CVE-2026-19639
published 2026-08-14CVE-2026-19639: An improper access control vulnerability exists where an authenticated non-administrative application user could potentially view settings outside of their…
PriorityP421medium4.3CVSS 3.1
AVNACLPRLUINSUCLINAN
EPSS
0.30%
21.7th percentile
An improper access control vulnerability exists where an authenticated non-administrative application user could potentially view settings outside of their assigned scope.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| tenable | security_center | < 6.9.0 | 6.9.0 |
| tenable_inc | security_center | < 6.9.0 | 6.9.0 |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
nvdv4.05.3MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat5.5LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
An improper access control vulnerability exists where an authenticated non-administrative application user could potentially view settings outside of their assigned scope.
ghsa_unreviewed·2026-08-14
CVE-2026-19639 [MEDIUM] CWE-1284 An improper access control vulnerability exists where an authenticated non-administrative application user could potentially view settings outside of their assigned scope.
An improper access control vulnerability exists where an authenticated non-administrative application user could potentially view settings outside of their assigned scope.
VulDB
Tenable Security Center up to 6.8.x access control
vuldb·2026-08-14·CVSS 4.3
CVE-2026-19639 [MEDIUM] Tenable Security Center up to 6.8.x access control
A vulnerability marked as problematic has been reported in Tenable Security Center up to 6.8.x. Impacted is an unknown function. The manipulation leads to improper access controls.
This vulnerability is referenced as CVE-2026-19639. Remote exploitation of the attack is possible. No exploit is available.
It is suggested to upgrade the affected component.
Red Hat
kernel: md/raid1: create serial pool adding rdev to array with serialize_policy=1
vendor_redhat·2026-09-17·CVSS 5.5
CVE-2026-90385 [LOW] CWE-824 kernel: md/raid1: create serial pool adding rdev to array with serialize_policy=1
kernel: md/raid1: create serial pool adding rdev to array with serialize_policy=1
In the Linux kernel, the following vulnerability has been resolved:
md/raid1: create serial pool adding rdev to array with serialize_policy=1
The following bug has been observed with kernel 7.1.3 after adding a new
rdev to an existing RAID1 array with serialize_policy enabled:
Oops: 0002 [#1]
CPU: 0 UID: 0 PID: 19639 Comm: ext4lazyinit Not tainted 7.1.3-1-default
RIP: _raw_spin_lock_irqsave+0x27/0x50
CR2: 0000000000004960
Call Trace:
wait_for_serialization+0xb9/0x260 [raid1]
raid1_make_request+0x762/0xaff [raid1]
md_handle_request+0x1c9/0x2e0 [md_mod]
The raid1.c code calls wait_for_serialization() if the MD_SERIALIZE_POLICY
is set, and wait_for_serialization assumes that rdev->serial is
initialized. Normall
No detection rules found.
No public exploits indexed.
2026-08-14
Published