectorCVSSv4 Base ScoreCVSSv4 VectorCWEMEDIUMCVE-2025-111876.15.3CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H/E:U/RL:O/RC:C——CWE-121: Stack-based Buffer OverflowMEDIUMCVE-2025-130345.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C——CWE-345: Insufficient Verification of Data AuthenticityMEDIUMCVE-2025-140176.35.5CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-416: Use After FreeMEDIUMCVE-2025-145245.34.6CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2025-148195.34.6CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2025-150795.34.6CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorLOWCVE-2025-152243.12.7CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2025-154678.87.6CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-416: Use After FreeMEDIUMCVE-2025-154685.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2025-154695.54.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlCRITICALCVE-2025-551309.17.9CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-287: Improper AuthenticationHIGHCVE-2025-551317.16.2CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C——CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')MEDIUMCVE-2025-551325.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C4.8CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:NCWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2025-552477.36.3CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-269: Improper Privilege ManagementMEDIUMCVE-2025-552485.75CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorCRITICALCVE-2025-553159.98.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L/E:U/RL:O/RC:C——CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')HIGHCVE-2025-594657.56.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2025-594667.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2025-661995.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2025-681604.74.1CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2025-6941843.5CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2025-694197.46.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationHIGHCVE-2025-694207.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2025-694217.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-19656.55.7CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlMEDIUMCVE-2026-26736.55.7CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:U/RL:O/RC:C——CWE-284: Improper Access ControlMEDIUMCVE-2026-37835.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-37846.55.7CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-38057.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-48735.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-55456.55.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2026-57737.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-62535.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-62767.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-64295.34.6CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-70095.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-71685.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-73838.17CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationHIGHCVE-2026-90767.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-130077.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:NCWE-306: Missing Authentication for Critical Function; CWE-524: Use of Cache Containing Sensitive InformationHIGHCVE-2026-212187.56.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:NCWE-284: Improper Access ControlHIGHCVE-2026-212628.87.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2026-216377.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-217107.56.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-217135.95.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-217145.34.6CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionLOWCVE-2026-217153.32.9CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorLOWCVE-2026-217163.32.9CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlMEDIUMCVE-2026-217175.95.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-227955.54.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-227965.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-261307.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-261717.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-283867.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-125: Out-of-bounds ReadHIGHCVE-2026-283878.17CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationHIGHCVE-2026-283887.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-283897.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-283907.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionCRITICALCVE-2026-317899.88.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-119: Improper Restriction of Operations within the Bounds of a Memory BufferHIGHCVE-2026-317907.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-321677.86.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')MEDIUMCVE-2026-321754.33.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2026-321767.86.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')HIGHCVE-2026-321777.36.3CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C——CWE-269: Improper Privilege ManagementHIGHCVE-2026-321787.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-322037.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-331167.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-331208.87.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-822: Untrusted Pointer DereferenceHIGHCVE-2026-341807.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-341817.46.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationCRITICALCVE-2026-341829.17.9CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-287: Improper AuthenticationHIGHCVE-2026-341837.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-3518854.4CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-354337.36.3CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C——CWE-269: Improper Privilege ManagementHIGHCVE-2026-403708.87.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-73: External Control of File Name or PathHIGHCVE-2026-427647.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-427657.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-427665.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-427675.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionLOWCVE-2026-427683.73.2CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-427695.34.6CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorLOWCVE-2026-427703.73.2CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-427716.25.4CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-427894.84.2CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C7CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:NCWE-295: Improper Certificate ValidationHIGHCVE-2026-427908.17CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C7.6CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:NCWE-295: Improper Certificate ValidationHIGHCVE-2026-428997.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-454457.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-454464.84.2CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationHIGHCVE-2026-454478.87.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-287: Improper AuthenticationHIGHCVE-2026-454907.86.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-269: Improper Privilege ManagementMEDIUMCVE-2026-454915.54.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2026-455917.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource Consumption Tenable has released Tenable Identity Exposure version 3.93.5 to address these issues. The installation files can be obtained from the Tenable Downloads Portal: https://www.tenable.com/downloads/identity-exposure	high
