RockyLinux 9 : freerdp (RLSA-2026:93592)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:93592 advisory. freerdp: FreeRDP: Denial of Service via uninitialized progressive tile handling CVE-2026-109242 freerdp: freerdp: Denial of Service via heap-based buffe...

Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500572)

The remote Oracle Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-500572 advisory. - NFSD: Define actions for the new timedeleg FATTR4 attributes Chuck Lever Orabug: 39004166 CVE-2025-40326 - ipv4: free inetopt and ireqopt afte...

Mozilla Firefox < 159.0.1

The version of Firefox installed on the remote Windows host is prior to 159.0.1. It is, therefore, affected by a vulnerability as referenced in the mfsa2026-123 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number...

RHEL 9 : pipewire (RHSA-2026:94437)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:94437 advisory. PipeWire is a multimedia server for Linux and other Unix like operating systems. Security Fixes: pipewire: RAOP RTSP NULL Deref...

Langflow 1.0.x < 1.13.0 Multiple Vulnerabilities

The version of Langflow installed on the remote host is 1.0.x prior to 1.13.0. It is, therefore, affected by multiple vulnerabilities: - IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to bypass security restrictions due to improper authentication. CVE-2026-93680 - IBM Langflo...

RHEL 8 : libXtst (RHSA-2026:94449)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:94449 advisory. X.Org X11 libXtst runtime library Security Fixes: libXtst: libXtst: Denial of Service via out-of-bounds read in RECORD reply parser CVE-2026-94286 F...

RockyLinux 10 : libXi (RLSA-2026:93441)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:93441 advisory. libXi: libXi: Arbitrary code execution via oversized DEVICEENABLE reply CVE-2026-109090 libXi: libXi: Arbitrary code execution via DEVICERESOLUTION...

AlmaLinux 8 : qt5-qtbase (ALSA-2026:93924)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:93924 advisory. qtbase: qt5-qtbase: qt6-qtbase: qtbase: Denial of Service via uncontrolled recursion in XML serialization CVE-2026-11573 qt5-qtbase: qt6-qtbase: Qt: Deni...

Rocky Linux 8.6 [CIQ] Security Update: aspnetcore-runtime-6.0 / aspnetcore-targeting-pack-6.0 / dotnet / etc (ciqsa-2026_1750)

The Rocky Linux 8.6 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261750 advisory. This advisory aggregates security fixes for the dotnet6.0 SRPM in CIQ LTS 8.6. It addresses 1 CVE: CVE-2026-111497. Tenable has extracted the preceding descriptio...

Rocky Linux 8.10 [CIQ] Security Update: bpftool / kernel / kernel-abi-stablelists / kernel-core / etc (ciqsa-2026_1747)

The Rocky Linux 8.10 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261747 advisory. This advisory aggregates security fixes for the kernel SRPM in CIQ Core 8.10. It addresses 1 CVE: CVE-2026-98432. Tenable has extracted the preceding description...

AlmaLinux 8 : perl-YAML:1.24 (ALSA-2026:93471)

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:93471 advisory. perl-yaml: perl-yaml: Arbitrary code execution via unrestricted package variable assignment CVE-2019-25777 perl-yaml: perl-yaml: Arbitrary destructor...

AlmaLinux 9 : libXi (ALSA-2026:93439)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:93439 advisory. libXi: libXi: Arbitrary code execution via oversized DEVICEENABLE reply CVE-2026-109090 libXi: libXi: Arbitrary code execution via DEVICERESOLUTION...

AlmaLinux 8 : firefox (ALSA-2026:89756)

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:89756 advisory. libexpat: denial of service via crafted XML input CVE-2026-45186 firefox: thunderbird: Privilege escalation in the Application Update component...

FreeBSD : freenginx -- TLS session ticket key left uninitialized (4784aba5-d6a9-11f1-8a93-a0369f6e85b8)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 4784aba5-d6a9-11f1-8a93-a0369f6e85b8 advisory. The freenginx project reports: One of the keys was left uninitialized when using automatic rotation of...

AlmaLinux 8 : bind (ALSA-2026:93925)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:93925 advisory. bind9: bind: BIND 9: Denial of Service via crafted DNSSEC responses CVE-2026-19662 bind: BIND: Denial of Service via unbounded processing of crafted DNS...

Linux Distros Unpatched Vulnerability : CVE-2026-99265

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iouring/openclose: keep the lock in iopipefixed iopipefixed installs both ends of the pipe in the fixed file table, drops -uringlock, and copies the slot number...

Linux Distros Unpatched Vulnerability : CVE-2026-102703

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. A common access pattern is a batc...

Linux Distros Unpatched Vulnerability : CVE-2026-121440

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 fails to check forwarded trailers against the WasiHttpHooks::isforbiddenheader hook in wasi-http p3. WASI...

CVE-2026-121440: bytecodealliance wasmtime: Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 fails to check forwarded trailers against the…

Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 fails to check forwarded trailers against the WasiHttpHooks::isforbiddenheader hook in wasi-http p3. WASIp3 guests can forward a request or response body so its trailers skip embedder-customized forbidden header filtering, undermining header...

...[ More ]

This Metasploit module exploits an unauthenticated SQL injection in the Cisco Secure Email Gateway SEG Email Cloud Scanner ECS URL-retrospective message database. A sender-controlled Message-ID is placed inside a fixed PostgreSQL dollar-quoted string without escaping. The module sends one email...