AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

TenableCVE-2026-19657

Tenable ScadaLTS: cross-site scripting

Tenable

CVE-2026-19657 · Published Aug 12, 2026 · updated Aug 25, 2026

Medium6.1
No fix yet
Tenable advisory

ScadaLTS 2.7.8.1 reflects user-supplied input into an HTML response without sanitization. An unauthenticated attacker who lures a victim into visiting a crafted URL can execute arbitrary JavaScript in the context of the victim's browser session.

Affected versions

PackageAffectedFixed in
ScadaLTS
Product
<= 2.7.8.1No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-79

More Tenable advisories

All Tenable
Medium 6.0Aug 14Tenable Security Center: cross-site request forgeryCVE-2026-19636fixed in 6.9.0High 8.5Aug 14Tenable Security Center: privilege escalationCVE-2026-19635fixed in 6.9.0High 8.6Aug 14Tenable Security Center: command injectionCVE-2026-19628fixed in 6.9.0Critical 9.4Aug 14Tenable Security Center: remote code executionCVE-2026-19626fixed in 6.9.0Critical 9.9Aug 12Tenable ScadaLTS: code executionCVE-2026-19656no fix yetMedium 5.3Aug 11Tenable Snipe-IT: insecure direct object referenceCVE-2026-19579fixed in 8.6.0