CVE-2026-261307	Tenable Identity Exposure leverages third-party software to help provide underlying functionality. Several of the third-party components (.NET Windows Server Hosting, NodeJS, Erlang OTP, SQL Server, OpenSSL, Curl) were found to contain vulnerabilities, and updated versions have been made available by the providers.Out of caution and in line with best practice, Tenable has opted to upgrade these components to address the potential impact of the issues. Tenable Identity Exposure version 3.93.5 updates .NET Windows Server Hosting to version 8.0.28.26269, NodeJS to version 20.20.2.0, Erlang OTP to version 26.2.5.21, SQL Server to version 15.0.4470.1, OpenSSL to version 4.0.1, and Curl to version 8.19.0 to address the identified vulnerabilities.Tenable Identity Exposure version v3.93.5 also resolves a vulnerability related to API endpoints returning information to unauthenticated GET requests (CVE-2026-13007). p.subtitle { display: none; } table { border-collapse: collapse; width: 100%; } th { background: #1a1a2e; color: #fff; padding: 8px 10px; text-align: left; font-size: 12px; letter-spacing: 0.04em; white-space: nowrap; } td { padding: 6px 10px; border-bottom: 1px solid #e5e7eb; vertical-align: top; } tr:hover td { background: #f5f7ff; } .cve-id { white-space: nowrap; } .vector { font-size: 11px; color: #444; word-break: break-all; } .score { font-weight: 600; white-space: nowrap; } .lozenge.critical { color: #fff; } .critical { color: #b91c1c; } .high { color: #c2410c; } .medium { color: #b45309; } .low { color: #15803d; } .badge { display: inline-block; padding: 1px 6px; border-radius: 3px; font-size: 11px; font-weight: 600; margin-right: 4px; } .badge.critical { background: #fee2e2; color: #991b1b; } .badge.high { background: #ffedd5; color: #9a3412; } .badge.medium { background: #fef9c3; color: #854d0e; } .badge.low { background: #dcfce7; color: #166534; } .cwe { font-size: 12px; } .empty { color: #aaa; } .new-row td { background: #f0fdf4; } .new-row:hover td { background: #dcfce7; }  CVE IDBase ScoreTemporal ScoreCVSSv3 VectorCVSSv4 Base ScoreCVSSv4 VectorCWEMEDIUMCVE-2025-111876.15.3CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H/E:U/RL:O/RC:C——CWE-121: Stack-based Buffer OverflowMEDIUMCVE-2025-130345.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C——CWE-345: Insufficient Verification of Data AuthenticityMEDIUMCVE-2025-140176.35.5CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-416: Use After FreeMEDIUMCVE-2025-145245.34.6CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2025-148195.34.6CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2025-150795.34.6CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorLOWCVE-2025-152243.12.7CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2025-154678.87.6CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-416: Use After FreeMEDIUMCVE-2025-154685.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2025-154695.54.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlCRITICALCVE-2025-551309.17.9CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-287: Improper AuthenticationHIGHCVE-2025-551317.16.2CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C——CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')MEDIUMCVE-2025-551325.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C4.8CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:NCWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2025-552477.36.3CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-269: Improper Privilege ManagementMEDIUMCVE-2025-552485.75CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorCRITICALCVE-2025-553159.98.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L/E:U/RL:O/RC:C——CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')HIGHCVE-2025-594657.56.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2025-594667.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2025-661995.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2025-681604.74.1CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2025-6941843.5CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2025-694197.46.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationHIGHCVE-2025-694207.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2025-694217.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-19656.55.7CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlMEDIUMCVE-2026-26736.55.7CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:U/RL:O/RC:C——CWE-284: Improper Access ControlMEDIUMCVE-2026-37835.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-37846.55.7CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-38057.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-48735.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-55456.55.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2026-57737.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-62535.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-62767.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-64295.34.6CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-70095.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-71685.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-73838.17CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationHIGHCVE-2026-90767.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-130077.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:NCWE-306: Missing Authentication for Critical Function; CWE-524: Use of Cache Containing Sensitive InformationHIGHCVE-2026-212187.56.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:NCWE-284: Improper Access ControlHIGHCVE-2026-212628.87.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2026-216377.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-217107.56.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-217135.95.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-217145.34.6CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionLOWCVE-2026-217153.32.9CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorLOWCVE-2026-217163.32.9CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlMEDIUMCVE-2026-217175.95.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-227955.54.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-227965.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-261307.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-261717.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-283867.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-125: Out-of-bounds ReadHIGHCVE-2026-283878.17CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationHIGHCVE-2026-283887.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-283897.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-283907.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionCRITICALCVE-2026-317899.88.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-119: Improper Restriction of Operations within the Bounds of a Memory BufferHIGHCVE-2026-317907.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-321677.86.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')MEDIUMCVE-2026-321754.33.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2026-321767.86.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')HIGHCVE-2026-321777.36.3CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C——CWE-269: Improper Privilege ManagementHIGHCVE-2026-321787.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-322037.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-331167.