MiracleLinux 8 : xorg-x11-server-Xwayland-21.1.3-20.el8_10.3 (AXSA:2026-1277:06)

The remote MiracleLinux 8 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1277:06 advisory. xorg: X11: xserver: X.org: glamor Font Atlas Heap Buffer Overflow CVE-2026-55999 Tenable has extracted the preceding description block directly from the...

UBUNTU-CVE-2026-63980

In the Linux kernel, the following vulnerability has been resolved: net/handshake: Use spinlockbh for hnlock nvmettcpstatechange, a socket callback that runs in BH context, can reach handshakereqcancel via nvmettcpschedulereleasequeue and tlshandshakecancel. handshakereqcancel acquires hn-hnlock...

Fedora 44 : dnsx (2026-902340971e)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-902340971e advisory. Update to 1.3.0 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested fo...

Oracle Linux 10 : .NET / 10.0 (ELSA-2026-41897)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-41897 advisory. 10.0.110-1.0.1 - Add support for Oracle Linux 10.0.110-1 - Update to .NET SDK 10.0.110 and Runtime 10.0.10 - Resolves: RHEL-192463 10.0.109-2 - Reduc...

TencentOS Server 3: go-toolset:rhel8 (TSSA-2026:0648)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0648 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

TencentOS Server 3: postgresql:16 (TSSA-2026:0655)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0655 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

Oracle Linux 10 : postgresql16 (ELSA-2026-27743)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-27743 advisory. 16.14-1.0.1 - Replace upstream reference Orabug: 37044148 16.14-1 - Update to 16.14 - Fix CVE-2026-6478 Tenable has extracted the preceding descripti...

Amazon Linux 2023 : python3.13, python3.13-devel, python3.13-freethreading (ALAS2023-2026-1964)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1964 advisory. The tarfile module would still apply normalization of AREGTYPE \x00 blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPELONGNAME or GNUTYPELONGLINK. This could result ...

Fedora 44 : wireshark (2026-bc152c9ff6)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-bc152c9ff6 advisory. Latest wireshark version includes fixes for the following CVEs: CVE-2026-15163 CVE-2026-15164 CVE-2026-15165 CVE-2026-15166 CVE-2026-15167...

BIT-DRUPAL-2026-55804 Drupal core - Moderately critical - Gadget chain - SA-CORE-2026-006

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.,...

[SECURITY] [DSA 6392-1] tiff security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6392-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 19, 2026 https://www.debian.org/security/faq -...

SUSE CVE-2026-15905

Use after free in Aura in Google Chrome prior to 150.0.7871.128 allowed a local attacker to potentially exploit heap corruption via a malicious file. Chromium security severity: High...

DEBIAN-CVE-2026-64172

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Disable AVIC IPI virtualization on Hygon Family 18h erratum 1235 Hygon Family 18h CPUs are derived from AMD Family 17h Zen1 silicon and share the same erratum 1235: hardware may read a stale IsRunning=1 bit during ICR...

DEBIAN-CVE-2026-64125

In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: keep RBUF EEE/PM disabled Setting RBUFEEEEN | RBUFPMEN in RBUFENERGYCTRL breaks the RX path on GENET hardware once MAC EEE becomes active. RX traffic stops flowing while the link stays up and the usual descriptor/R...

DEBIAN-CVE-2026-64104

In the Linux kernel, the following vulnerability has been resolved: virt: sev-guest: Explicitly leak pages in unknown state When setmemoryencrypted,decrypted fail, the user cannot know at which point the function failed, meaning that the pages are left in an unknown state from the point of view o...

DEBIAN-CVE-2026-64038

In the Linux kernel, the following vulnerability has been resolved: hwmon: lm90 Stop work before releasing hwmon device Sashiko reports: In lm90probe, the devm action to cancel the alertwork and reportwork lm90restoreconf is registered in lm90initclient before devmhwmondeviceregisterwithinfo is...

DEBIAN-CVE-2026-64018

In the Linux kernel, the following vulnerability has been resolved: net: mana: validate rxreqidx to prevent out-of-bounds array access In manahwcrxeventhandler, rxreqidx is derived from sge-address in DMA-coherent memory. In Confidential VMs SEV-SNP/TDX, this memory is shared unencrypted and HW c...

DEBIAN-CVE-2026-63940

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Ignore Port I/O requests of length '0' Explicitly ignore Port I/O requests of length '0' or count '0', so that setting up the software scratch area and other code doesn't have to worry about underflowing the length, and...

DEBIAN-CVE-2026-63903

In the Linux kernel, the following vulnerability has been resolved: USB: serial: belkinsa: validate interrupt status length The Belkin interrupt callback treats interrupt data as a four-byte status report and reads LSR/MSR fields at offsets 2 and 3. The interrupt-in buffer length is derived from...

DEBIAN-CVE-2026-63890

In the Linux kernel, the following vulnerability has been resolved: scsi: fcoe: Reject FIP descriptors with zero fipdlen in CVL walker drivers/scsi/fcoe/fcoectlr.c::fcoectlrrecvclrvlink advanced the descriptor cursor by an attacker-supplied fipdlen without ever requiring dlen = sizeofstruct fipde...