CVE-2026-109836: ALCPU Core Temp: The Core Temp kernel driver provided by ALCPU is vulnerable to insufficient access control in an exposed IOCTL, which…

The Core Temp kernel driver provided by ALCPU is vulnerable to insufficient access control in an exposed IOCTL, which may allow physical memory to be read or written...

CVE-2026-115710: Elastic Elasticsearch: Use of Cache Containing Sensitive Information (CWE-524) in Elasticsearch can lead to information disclosure and…

Use of Cache Containing Sensitive Information CWE-524 in Elasticsearch can lead to information disclosure and incorrect search results via specially crafted search requests. For some query types, Elasticsearch can share cached query results between users who have field-level security restrictions...

CVE-2026-109593: SonicWall Global Management System (GMS): An unauthenticated attacker with network access to the SonicWall GMS 9.5.2 and earlier versions may be able to read…

An unauthenticated attacker with network access to the SonicWall GMS 9.5.2 and earlier versions may be able to read internal GMS files, potentially exposing sensitive information...

CVE-2025-71451: Vembu Technologies BDRSuite: Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting vulnerability in…

Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting vulnerability in templates/progress/serverside/serverbackupprogress.sgp that allows remote attackers to inject arbitrary JavaScript by manipulating request parameters such as ClientName, BackupName, and grpName that are...

CVE-2026-95725: Hewlett Packard Enterprise (HPE) Virtual Intranet Access (VIA): A command injection vulnerability exists in the VIA client for Linux

A command injection vulnerability exists in the VIA client for Linux. Successful exploitation could allow a low-privileged local attacker to execute arbitrary commands with elevated privileges on the affected system...

MiracleLinux 8 : dotnet9.0-9.0.123-1.el8_10 (AXSA:2026-2237:22)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-2237:22 advisory. dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnerability CVE-2026-114148 Tenable has extracted the preceding descripti...

Linux Distros Unpatched Vulnerability : CVE-2026-99245

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KEYS: Fix keyrejectandlink race with keyring restriction The restrictlink check in keyrejectandlink is done before taking the keyring semaphore, racing with a...

Linux Distros Unpatched Vulnerability : CVE-2026-99253

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iouring/cancel: rearm local work wake up before sleep iouringtrycancelrequests sets -cqwaitnr to 1 so that the next ioreqlocalworkadd wakes the cancelling task...

Linux Distros Unpatched Vulnerability : CVE-2026-99263

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iouring/poll: avoid retry wakeup loss when dropping ownership If a wakeup sets IOPOLLRETRYFLAG between the owning task consuming the existing instance of...

Google Chrome < 156.0.8078.88 Vulnerability

The version of Google Chrome installed on the remote Windows host is prior to 156.0.8078.88. It is, therefore, affected by a vulnerability as referenced in the 202611extended-stable-update-for-desktop advisory. Note that Nessus has not tested for this issue but has instead relied only on the...

RockyLinux 10 : pipewire (RLSA-2026:93442)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:93442 advisory. pipewire: Pulse Server alloca Stack Overflow CVE-2026-14330 Tenable has extracted the preceding description block directly from the RockyLinux security advisory...

Photon OS 5.0: Erlang PHSA-2026-5.0-91-0958

An update of the erlang package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-91-0958. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Linux Distros Unpatched Vulnerability : CVE-2026-121439

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 contains a response splitting vulnerability in wasi-http p3 that allows guests to set unvalidated...

RockyLinux 8 : ghostscript (RLSA-2026:93978)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:93978 advisory. ghostscript: Reintroduction of .charkeys -dSAFER bypass in Rocky Linux 8 CVE-2026-112177 Tenable has extracted the preceding description block directly from the...

Fedora 44 : barman / python-uv-build / ruff / rust-archive-trait / etc (2026-05eeaf8ac6)

"The remote Fedora 44 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-05eeaf8ac6 advisory. Update uv and python-uv-build to version 0.13.5. This includes some breaking changes to uv but none to python-uv-build %NASLMINLEVEL 80900 C Tenable, Inc. T...

Microsoft Visual Studio 15.9.x < 15.9.84 / 16.11.x < 16.11.61 / 17.14.x < 17.14.43 / 18.x < 18.11.2 Brotli Decoder Out-of-bounds Write (CVE-2026-111497)

The version of Microsoft Visual Studio installed on the remote Windows host is missing a security update. It is, therefore, affected by an elevation of privilege vulnerability: - A buffer overflow in the Brotli decoder c/dec/decode.c in Google Brotli 1.0.3 through 1.2.0 allows a remote...

Oracle Linux 8 : pcs (ELSA-2026-0930)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-0930 advisory. 0.10.18-2.0.1.el810.8 - Replaced HAM-logo 0.10.18 - Debrand PCS 0.10.18-2.el810.8 - Fixed CVE-2025-67725, CVE-2025-67726 by patching bundled Tornado...

RockyLinux 8 : bind9.16 (RLSA-2026:94011)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:94011 advisory. bind9: bind: BIND 9: Denial of Service via crafted DNSSEC responses CVE-2026-19662 bind: BIND: Denial of Service via unbounded processing of crafted DNS...

Photon OS 5.0: Python3 PHSA-2026-5.0-91-0793

An update of the python3 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-91-0793. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Linux Distros Unpatched Vulnerability : CVE-2026-120452

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libgphoto2 through 2.5.34 contains a heap out-of-bounds read and write vulnerability in jl2005bcddecompress that allows malicious USB cameras to corrupt heap...