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-331208.87.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-822: Untrusted Pointer DereferenceHIGHCVE-2026-341807.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-341817.46.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationCRITICALCVE-2026-341829.17.9CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-287: Improper AuthenticationHIGHCVE-2026-341837.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-3518854.4CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-354337.36.3CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C——CWE-269: Improper Privilege ManagementHIGHCVE-2026-403708.87.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-73: External Control of File Name or PathHIGHCVE-2026-427647.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-427657.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-427665.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-427675.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionLOWCVE-2026-427683.73.2CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-427695.34.6CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorLOWCVE-2026-427703.73.2CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-427716.25.4CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-427894.84.2CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C7CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:NCWE-295: Improper Certificate ValidationHIGHCVE-2026-427908.17CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C7.6CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:NCWE-295: Improper Certificate ValidationHIGHCVE-2026-428997.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-454457.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-454464.84.2CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationHIGHCVE-2026-454478.87.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-287: Improper AuthenticationHIGHCVE-2026-454907.86.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-269: Improper Privilege ManagementMEDIUMCVE-2026-454915.54.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2026-455917.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource Consumption Tenable has released Tenable Identity Exposure version 3.93.5 to address these issues. The installation files can be obtained from the Tenable Downloads Portal: https://www.tenable.com/downloads/identity-exposure	high
CVE-2026-322037	Tenable Identity Exposure leverages third-party software to help provide underlying functionality. Several of the third-party components (.NET Windows Server Hosting, NodeJS, Erlang OTP, SQL Server, OpenSSL, Curl) were found to contain vulnerabilities, and updated versions have been made available by the providers.Out of caution and in line with best practice, Tenable has opted to upgrade these components to address the potential impact of the issues. Tenable Identity Exposure version 3.93.5 updates .NET Windows Server Hosting to version 8.0.28.26269, NodeJS to version 20.20.2.0, Erlang OTP to version 26.2.5.21, SQL Server to version 15.0.4470.1, OpenSSL to version 4.0.1, and Curl to version 8.19.0 to address the identified vulnerabilities.Tenable Identity Exposure version v3.93.5 also resolves a vulnerability related to API endpoints returning information to unauthenticated GET requests (CVE-2026-13007). p.subtitle { display: none; } table { border-collapse: collapse; width: 100%; } th { background: #1a1a2e; color: #fff; padding: 8px 10px; text-align: left; font-size: 12px; letter-spacing: 0.04em; white-space: nowrap; } td { padding: 6px 10px; border-bottom: 1px solid #e5e7eb; vertical-align: top; } tr:hover td { background: #f5f7ff; } .cve-id { white-space: nowrap; } .vector { font-size: 11px; color: #444; word-break: break-all; } .score { font-weight: 600; white-space: nowrap; } .lozenge.critical { color: #fff; } .critical { color: #b91c1c; } .high { color: #c2410c; } .medium { color: #b45309; } .low { color: #15803d; } .badge { display: inline-block; padding: 1px 6px; border-radius: 3px; font-size: 11px; font-weight: 600; margin-right: 4px; } .badge.critical { background: #fee2e2; color: #991b1b; } .badge.high { background: #ffedd5; color: #9a3412; } .badge.medium { background: #fef9c3; color: #854d0e; } .badge.low { background: #dcfce7; color: #166534; } .cwe { font-size: 12px; } .empty { color: #aaa; } .new-row td { background: #f0fdf4; } .new-row:hover td { background: #dcfce7; }  CVE IDBase ScoreTemporal ScoreCVSSv3 VectorCVSSv4 Base ScoreCVSSv4 VectorCWEMEDIUMCVE-2025-111876.15.3CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H/E:U/RL:O/RC:C——CWE-121: Stack-based Buffer OverflowMEDIUMCVE-2025-130345.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C——CWE-345: Insufficient Verification of Data AuthenticityMEDIUMCVE-2025-140176.35.5CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-416: Use After FreeMEDIUMCVE-2025-145245.34.6CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2025-148195.34.6CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2025-150795.34.6CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorLOWCVE-2025-152243.12.7CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2025-154678.87.6CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-416: Use After FreeMEDIUMCVE-2025-154685.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2025-154695.54.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlCRITICALCVE-2025-551309.17.9CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-287: Improper AuthenticationHIGHCVE-2025-551317.16.2CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C——CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')MEDIUMCVE-2025-551325.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C4.8CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:NCWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2025-552477.36.3CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-269: Improper Privilege ManagementMEDIUMCVE-2025-552485.75CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorCRITICALCVE-2025-553159.98.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L/E:U/RL:O/RC:C——CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')HIGHCVE-2025-594657.56.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2025-594667.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2025-661995.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2025-681604.74.1CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2025-6941843.5CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2025-694197.46.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationHIGHCVE-2025-694207.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2025-694217.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-19656.55.7CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlMEDIUMCVE-2026-26736.55.7CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:U/RL:O/RC:C——CWE-284: Improper Access ControlMEDIUMCVE-2026-37835.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-37846.55.7CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-38057.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-48735.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-55456.55.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2026-57737.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-62535.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-62767.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-64295.34.6CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-70095.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-71685.