Detections
Analytics

CVEs

Tenable maintains a list of Common Vulnerabilities and Exposures (CVEs) and their affected products. Tenable augments the data to include related Tenable Plugins that detect each vulnerability. 321161 CVEs are indexed from NVD.

RSS Feeds

Search

Vulnerability Watch ›

  • CVE-2025-55182
    criticalVulnerability of Interest

    This unauthenticated remote code execution flaw in React has been exploited in the wild and multiple exploit scripts have been made public. Immediate patching is required.

  • CVE-2025-61757
    criticalVulnerability of Interest

    Exploitation of this Oracle Identity Manager remote code execution vulnerability has been observed. Immediate patching is recommended.

  • CVE-2025-66516
    criticalVulnerability Being Monitored

    This XXE flaw affecting Apache Tika has received the highest CVSS score of 10.0. While no exploitation has been observed, immediate patching is recommended.

Newest ›

  • CVE-2025-34266
    medium

    Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS)...

  • CVE-2025-34265
    medium

    Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS)...

  • CVE-2025-34264
    medium

    Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS)...

  • CVE-2025-34263
    medium

    Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS)...

  • CVE-2025-34262
    medium

    Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS)...

  • CVE-2025-34261
    medium

    Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS)...

  • CVE-2025-34260
    medium

    Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS)...

  • CVE-2025-34259
    medium

    Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS)...

  • CVE-2025-34258
    medium

    Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS)...

  • CVE-2025-34257
    medium

    Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS)...

Updated ›

  • CVE-2025-9817
    high

    SSH dissector crash in Wireshark 4.4.0 to 4.4.8 allows denial of service

  • CVE-2025-9554
    medium

    Vulnerability in Drupal Owl Carousel 2.This issue affects Owl Carousel 2: *.*.

  • CVE-2025-9553
    medium

    Vulnerability in Drupal API Key manager.This issue affects API Key manager: *.*.

  • CVE-2025-6966
    medium

    NULL pointer dereference in TagSection.keys() in python-apt on APT-based Linux systems allows a local attacker to cause a denial of service (process crash) via a crafted deb822 file with a malformed non-UTF-8 key.

  • CVE-2025-6680
    medium

    The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.8.3. This makes it possible for authenticated attackers, with tutor-level access and above, to view assignments for courses they don't teach which may contain sensitive information.

  • CVE-2025-66563
    high

    Monkeytype is a minimalistic and customizable typing test. In 25.49.0 and earlier, there is improper handling of user input which allows an attacker to execute malicious javascript on anyone viewing a malicious quote submission. quote.text and quote.source are user input, and they're inserted straight into the DOM. If they contain HTML tags, they will be rendered (after some escaping using quotes and textarea tags).

  • CVE-2025-66552
    medium

    Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 30.0.9 and 31.0.1, incorrect path handling with groupfolders caused the admin_audit app to not properly log all actions on files and folders inside groupfolders. This vulnerability is fixed in Nextcloud Server and Enterprise Server prior to 30.0.9 and 31.0.1.

  • CVE-2025-66550
    medium

    Nextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.17 and 5.2.4, when a malicious user creates a calendar event with a crafted attachment that links to a download link of a file on the same Nextcloud server, the file would be downloaded without the user confirming the action. This vulnerability is fixed in 4.7.17 and 5.2.4.

  • CVE-2025-66547
    medium

    Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 31.0.1, non-privileged users can modify tags on files they should not have access to via bulk tagging. This vulnerability is fixed in 31.0.1.

  • CVE-2025-66546
    low

    Nextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.19, 5.5.6, and 6.0.1, the calendar app allowed blindly booking appointments with a squential ID without known the appointment token. This vulnerability is fixed in 4.7.19, 5.5.6, and 6.0.1.