CVE-2026-64880

Unsanitized user-supplied input in report filtering parameters is concatenated directly into SQL queries without proper escaping or parameterized queries, enabling blind SQL injection and unauthorized database read access.

Score

CVSS 4.0 7.1 High

Status

Analyzed - vulnreport@tenable.com

Published

2026-07-21

Last modified

2026-10-24

Weaknesses

CWE-89

Affected products

• Security Center (Tenable)
• Security Center (Tenable Inc.)

References

• https://www.tenable.com/security/tns-2026-19