Elasticsearch 8.9.x < 8.19.24 / 9.0.x < 9.4.9 / 9.5.x < 9.5.6 Information Disclosure (ESA-2026-210)

The version of Elasticsearch installed on the remote host is 8.9.x prior to 8.19.24, or 9.0.x prior to 9.4.9, or 9.5.x prior to 9.5.6. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-210 advisory. - Use of Cache Containing Sensitive Information CWE-524 in Elasticsearch...

SUSE SLES15 Security Update : kernel RT (Live Patch 12 for SUSE Linux Enterprise 15 SP7) (SUSE-SU-2026:4984-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4984-1 advisory. This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.7.40 fixes various security issues: The following security issues were fixed: -...

CentOS Linux 8 [TuxCare] Security Update: lemon / sqlite / sqlite-analyzer / sqlite-devel / sqlite-doc / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1793699740)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1793699740 advisory. - SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITELIMITEXPRDEPTH nesting...

RockyLinux 9 : tomcat (RLSA-2026:93469)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:93469 advisory. tomcat: Apache Tomcat: Security constraint bypass due to improper access control CVE-2026-65182 tomcat: Apache Tomcat: Access control bypass due to...

RHEL 9 : pipewire (RHSA-2026:94437)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:94437 advisory. PipeWire is a multimedia server for Linux and other Unix like operating systems. Security Fixes: pipewire: RAOP RTSP NULL Deref...

AlmaLinux 9.2 [TuxCare] Security Update: lemon / sqlite / sqlite-analyzer / sqlite-devel / sqlite-doc / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1793693567)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1793693567 advisory. - SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists that undersizes the output buffer when...

RHCOS 4 : OpenShift Container Platform 4.21.41 (RHSA-2026:92286)

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:92286 advisory. - crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates CVE-2026-111943 Note that Nessus has n...

RockyLinux 9 : bind (RLSA-2026:93610)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:93610 advisory. bind: BIND: Denial of Service via unbounded processing of crafted DNS messages CVE-2026-19630 bind: bind: Arbitrary code execution via GSS-TSIG UDP...

CVE-2026-105822: TP-Link Systems Inc. Tapo Cloud Service: The Tapo Cloud MQTT proxy contains a server-side request forgery (SSRF) vulnerability because it accepts a…

The Tapo Cloud MQTT proxy contains a server-side request forgery SSRF vulnerability because it accepts a user-controlled host value without sufficient input validation. An attacker may exploit this vulnerability to cause the Tapo Cloud service to send requests to an attacker-controlled server...

Oracle Linux 9 : kernel (ELSA-2026-93412)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-93412 advisory. - ipv4: free inetopt and ireqopt after an RCU grace period CKI Backport Bot RHEL-295635 CVE-2026-98432 - nvmet-auth: fix out-of-bounds write in...

SUSE SLES12: cpp48 / gcc48 / gcc48-32bit / gcc48-c++ / gcc48-info / gcc48-locale / etc (SUSE-SU-2026:4637-2)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4637-2 advisory. This update for gcc48 fixes the following issue: - CVE-2026-102010: UAF due to improper pointer update when an application calls the eraseif...

Photon OS 5.0: Glib PHSA-2026-5.0-92-0953

An update of the glib package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-92-0953. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Glib PHSA-2026-5.0-91-0947

An update of the glib package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-91-0947. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

RockyLinux 8 : perl-YAML:1.24 (RLSA-2026:93471)

The remote RockyLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RLSA-2026:93471 advisory. perl-yaml: perl-yaml: Arbitrary code execution via unrestricted package variable assignment CVE-2019-25777 perl-yaml: perl-yaml: Arbitrary destructor...

Elasticsearch 8.10.x < 8.19.24 / 9.0.x < 9.4.9 / 9.5.x < 9.5.6 DoS (ESA-2026-201)

The version of Elasticsearch installed on the remote host is 8.10.x prior to 8.19.24, or 9.0.x prior to 9.4.9, or 9.5.x prior to 9.5.6. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-201 advisory. - Uncontrolled Recursion CWE-674 in Elasticsearch can lead to denial of...

Oracle Linux 9 : qemu-kvm (ELSA-2026-88421)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-88421 advisory. 10.1.0-17.el98.9 - kvm-qcow2-Add-keepdatafile-command-line-option.patch RHEL-164549 - kvm-qcow2-Simplify-size-round-up-in-cocreateopts.patch RHEL-164549 -...

RHEL 8 : libXtst (RHSA-2026:94482)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:94482 advisory. X.Org X11 libXtst runtime library Security Fixes: libXtst: libXtst: Denial of Service via out-of-bounds read in RECORD reply parser CVE-2026-94286 F...

Linux Distros Unpatched Vulnerability : CVE-2026-74846

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier...

Linux Distros Unpatched Vulnerability : CVE-2026-120063

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When psqlODBC quotes a schema or table name into a 128-byte stack buffer, its length check lets it write up to two bytes past the end of the buffer for a long...

Oracle Linux 8 : ghostscript (ELSA-2026-93978)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-93978 advisory. 9.27-20 - CVE-2026-112177 ghostscript: Reintroduction of .charkeys -dSAFER bypass in RHEL 8 -dSAFER bypass in RHEL 8 Tenable has extracted the preceding...