Fedora 44 : kernel (2026-778424cb43)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-778424cb43 advisory. The 7.2.15 stable kernel update contains a number of important fixes across the tree. Tenable has extracted the preceding description block directly from the...

AlmaLinux 9.2 [TuxCare] Security Update: ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1793719329)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1793719329 advisory. - ImageMagick before 7.1.2-33 contains a memory leak vulnerability in PerlMagick that fails to free values returned when reading ima...

RHEL 10 / 8 / 9 : Satellite 6 Client Update (Important) (RHSA-2026:94063)

The remote Redhat Enterprise Linux 10 / 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:94063 advisory. Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the...

CVE-2026-121418: surrealdb: SurrealDB from 3.1.0 before 3.3.0 contains an incorrect authorization vulnerability that allows record users to infer…

SurrealDB from 3.1.0 before 3.3.0 contains an incorrect authorization vulnerability that allows record users to infer restricted field values because the streaming planner uses indexes on fields with restrictive SELECT permissions. Attackers can issue full-text MATCHES, compound B-tree, or HNSW K...

CVE-2026-120577: wpmanageninja: The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to arbitrary…

The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteFile function in all versions up to, and including, 1.6.2. This makes it possible for authenticated attackers,...

AlmaLinux 9.2 [TuxCare] Security Update: bind / bind-chroot / bind-devel / bind-dnssec-doc / etc (ALMALINUX9.2:CLSA-2026:1793710996)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1793710996 advisory. - Querying for records within a specially crafted zone containing certain malformed DNSKEY records can lead to CPU exhaustion. This issue...

Linux Distros Unpatched Vulnerability : CVE-2026-121425

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nodemailer from 3.0.0 before 10.1.4 contains a parsing flaw in addressparser that ends an RFC 5322 group at a semicolon inside quoted display names or comments...

SUSE SLES12 Security Update : gnutls (SUSE-SU-2026:4953-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4953-1 advisory. This update for gnutls fixes the following issue: - CVE-2025-14831: excessive resource consumption when verifying specially crafted maliciou...

Elasticsearch 8.9.x < 8.19.24 / 9.0.x < 9.4.9 / 9.5.x < 9.5.6 Information Disclosure (ESA-2026-210)

The version of Elasticsearch installed on the remote host is 8.9.x prior to 8.19.24, or 9.0.x prior to 9.4.9, or 9.5.x prior to 9.5.6. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-210 advisory. - Use of Cache Containing Sensitive Information CWE-524 in Elasticsearch...

Photon OS 5.0: Glib PHSA-2026-5.0-91-0947

An update of the glib package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-91-0947. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

AlmaLinux 9.6 [TuxCare] Security Update: ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1793719568)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793719568 advisory. - ImageMagick before 7.1.2-33 contains a memory leak vulnerability in PerlMagick that fails to free values returned when reading ima...

SUSE SLED15: docker / docker-bash-completion / docker-buildx / etc (SUSE-SU-2026:4956-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4956-1 advisory. This update for docker rebuilds it against the current go security release. Tenable has extracted the preceding...

Linux Distros Unpatched Vulnerability : CVE-2026-99251

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Drivers: hv: Avoid infinite retry loop in initvpindex There is a retry loop in initvpindex where the CPUs from a certain node are stripped out if they have...

Fedora 44 : python-pillow (2026-719fffc96a)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-719fffc96a advisory. Backport fix for CVE-2026-112900. ---- Backport fix for CVE-2026-112398 ---- Backport fix for CVE-2026-112393. Tenable has extracted the preceding...

CVE-2026-95735: Hewlett Packard Enterprise (HPE) Fabric Composer: An improper certificate validation vulnerability exists in HPE Networking Fabric Composer

An improper certificate validation vulnerability exists in HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated remote attacker, under certain preconditions outside the attacker's control, to obtain sensitive information, including credentials...

CVE-2026-95753: Hewlett Packard Enterprise (HPE) Fabric Composer: A privilege escalation vulnerability exists in the API of HPE Networking Fabric Composer

A privilege escalation vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated attacker with low privileges to disclose network traffic from switches managed by Fabric Composer...

CVE-2026-95732: Hewlett Packard Enterprise (HPE) Fabric Composer: An authentication bypass vulnerability exists in the underlying operating system of HPE Networking Fabric Composer

An authentication bypass vulnerability exists in the underlying operating system of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent attacker to execute arbitrary code on the affected system...

CVE-2026-95747: Hewlett Packard Enterprise (HPE) Fabric Composer: A privilege escalation vulnerability exists in the SSH interface of HPE Networking Fabric Composer which could allow an…

A privilege escalation vulnerability exists in the SSH interface of HPE Networking Fabric Composer which could allow an authenticated low-privileged attacker to exceed their authorized level of access, if certain preconditions outside of the attacker's control are met. Successful exploitation cou...

RHEL 10 : dpdk (RHSA-2026:94630)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:94630 advisory. The dpdk packages provide the Data Plane Development Kit, which is a set of libraries and drivers for fast packet processing in the user...

Elasticsearch 8.12.1 < 8.19.24 / 9.0.x < 9.4.9 / 9.5.x < 9.5.6 Multiple Vulnerabilities (ESA-2026-227)

The version of Elasticsearch installed on the remote host is 8.12.1 or later prior to 8.19.24, or 9.0.x prior to 9.4.9, or 9.5.x prior to 9.5.6. It is, therefore, affected by multiple vulnerabilities as referenced in the ESA-2026-227 advisory. - Vulnerability in the Oracle Java SE, Oracle GraalVM...