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-73838.17CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationHIGHCVE-2026-90767.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-130077.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:NCWE-306: Missing Authentication for Critical Function; CWE-524: Use of Cache Containing Sensitive InformationHIGHCVE-2026-212187.56.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:NCWE-284: Improper Access ControlHIGHCVE-2026-212628.87.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2026-216377.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-217107.56.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-217135.95.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-217145.34.6CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionLOWCVE-2026-217153.32.9CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorLOWCVE-2026-217163.32.9CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlMEDIUMCVE-2026-217175.95.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-227955.54.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-227965.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-261307.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-261717.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-283867.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-125: Out-of-bounds ReadHIGHCVE-2026-283878.17CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationHIGHCVE-2026-283887.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-283897.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-283907.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionCRITICALCVE-2026-317899.88.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-119: Improper Restriction of Operations within the Bounds of a Memory BufferHIGHCVE-2026-317907.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-321677.86.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')MEDIUMCVE-2026-321754.33.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2026-321767.86.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')HIGHCVE-2026-321777.36.3CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C——CWE-269: Improper Privilege ManagementHIGHCVE-2026-321787.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-322037.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-331167.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-331208.87.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-822: Untrusted Pointer DereferenceHIGHCVE-2026-341807.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-341817.46.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationCRITICALCVE-2026-341829.17.9CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-287: Improper AuthenticationHIGHCVE-2026-341837.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-3518854.4CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-354337.36.3CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C——CWE-269: Improper Privilege ManagementHIGHCVE-2026-403708.87.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-73: External Control of File Name or PathHIGHCVE-2026-427647.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-427657.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-427665.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-427675.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionLOWCVE-2026-427683.73.2CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-427695.34.6CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorLOWCVE-2026-427703.73.2CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-427716.25.4CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-427894.84.2CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C7CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:NCWE-295: Improper Certificate ValidationHIGHCVE-2026-427908.17CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C7.6CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:NCWE-295: Improper Certificate ValidationHIGHCVE-2026-428997.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-454457.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-454464.84.2CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationHIGHCVE-2026-454478.87.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-287: Improper AuthenticationHIGHCVE-2026-454907.86.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-269: Improper Privilege ManagementMEDIUMCVE-2026-454915.54.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2026-455917.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource Consumption Tenable has released Tenable Identity Exposure version 3.93.5 to address these issues. The installation files can be obtained from the Tenable Downloads Portal: https://www.tenable.com/downloads/identity-exposure	high
CVE-2026-37846	Tenable Identity Exposure leverages third-party software to help provide underlying functionality. Several of the third-party components (.NET Windows Server Hosting, NodeJS, Erlang OTP, SQL Server, OpenSSL, Curl) were found to contain vulnerabilities, and updated versions have been made available by the providers.Out of caution and in line with best practice, Tenable has opted to upgrade these components to address the potential impact of the issues. Tenable Identity Exposure version 3.93.5 updates .NET Windows Server Hosting to version 8.0.28.26269, NodeJS to version 20.20.2.0, Erlang OTP to version 26.2.5.21, SQL Server to version 15.0.4470.1, OpenSSL to version 4.0.1, and Curl to version 8.19.0 to address the identified vulnerabilities.Tenable Identity Exposure version v3.93.5 also resolves a vulnerability related to API endpoints returning information to unauthenticated GET requests (CVE-2026-13007). p.subtitle { display: none; } table { border-collapse: collapse; width: 100%; } th { background: #1a1a2e; color: #fff; padding: 8px 10px; text-align: left; font-size: 12px; letter-spacing: 0.04em; white-space: nowrap; } td { padding: 6px 10px; border-bottom: 1px solid #e5e7eb; vertical-align: top; } tr:hover td { background: #f5f7ff; } .cve-id { white-space: nowrap; } .vector { font-size: 11px; color: #444; word-break: break-all; } .score { font-weight: 600; white-space: nowrap; } .lozenge.critical { color: #fff; } .critical { color: #b91c1c; } .high { color: #c2410c; } .medium { color: #b45309; } .low { color: #15803d; } .badge { display: inline-block; padding: 1px 6px; border-radius: 3px; font-size: 11px; font-weight: 600; margin-right: 4px; } .badge.critical { background: #fee2e2; color: #991b1b; } .badge.high { background: #ffedd5; color: #9a3412; } .badge.medium { background: #fef9c3; color: #854d0e; } .badge.low { background: #dcfce7; color: #166534; } .cwe { font-size: 12px; } .empty { color: #aaa; } .new-row td { background: #f0fdf4; } .new-row:hover td { background: #dcfce7; }  CVE IDBase ScoreTemporal ScoreCVSSv3 VectorCVSSv4 Base ScoreCVSSv4 VectorCWEMEDIUMCVE-2025-111876.15.3CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H/E:U/RL:O/RC:C——CWE-121: Stack-based Buffer OverflowMEDIUMCVE-2025-130345.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C——CWE-345: Insufficient Verification of Data AuthenticityMEDIUMCVE-2025-140176.35.5CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-416: Use After FreeMEDIUMCVE-2025-145245.34.6CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2025-148195.34.6CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2025-150795.34.6CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorLOWCVE-2025-152243.12.7CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2025-154678.87.6CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-416: Use After FreeMEDIUMCVE-2025-154685.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2025-154695.54.