CVE-2026-19680

HighCVSS 7.1/10Last modified Aug 19, 2026

Description

A SQL injection vulnerability exists in Security Center that could allow an attacker to access unauthorized data from the application's database.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-89

Affected software

VendorProductVersions
Tenable, Inc.Security Center< 6.9.0

References

Timeline

Published
Aug 14, 2026
Last modified
Aug 19, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-196819.9An authenticated command injection vulnerability exists in Security Center related to file upload processing. An attacker could exploit thisCVE-2026-196829.9A command injection vulnerability exists in Security Center where a remote, unauthenticated attacker could exploit this issue to execute arbCVE-2026-196837.4A vulnerability exists in the Dynamic DNS (DDNS) functionality of TP-Link Omada Gateways. During communication with a third-party DDNS serviCVE-2026-196857.1NetworkManager did not apply the private_user restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. TCVE-2026-196886.8A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The Admin API fails to verify the intended aCVE-2026-19695.3The trx_addons WordPress plugin before 2.38.5 does not correctly validate file types in one of its AJAX action, allowing unauthenticated useCVE-2026-196938.1extract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and never the entry's own final path component,CVE-2026-196945.5TTX Logger file parser crash in 4.6.0 to 4.6.7 allows denial of serviceCVE-2026-196955.5Gammu DCT3 trace file parser crash in 4.6.0 to 4.6.7 allows denial of serviceCVE-2026-196965.5Ixia IxVeriWave and Vector Informatik BLF file parser crashes in 4.6.0 to 4.6.7 allows denial of service on WindowsCVE-2026-196976.8The GutenKit WordPress plugin before 2.5.0 does not sanitise uploaded SVG files on all of the upload paths it enables, allowing users with CVE-2026-196983.5The GutenKit WordPress plugin before 2.5.1 does not validate or escape style settings saved against a post before using them to build the CS
CVE-2026-19680: High severity, CVSS 7.1 | Vulnix