Tenable Research Advisories
Every vulnerability we disclose, with what is affected, how severe it is and where the fix stands. Search a CVE, vendor or product, or narrow by severity and area.
- Advisories
- 12
- Critical
- 3
- No patch at publication
- 2
- CVEs
- 13
- TRA-2026-44Unauthenticated remote code execution via agent update channelHelix Systems · Helix Fleet ManagerCVE-2026-411879.8criticalNo patch
- TRA-2026-43Prompt injection leads to tool-call exfiltration in AI coding assistantLumen Labs · Lumen Copilot for IDEsCVE-2026-40912CVE-2026-409138.6highPatched
- TRA-2026-42Hardcoded maintenance credentials in PLC web interfaceQuanta Automation · Q-Series PLC firmware 4.xCVE-2026-397719.1criticalMitigation available
- TRA-2026-41Cross-tenant data access through misconfigured federated identityNorthwind Cloud · Northwind Identity FederationCVE-2026-388208.1highPatched
- TRA-2026-40Stored XSS in ticket comments enables session takeoverBrightdesk · Brightdesk Service CloudCVE-2026-381046.4mediumPatched
- TRA-2026-39Pre-auth stack overflow in SSL VPN portalCorvane Networks · Corvane SecureGate 7CVE-2026-374559.8criticalPatched
- TRA-2026-38Debug UART exposes root shell on smart building gatewayOstra · Ostra Hub BX-200CVE-2026-366906.8mediumNo patch
- TRA-2026-37Model registry path traversal overwrites serving artifactsFathom AI · Fathom MLOps PlatformCVE-2026-355127.7highPatched
- TRA-2026-36Information disclosure in backup agent diagnostic endpointLarkspur Software · Larkspur Backup AgentCVE-2026-344075.3mediumPatched
- TRA-2026-35Container escape through writable host socket in serverless runtimeNorthwind Cloud · Northwind FunctionsCVE-2026-339808.8highPatched
- TRA-2026-34Denial of service in Modbus gateway parserQuanta Automation · Q-Link GatewayCVE-2026-327165.9mediumPatched
- TRA-2026-33Open redirect in OAuth consent screenBrightdesk · Brightdesk IdentityCVE-2026-310553.1lowPatched
No advisories match these filters.
Try a CVE identifier, a vendor name or a broader severity.
Showing 12 of 12 advisories