Oracle Linux 10 : fence-agents (ELSA-2026-94501)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-94501 advisory. 4.16.0-21.7 - bundled PyJWT: upgrade to v2.15.1 to fix CVE-2026-102266, CVE-2026-102267, CVE-2026-102268, CVE-2026-102271, and CVE-2026-102272...

Linux Distros Unpatched Vulnerability : CVE-2026-121407

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server's remdeskserverthread that allows authenticated clients to crash the proce...

CVE-2026-121137: Google Chrome: Type confusion in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social…

Type confusion in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-121531: n/a Umami: A vulnerability has been found in Umami 3.3.x/3.4.0/3.4.1

A vulnerability has been found in Umami 3.3.x/3.4.0/3.4.1. This affects an unknown part of the file src/app/api/auth/login/route.ts of the component 2FA Policy Handler. The manipulation leads to use of single-factor authentication. It is possible to initiate the attack remotely. The exploit has...

CVE-2026-121170: Google Chrome: Improper resource control in WebCodecs in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web…

Improper resource control in WebCodecs in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-121177: Google Chrome: UI misrepresentation in PageInfo in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to spoof…

UI misrepresentation in PageInfo in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to spoof UI elements via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-121047: Google Chrome: Buffer overflow in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code…

Buffer overflow in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

Fedora 45 : kernel (2026-7a0f444c64)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-7a0f444c64 advisory. The 7.2.15 stable kernel update contains a number of important fixes across the tree. Tenable has extracted the preceding description block directly from the...

Oracle Linux 8 : qt5-qtbase (ELSA-2026-93924)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-93924 advisory. - Fix CVE-2026-19248: unbounded recursion and ON2 behavior in QDom Resolves: RHEL-261130 Tenable has extracted the preceding description block directl...

CVE-2026-121736: nocodb: NocoDB 0.300.0 before 2026.08.0 contains a missing authentication vulnerability in the POST /api/v2/oauth/authorize…

NocoDB 0.300.0 before 2026.08.0 contains a missing authentication vulnerability in the POST /api/v2/oauth/authorize handler that allows unauthenticated attackers to create OAuth authorization codes. Attackers can send anonymous requests with clientid, redirecturi and approved=true to insert...

Photon OS 5.0: Linux PHSA-2026-5.0-92-1051

An update of the linux package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-92-1051. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Etcd PHSA-2026-5.0-92-0975

An update of the etcd package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-92-0975. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

SUSE SLED15: apache-commons-codec / apache-commons-io / apache-commons-logging / etc (SUSE-SU-2026:5017-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:5017-1 advisory. This update for apache-commons-codec, apache-commons-io, apache-commons-logging, avalon-framework, avalon- logkit,...

Fedora 44 : zvbi (2026-055ec4753d)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-055ec4753d advisory. Update to 0.2.46 Fixes CVE-2026-110654 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has...

CVE-2026-121179: Google Chrome: Use after free in PDFium in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code…

Use after free in PDFium in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-121183: Google Chrome: Incorrect authorization in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had…

Incorrect authorization in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-121236: Google Chrome: Improper input validation in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web…

Improper input validation in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...

CVE-2026-99268: Linux: In the Linux kernel, the following vulnerability has been resolved: io_uring: wake ring pollers for local task_work…

In the Linux kernel, the following vulnerability has been resolved: iouring: wake ring pollers for local taskwork With IORINGSETUPDEFERTASKRUN completions are queued as local work, and only become CQEs when the submitter enters the kernel to wait for events. For an application that finds out via...

Fedora 44 : erlang-hex_core (2026-b300043748)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-b300043748 advisory. hexcore ver. 0.21.1 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not teste...

CVE-2026-99249: Linux: In the Linux kernel, the following vulnerability has been resolved: pid_namespace: make zap_pid_ns_processes()…

In the Linux kernel, the following vulnerability has been resolved: pidnamespace: make zappidnsprocesses freezable When the init of a pid namespace exits, zappidnsprocesses waits until all other pids in the namespace are freed. A tracer outside the namespace that does not reap its traced zombies...