Fedora 44 : python-pillow (2026-719fffc96a)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-719fffc96a advisory. Backport fix for CVE-2026-112900. ---- Backport fix for CVE-2026-112398 ---- Backport fix for CVE-2026-112393. Tenable has extracted the preceding...

RockyLinux 9 : opentelemetry-collector (RLSA-2026:93617)

The remote RockyLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RLSA-2026:93617 advisory. net/http: golang: golang: Denial of Service via crafted HTTP Range headers CVE-2026-78667 crypto/tls: golang: crypto/tls: Denial of Service via multiple...

SUSE SLES15 Security Update : kernel RT (Live Patch 12 for SUSE Linux Enterprise 15 SP7) (SUSE-SU-2026:4984-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4984-1 advisory. This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.7.40 fixes various security issues: The following security issues were fixed: -...

Photon OS 5.0: Glib PHSA-2026-5.0-92-0953

An update of the glib package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-92-0953. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

AlmaLinux 9.2 [TuxCare] Security Update: lemon / sqlite / sqlite-analyzer / sqlite-devel / sqlite-doc / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1793693567)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1793693567 advisory. - SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists that undersizes the output buffer when...

RHEL 9 : pipewire (RHSA-2026:94436)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:94436 advisory. PipeWire is a multimedia server for Linux and other Unix like operating systems. Security Fixes: pipewire: RAOP RTSP NULL Deref...

Elasticsearch 8.10.x < 8.19.24 / 9.0.x < 9.4.9 / 9.5.x < 9.5.6 DoS (ESA-2026-201)

The version of Elasticsearch installed on the remote host is 8.10.x prior to 8.19.24, or 9.0.x prior to 9.4.9, or 9.5.x prior to 9.5.6. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-201 advisory. - Uncontrolled Recursion CWE-674 in Elasticsearch can lead to denial of...

RockyLinux 9 : bind (RLSA-2026:93610)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:93610 advisory. bind: BIND: Denial of Service via unbounded processing of crafted DNS messages CVE-2026-19630 bind: bind: Arbitrary code execution via GSS-TSIG UDP...

SUSE SLES12: cpp48 / gcc48 / gcc48-32bit / gcc48-c++ / gcc48-info / gcc48-locale / etc (SUSE-SU-2026:4637-2)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4637-2 advisory. This update for gcc48 fixes the following issue: - CVE-2026-102010: UAF due to improper pointer update when an application calls the eraseif...

Oracle Linux 9 : kernel (ELSA-2026-93412)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-93412 advisory. - ipv4: free inetopt and ireqopt after an RCU grace period CKI Backport Bot RHEL-295635 CVE-2026-98432 - nvmet-auth: fix out-of-bounds write in...

Oracle Linux 8 : ghostscript (ELSA-2026-93978)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-93978 advisory. 9.27-20 - CVE-2026-112177 ghostscript: Reintroduction of .charkeys -dSAFER bypass in RHEL 8 -dSAFER bypass in RHEL 8 Tenable has extracted the preceding...

Linux Distros Unpatched Vulnerability : CVE-2026-120063

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When psqlODBC quotes a schema or table name into a 128-byte stack buffer, its length check lets it write up to two bytes past the end of the buffer for a long...

Google Chrome < 157.0.8103.38 Multiple Vulnerabilities

The version of Google Chrome installed on the remote Windows host is prior to 157.0.8103.38. It is, therefore, affected by multiple vulnerabilities as referenced in the 202611stable-channel-update-for-desktop advisory. - Use after free in TabStrip. CVE-2026-121114, CVE-2026-121257 - Missing...

Mozilla Firefox < 159.0.1

The version of Firefox installed on the remote Windows host is prior to 159.0.1. It is, therefore, affected by a vulnerability as referenced in the mfsa2026-123 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number...

RHEL 8 : libXtst (RHSA-2026:94482)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:94482 advisory. X.Org X11 libXtst runtime library Security Fixes: libXtst: libXtst: Denial of Service via out-of-bounds read in RECORD reply parser CVE-2026-94286 F...

Linux Distros Unpatched Vulnerability : CVE-2026-74846

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier...

Oracle Linux 9 : qemu-kvm (ELSA-2026-88421)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-88421 advisory. 10.1.0-17.el98.9 - kvm-qcow2-Add-keepdatafile-command-line-option.patch RHEL-164549 - kvm-qcow2-Simplify-size-round-up-in-cocreateopts.patch RHEL-164549 -...

nginx 0.8.11 < 1.30.4 / 1.31.x < 1.31.3 Use-After-Free Memory Corruption

According to its Server response header, the installed version of nginx is 0.8.11 prior to 1.30.4 or 1.31.x prior to 1.31.3. It is, therefore, affected by the following issue : - NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpssimodule module. This vulnerability may exist whe...

Oracle Linux 8 : firefox (ELSA-2026-94405)

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-94405 advisory. 153.6.0-1.0.1 - Fix firefox-oracle-default-prefs.js for new nss Orabug: 37079789 - diable wasisdk to prevent build failure with newer llvm 153.6.0 - A...

SUSE SLES15 Security Update : kernel (Live Patch 27 for SUSE Linux Enterprise 15 SP6) (SUSE-SU-2026:5016-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:5016-1 advisory. This update for the SUSE Linux Enterprise Kernel 6.4.0-150600.23.115 fixes various security issues: The following security issues were fixed: -...