AlmaLinux 9 : xorg-x11-server (ALSA-2026:38486)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:38486 advisory. xorg: X11: xserver: X.org: glamor Font Atlas Heap Buffer Overflow CVE-2026-55999 Tenable has extracted the preceding description block directly from the AlmaLinux...

RockyLinux 9 : buildah (RLSA-2026:38493)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:38493 advisory. os: golang: Go os.Root: Symlink following vulnerability allows directory traversal CVE-2026-39822 Tenable has extracted the preceding description block directly...

maven:3.9 security update

An update is available for module.slf4j, atinject, maven-resolver, module.maven, module.maven-wagon, slf4j, module.apache-commons-cli, plexus-utils, module.sisu, module.aopalliance, module.plexus-classworlds, apache-commons-io, module.plexus-sec-dispatcher, module.plexus-utils, jsr-305, maven,...

Oracle Linux 9 : gimp (ELSA-2026-38496)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-38496 advisory. - fix CVE-2026-58379 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus has not tested fo...

RockyLinux 9 : golang (RLSA-2026:37435)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:37435 advisory. golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVE-2026-39821 os: golang: Go os.Root...

Oracle Linux 9 : xorg-x11-server (ELSA-2026-38486)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-38486 advisory. 1.20.11-34.3 - CVE fix for CVE-2026-55999 Resolves: https://redhat.atlassian.net/browse/RHEL-191493 Tenable has extracted the preceding description block...

CVE-2026-60001 affecting package openssh for versions less than 9.8p1-9

CVE-2026-60001 affecting package openssh for versions less than 9.8p1-9. A patched version of the package is available...

CVE-2026-59995 affecting package openssh for versions less than 9.8p1-9

CVE-2026-59995 affecting package openssh for versions less than 9.8p1-9. A patched version of the package is available...

CVE-2026-57218 RabbitMQ: AMQP 0-9-1 in combination with OAuth 2: consumer persistence can lead to post-revocation message disclosure

RabbitMQ is a messaging and streaming broker. Prior to 4.2.6, RabbitMQ AMQP 0-9-1 allows an existing consumer to keep receiving messages after OAuth token expiry or connection.updatesecret refresh to reduced scopes because existing consumers are not canceled or reauthorized at delivery time after...

CVE-2026-55890

Grav is a file-based Web platform. Prior to 2.0.0-rc.9, Grav's incomplete fix for stored XSS through the Markdown media attribute action CVE-2026-42841 leaves the sibling MediaObjectTrait::style method reachable through the same Markdown excerpt-action pipeline, allowing an editor to save Markdow...

CVE-2026-55890 Grav: Stored CSS injection via Markdown image ?style=… reaches MediaObjectTrait::style()

Grav is a file-based Web platform. Prior to 2.0.0-rc.9, Grav's incomplete fix for stored XSS through the Markdown media attribute action CVE-2026-42841 leaves the sibling MediaObjectTrait::style method reachable through the same Markdown excerpt-action pipeline, allowing an editor to save Markdow...

EUVD-2026-42946

Grav is a file-based Web platform. Prior to 2.0.0-rc.9, Grav's incomplete fix for stored XSS through the Markdown media attribute action CVE-2026-42841 leaves the sibling MediaObjectTrait::style method reachable through the same Markdown excerpt-action pipeline, allowing an editor to save Markdow...

buildah security update

An update is available for buildah. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The buildah package provides a tool for facilitating building OCI container...

RockyLinux 9 : libreoffice (RLSA-2026:36832)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:36832 advisory. libreoffice: LibreOffice Calc: Arbitrary code execution via heap buffer overflow in formula compilation CVE-2026-8357 Tenable has extracted the preceding...

Oracle Linux 9 : buildah (ELSA-2026-37410)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-37410 advisory. - bump golang.org/x/crypto to v0.53.0 to fix CVE-2026-39832 and CVE-2026-39835 Tenable has extracted the preceding description block directly from the...

RockyLinux 9 : oci-seccomp-bpf-hook (RLSA-2026:36617)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:36617 advisory. net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME CVE-2026-33811 Tenable has extracted the preceding description block direct...

AlmaLinux 9 : gstreamer1-plugins-bad-free (ALSA-2026:36834)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:36834 advisory. gstreamer1-plugins-bad-free: GStreamer: Denial of service via AV1 tilelistobu parser byte/bit confusion CVE-2026-52718 gstreamer1-plugins-bad-free:...

RockyLinux 9 : tomcat (RLSA-2026:36879)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:36879 advisory. Apache Tomcat: Apache Tomcat: Information disclosure via Padding Oracle vulnerability in EncryptInterceptor CVE-2026-29146 Apache Tomcat: Apache Tomcat:...

PT-2026-57303

RabbitMQ is a messaging and streaming broker. Prior to 4.2.6, RabbitMQ AMQP 0-9-1 allows an existing consumer to keep receiving messages after OAuth token expiry or connection.update secret refresh to reduced scopes because existing consumers are not canceled or reauthorized at delivery time afte...

RockyLinux 9 : gstreamer1-plugins-good (RLSA-2026:37129)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:37129 advisory. gstreamer1-plugins-good: GStreamer: Heap buffer overflow in WavPack decoder via integer overflow CVE-2026-53705 Tenable has extracted the preceding description...