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlCRITICALCVE-2025-551309.17.9CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-287: Improper AuthenticationHIGHCVE-2025-551317.16.2CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C——CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')MEDIUMCVE-2025-551325.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C4.8CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:NCWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2025-552477.36.3CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-269: Improper Privilege ManagementMEDIUMCVE-2025-552485.75CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorCRITICALCVE-2025-553159.98.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L/E:U/RL:O/RC:C——CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')HIGHCVE-2025-594657.56.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2025-594667.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2025-661995.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2025-681604.74.1CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2025-6941843.5CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2025-694197.46.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationHIGHCVE-2025-694207.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2025-694217.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-19656.55.7CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlMEDIUMCVE-2026-26736.55.7CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:U/RL:O/RC:C——CWE-284: Improper Access ControlMEDIUMCVE-2026-37835.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-37846.55.7CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-38057.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-48735.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-55456.55.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2026-57737.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-62535.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-62767.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-64295.34.6CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-70095.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-71685.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-73838.17CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationHIGHCVE-2026-90767.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-130077.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:NCWE-306: Missing Authentication for Critical Function; CWE-524: Use of Cache Containing Sensitive InformationHIGHCVE-2026-212187.56.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:NCWE-284: Improper Access ControlHIGHCVE-2026-212628.87.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2026-216377.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-217107.56.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-217135.95.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-217145.34.6CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionLOWCVE-2026-217153.32.9CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorLOWCVE-2026-217163.32.9CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlMEDIUMCVE-2026-217175.95.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-227955.54.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-227965.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-261307.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-261717.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-283867.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-125: Out-of-bounds ReadHIGHCVE-2026-283878.17CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationHIGHCVE-2026-283887.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-283897.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-283907.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionCRITICALCVE-2026-317899.88.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-119: Improper Restriction of Operations within the Bounds of a Memory BufferHIGHCVE-2026-317907.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-321677.86.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')MEDIUMCVE-2026-321754.33.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2026-321767.86.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')HIGHCVE-2026-321777.36.3CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C——CWE-269: Improper Privilege ManagementHIGHCVE-2026-321787.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-322037.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-331167.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-331208.87.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-822: Untrusted Pointer DereferenceHIGHCVE-2026-341807.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-341817.46.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationCRITICALCVE-2026-341829.17.9CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-287: Improper AuthenticationHIGHCVE-2026-341837.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-3518854.4CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-354337.36.3CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C——CWE-269: Improper Privilege ManagementHIGHCVE-2026-403708.87.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-73: External Control of File Name or PathHIGHCVE-2026-427647.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-427657.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-427665.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-427675.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionLOWCVE-2026-427683.73.2CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-427695.34.6CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorLOWCVE-2026-427703.73.2CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-427716.25.4CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-427894.84.2CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C7CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:NCWE-295: Improper Certificate ValidationHIGHCVE-2026-427908.17CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C7.6CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:NCWE-295: Improper Certificate ValidationHIGHCVE-2026-428997.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-454457.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-454464.84.2CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationHIGHCVE-2026-454478.87.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-287: Improper AuthenticationHIGHCVE-2026-454907.86.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-269: Improper Privilege ManagementMEDIUMCVE-2026-454915.54.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2026-455917.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource Consumption Tenable has released Tenable Identity Exposure version 3.93.5 to address these issues. The installation files can be obtained from the Tenable Downloads Portal: https://www.tenable.com/downloads/identity-exposure	high
