RockyLinux 10 : libXi (RLSA-2026:93441)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:93441 advisory. libXi: libXi: Arbitrary code execution via oversized DEVICEENABLE reply CVE-2026-109090 libXi: libXi: Arbitrary code execution via DEVICERESOLUTION...

RHEL 8 : libXtst (RHSA-2026:94567)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:94567 advisory. X.Org X11 libXtst runtime library Security Fixes: libXtst: libXtst: Denial of Service via out-of-bounds read in RECORD reply parser CVE-2026-94286 F...

Linux Distros Unpatched Vulnerability : CVE-2026-99247

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tracing: Do not initialize tracefs work if tracing is disabled If trace buffer allocation fails during early boot e.g. in earlytraceinit - allocatetracebuffers,...

Linux Distros Unpatched Vulnerability : CVE-2026-99255

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iouring/io-wq: don't hide a link from cancellations A task that exits cancels its tracked requests and waits until they are gone. iouringcancelgeneric looks...

Kibana 8.x < 8.19.24 / 9.0.x < 9.4.9 / 9.5.x < 9.5.6 Incorrect Authorization (ESA-2026-203)

The version of Kibana installed on the remote host is 8.x prior to 8.19.24, or 9.0.x prior to 9.4.9, or 9.5.x prior to 9.5.6. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-203 advisory. - Authorization Bypass Through User-Controlled Key CWE-639 in Kibana Machine...

AlmaLinux 8 : bind (ALSA-2026:93925)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:93925 advisory. bind9: bind: BIND 9: Denial of Service via crafted DNSSEC responses CVE-2026-19662 bind: BIND: Denial of Service via unbounded processing of crafted DNS...

Rocky Linux 9.6 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1793725885)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793725885 advisory. - When an FTP wildcard LIST operation fails, libcurl omits the restoration path meant for successful listings, leaving the write...

AlmaLinux 9.2 [TuxCare] Security Update: bind / bind-chroot / bind-devel / bind-dnssec-doc / etc (ALMALINUX9.2:CLSA-2026:1793710996)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1793710996 advisory. - Querying for records within a specially crafted zone containing certain malformed DNSKEY records can lead to CPU exhaustion. This issue...

RHEL 9 : RHEL AI 3.5 RPM runtime CVE fix - ffmpeg (Important) (RHSA-2026:94488)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:94488 advisory. RPM packages are internal build artifacts and not supported on their own. They are only supported as part of the Red Hat AI application...

Fedora 45 : erlang-hex_core (2026-b514ab4cac)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-b514ab4cac advisory. hexcore ver. 0.21.1 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not teste...

Oracle Linux 9 : gimp (ELSA-2026-93975)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-93975 advisory. - fix CVE-2026-106062 - fix CVE-2026-112257 - fix CVE-2026-112258 - fix CVE-2026-112260 Tenable has extracted the preceding description block directly...

AlmaLinux 9 : libXi (ALSA-2026:93439)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:93439 advisory. libXi: libXi: Arbitrary code execution via oversized DEVICEENABLE reply CVE-2026-109090 libXi: libXi: Arbitrary code execution via DEVICERESOLUTION...

AlmaLinux 8 : perl-YAML:1.24 (ALSA-2026:93471)

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:93471 advisory. perl-yaml: perl-yaml: Arbitrary code execution via unrestricted package variable assignment CVE-2019-25777 perl-yaml: perl-yaml: Arbitrary destructor...

Linux Distros Unpatched Vulnerability : CVE-2026-121386

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.32.2 contains a denial of service vulnerability in WinPR's winprreadpngfrombuffer and winprconvertfromjpeg, which lack libpng/libjpeg error...

CVE-2026-121199: Google Chrome: Missing authorization in Chromoting in Google Chrome on on Mac prior to 157.0.8103.38 allowed a local attacker to…

Missing authorization in Chromoting in Google Chrome on on Mac prior to 157.0.8103.38 allowed a local attacker to obtain sensitive information via a local program. Chromium security severity: Medium...

CVE-2026-121248: Google Chrome: Incorrect authorization in API in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system…

Incorrect authorization in API in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted Chrome extension. Chromium security severity: Medium...

CVE-2026-121138: Google Chrome: Observable discrepancy in CORS in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin…

Observable discrepancy in CORS in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: Low...

CVE-2026-121164: Google Chrome: Incorrect authorization in Views in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker leveraging…

Incorrect authorization in Views in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

SUSE SLES15 Security Update : kernel RT (Live Patch 19 for SUSE Linux Enterprise 15 SP7) (SUSE-SU-2026:5020-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:5020-1 advisory. This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.7.72 fixes various security issues: The following security issues were fixed: -...

Photon OS 5.0: Mysql PHSA-2026-5.0-90-1056

An update of the mysql package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-90-1056. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...