CVE-2026-427683	Tenable Identity Exposure leverages third-party software to help provide underlying functionality. Several of the third-party components (.NET Windows Server Hosting, NodeJS, Erlang OTP, SQL Server, OpenSSL, Curl) were found to contain vulnerabilities, and updated versions have been made available by the providers.Out of caution and in line with best practice, Tenable has opted to upgrade these components to address the potential impact of the issues. Tenable Identity Exposure version 3.93.5 updates .NET Windows Server Hosting to version 8.0.28.26269, NodeJS to version 20.20.2.0, Erlang OTP to version 26.2.5.21, SQL Server to version 15.0.4470.1, OpenSSL to version 4.0.1, and Curl to version 8.19.0 to address the identified vulnerabilities.Tenable Identity Exposure version v3.93.5 also resolves a vulnerability related to API endpoints returning information to unauthenticated GET requests (CVE-2026-13007). p.subtitle { display: none; } table { border-collapse: collapse; width: 100%; } th { background: #1a1a2e; color: #fff; padding: 8px 10px; text-align: left; font-size: 12px; letter-spacing: 0.04em; white-space: nowrap; } td { padding: 6px 10px; border-bottom: 1px solid #e5e7eb; vertical-align: top; } tr:hover td { background: #f5f7ff; } .cve-id { white-space: nowrap; } .vector { font-size: 11px; color: #444; word-break: break-all; } .score { font-weight: 600; white-space: nowrap; } .lozenge.critical { color: #fff; } .critical { color: #b91c1c; } .high { color: #c2410c; } .medium { color: #b45309; } .low { color: #15803d; } .badge { display: inline-block; padding: 1px 6px; border-radius: 3px; font-size: 11px; font-weight: 600; margin-right: 4px; } .badge.critical { background: #fee2e2; color: #991b1b; } .badge.high { background: #ffedd5; color: #9a3412; } .badge.medium { background: #fef9c3; color: #854d0e; } .badge.low { background: #dcfce7; color: #166534; } .cwe { font-size: 12px; } .empty { color: #aaa; } .new-row td { background: #f0fdf4; } .new-row:hover td { background: #dcfce7; }  CVE IDBase ScoreTemporal ScoreCVSSv3 VectorCVSSv4 Base ScoreCVSSv4 VectorCWEMEDIUMCVE-2025-111876.15.3CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H/E:U/RL:O/RC:C——CWE-121: Stack-based Buffer OverflowMEDIUMCVE-2025-130345.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C——CWE-345: Insufficient Verification of Data AuthenticityMEDIUMCVE-2025-140176.35.5CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-416: Use After FreeMEDIUMCVE-2025-145245.34.6CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2025-148195.34.6CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2025-150795.34.6CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorLOWCVE-2025-152243.12.7CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2025-154678.87.6CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-416: Use After FreeMEDIUMCVE-2025-154685.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2025-154695.54.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlCRITICALCVE-2025-551309.17.9CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-287: Improper AuthenticationHIGHCVE-2025-551317.16.2CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C——CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')MEDIUMCVE-2025-551325.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C4.8CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:NCWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2025-552477.36.3CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-269: Improper Privilege ManagementMEDIUMCVE-2025-552485.75CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorCRITICALCVE-2025-553159.98.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L/E:U/RL:O/RC:C——CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')HIGHCVE-2025-594657.56.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2025-594667.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2025-661995.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2025-681604.74.1CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2025-6941843.5CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2025-694197.46.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationHIGHCVE-2025-694207.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2025-694217.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-19656.55.7CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlMEDIUMCVE-2026-26736.55.7CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:U/RL:O/RC:C——CWE-284: Improper Access ControlMEDIUMCVE-2026-37835.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-37846.55.7CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-38057.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-48735.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-55456.55.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2026-57737.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-62535.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-62767.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-64295.34.6CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-70095.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-71685.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-73838.17CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationHIGHCVE-2026-90767.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-130077.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:NCWE-306: Missing Authentication for Critical Function; CWE-524: Use of Cache Containing Sensitive InformationHIGHCVE-2026-212187.56.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:NCWE-284: Improper Access ControlHIGHCVE-2026-212628.87.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2026-216377.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-217107.56.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-217135.95.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-217145.34.6CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionLOWCVE-2026-217153.32.9CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorLOWCVE-2026-217163.32.9CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlMEDIUMCVE-2026-217175.95.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-227955.54.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-227965.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-261307.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-261717.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-283867.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-125: Out-of-bounds ReadHIGHCVE-2026-283878.17CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationHIGHCVE-2026-283887.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-283897.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-283907.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionCRITICALCVE-2026-317899.88.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-119: Improper Restriction of Operations within the Bounds of a Memory BufferHIGHCVE-2026-317907.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-321677.86.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')MEDIUMCVE-2026-321754.33.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2026-321767.86.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')HIGHCVE-2026-321777.36.3CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C——CWE-269: Improper Privilege ManagementHIGHCVE-2026-321787.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-322037.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-331167.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-331208.87.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-822: Untrusted Pointer DereferenceHIGHCVE-2026-341807.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-341817.46.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationCRITICALCVE-2026-341829.17.9CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-287: Improper AuthenticationHIGHCVE-2026-341837.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-3518854.4CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-354337.36.3CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C——CWE-269: Improper Privilege ManagementHIGHCVE-2026-403708.87.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-73: External Control of File Name or PathHIGHCVE-2026-427647.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-427657.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-427665.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-427675.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionLOWCVE-2026-427683.73.2CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-427695.34.6CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorLOWCVE-2026-427703.73.2CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-427716.25.4CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-427894.84.2CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C7CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:NCWE-295: Improper Certificate ValidationHIGHCVE-2026-427908.17CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C7.6CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:NCWE-295: Improper Certificate ValidationHIGHCVE-2026-428997.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-454457.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-454464.84.2CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationHIGHCVE-2026-454478.87.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-287: Improper AuthenticationHIGHCVE-2026-454907.86.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-269: Improper Privilege ManagementMEDIUMCVE-2026-454915.54.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2026-455917.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource Consumption Tenable has released Tenable Identity Exposure version 3.93.5 to address these issues. The installation files can be obtained from the Tenable Downloads Portal: https://www.tenable.com/downloads/identity-exposure	high
CVE-2026-73838	Tenable Identity Exposure leverages third-party software to help provide underlying functionality. Several of the third-party components (.NET Windows Server Hosting, NodeJS, Erlang OTP, SQL Server, OpenSSL, Curl) were found to contain vulnerabilities, and updated versions have been made available by the providers.Out of caution and in line with best practice, Tenable has opted to upgrade these components to address the potential impact of the issues. Tenable Identity Exposure version 3.93.5 updates .NET Windows Server Hosting to version 8.0.28.26269, NodeJS to version 20.20.2.0, Erlang OTP to version 26.2.5.21, SQL Server to version 15.0.4470.1, OpenSSL to version 4.0.1, and Curl to version 8.19.0 to address the identified vulnerabilities.Tenable Identity Exposure version v3.93.5 also resolves a vulnerability related to API endpoints returning information to unauthenticated GET requests (CVE-2026-13007). p.subtitle { display: none; } table { border-collapse: collapse; width: 100%; } th { background: #1a1a2e; color: #fff; padding: 8px 10px; text-align: left; font-size: 12px; letter-spacing: 0.04em; white-space: nowrap; } td { padding: 6px 10px; border-bottom: 1px solid #e5e7eb; vertical-align: top; } tr:hover td { background: #f5f7ff; } .cve-id { white-space: nowrap; } .vector { font-size: 11px; color: #444; word-break: break-all; } .score { font-weight: 600; white-space: nowrap; } .lozenge.critical { color: #fff; } .critical { color: #b91c1c; } .high { color: #c2410c; } .medium { color: #b45309; } .low { color: #15803d; } .badge { display: inline-block; padding: 1px 6px; border-radius: 3px; font-size: 11px; font-weight: 600; margin-right: 4px; } .badge.critical { background: #fee2e2; color: #991b1b; } .badge.high { background: #ffedd5; color: #9a3412; } .badge.medium { background: #fef9c3; color: #854d0e; } .badge.low { background: #dcfce7; color: #166534; } .cwe { font-size: 12px; } .empty { color: #aaa; } .new-row td { background: #f0fdf4; } .new-row:hover td { background: #dcfce7; }  CVE IDBase ScoreTemporal ScoreCVSSv3 VectorCVSSv4 Base ScoreCVSSv4 VectorCWEMEDIUMCVE-2025-111876.15.3CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H/E:U/RL:O/RC:C——CWE-121: Stack-based Buffer OverflowMEDIUMCVE-2025-130345.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C——CWE-345: Insufficient Verification of Data AuthenticityMEDIUMCVE-2025-140176.35.5CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-416: Use After FreeMEDIUMCVE-2025-145245.34.6CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2025-148195.34.6CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2025-150795.34.6CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorLOWCVE-2025-152243.12.7CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2025-154678.87.6CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-416: Use After FreeMEDIUMCVE-2025-154685.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2025-154695.54.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlCRITICALCVE-2025-551309.17.9CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-287: Improper AuthenticationHIGHCVE-2025-551317.16.2CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C——CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')MEDIUMCVE-2025-551325.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C4.8CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:NCWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2025-552477.36.3CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-269: Improper Privilege ManagementMEDIUMCVE-2025-552485.75CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorCRITICALCVE-2025-553159.98.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L/E:U/RL:O/RC:C——CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')HIGHCVE-2025-594657.56.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2025-594667.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2025-661995.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2025-681604.74.1CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2025-6941843.5CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2025-694197.46.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationHIGHCVE-2025-694207.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2025-694217.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-19656.55.7CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlMEDIUMCVE-2026-26736.55.7CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:U/RL:O/RC:C——CWE-284: Improper Access ControlMEDIUMCVE-2026-37835.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-37846.55.7CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-38057.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-48735.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-55456.55.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2026-57737.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-62535.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-62767.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-64295.34.6CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-70095.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-71685.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-73838.17CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationHIGHCVE-2026-90767.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-130077.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:NCWE-306: Missing Authentication for Critical Function; CWE-524: Use of Cache Containing Sensitive InformationHIGHCVE-2026-212187.56.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:NCWE-284: Improper Access ControlHIGHCVE-2026-212628.87.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2026-216377.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-217107.56.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-217135.95.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-217145.34.6CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionLOWCVE-2026-217153.32.9CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorLOWCVE-2026-217163.32.9CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlMEDIUMCVE-2026-217175.95.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-227955.54.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-227965.34.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-261307.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-261717.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-283867.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-125: Out-of-bounds ReadHIGHCVE-2026-283878.17CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationHIGHCVE-2026-283887.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-283897.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-283907.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionCRITICALCVE-2026-317899.88.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-119: Improper Restriction of Operations within the Bounds of a Memory BufferHIGHCVE-2026-317907.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-321677.86.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')MEDIUMCVE-2026-321754.33.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2026-321767.86.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')HIGHCVE-2026-321777.36.3CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C——CWE-269: Improper Privilege ManagementHIGHCVE-2026-321787.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-322037.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-331167.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-331208.87.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-822: Untrusted Pointer DereferenceHIGHCVE-2026-341807.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-341817.46.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationCRITICALCVE-2026-341829.17.9CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C——CWE-287: Improper AuthenticationHIGHCVE-2026-341837.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-3518854.4CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorHIGHCVE-2026-354337.36.3CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C——CWE-269: Improper Privilege ManagementHIGHCVE-2026-403708.87.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-73: External Control of File Name or PathHIGHCVE-2026-427647.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-427657.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-427665.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-427675.95.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionLOWCVE-2026-427683.73.2CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-427695.34.6CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorLOWCVE-2026-427703.73.2CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-427716.25.4CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionMEDIUMCVE-2026-427894.84.2CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C7CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:NCWE-295: Improper Certificate ValidationHIGHCVE-2026-427908.17CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C7.6CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:NCWE-295: Improper Certificate ValidationHIGHCVE-2026-428997.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource ConsumptionHIGHCVE-2026-454457.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C——CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMEDIUMCVE-2026-454464.84.2CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C——CWE-295: Improper Certificate ValidationHIGHCVE-2026-454478.87.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-287: Improper AuthenticationHIGHCVE-2026-454907.86.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C——CWE-269: Improper Privilege ManagementMEDIUMCVE-2026-454915.54.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C——CWE-284: Improper Access ControlHIGHCVE-2026-455917.56.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C——CWE-400: Uncontrolled Resource Consumption Tenable has released Tenable Identity Exposure version 3.93.5 to address these issues. The installation files can be obtained from the Tenable Downloads Portal: https://www.tenable.com/downloads/identity-exposure	high
CVE-2026-22719	VMware Aria Operations contains a command injection vulnerability. A malicious unauthenticated actor may exploit this issue to execute arbitrary commands which may lead to remote code execution in VMware Aria Operations while support-assisted product migration is in progress. To remediate CVE-2026-22719, apply the patches listed in the 'Fixed Version' column of the ' Response Matrix https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 ' in VMSA-2026-0001 Workarounds for CVE-2026-22719 are documented in the 'Workarounds' column of the ' Response Matrix https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 ' in VMSA-2026-0001	high
CVE-2013-6662	Google Chrome caches TLS sessions before certificate validation occurs.	medium
CVE-2021-21230	Type confusion in V8 in Google Chrome prior to 90.0.4430.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.	high
CVE-2021-30513	Type confusion in V8 in Google Chrome prior to 90.0.4430.212 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.	high
CVE-2021-38012	Type confusion in V8 in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.	high
CVE-2020-6426	Inappropriate implementation in V8 in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.	medium
CVE-2020-15979	Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.	high
CVE-2020-6453	Inappropriate implementation in V8 in Google Chrome prior to 80.0.3987.162 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.	high
CVE-2010-1506	The Google V8 bindings in Google Chrome before 4.1.249.1059 allow attackers to cause a denial of service (memory corruption) via unknown vectors.	high
CVE-2022-39266	isolated-vm is a library for nodejs which gives the user access to v8's Isolate interface. In versions 4.3.6 and prior, if the untrusted v8 cached data is passed to the API through CachedDataOptions, attackers can bypass the sandbox and run arbitrary code in the nodejs process. Version 4.3.7 changes the documentation to warn users that they should not accept `cachedData` payloads from a user.	critical
CVE-2021-38001	Type confusion in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.	high
CVE-2021-38007	Type confusion in V8 in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.	high
CVE-2022-2295	Type confusion in V8 in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.	high
CVE-2020-6430	Type Confusion in V8 in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.	high
CVE-2020-16006	Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.	high
CVE-2020-6512	Type Confusion in V8 in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.	high
CVE-2013-2885	Use-after-free vulnerability in Google Chrome before 28.0.1500.95 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to not properly considering focus during the processing of JavaScript events in the presence of a multiple-fields input type.	high
CVE-2013-2870	Use-after-free vulnerability in Google Chrome before 28.0.1500.71 allows remote servers to execute arbitrary code via crafted response traffic after a URL request.	critical
CVE-2011-2880	Use-after-free vulnerability in Google Chrome before 14.0.835.202 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the Google V8 bindings.	high

Detections

Analytics

CVE Search

high

high

high

high

high

high

high

high

high

high

critical

high

critical

critical

medium

medium

high

critical

high

high

medium

high

high

critical

high

high

high

high

high

high

high

high

medium

high

high

high

medium

high

high

high

critical

high

high

high

high

high

high

high

critical

high