Important Photon OS Security Update - PHSA-2026-5.0-92-0940

Updates of 'mysql' packages of Photon OS have been released...

RockyLinux 8 : frr (RLSA-2026:49511)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:49511 advisory. frr: FRRouting: Denial of Service via crafted BGP UPDATE message CVE-2026-37460 Tenable has extracted the preceding description block directly from the RockyLinu...

Amazon Linux 2 : python-pillow, --advisory ALAS2-2026-3839 (ALAS-2026-3839)

The version of python-pillow installed on the remote host is prior to 2.0.0-23.gitd1c6db8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3839 advisory. Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image...

RHEL 8 / 9 : Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update (Important) (RHSA-2026:50319)

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:50319 advisory. Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT...

Amazon Linux 2023 : openvpn, openvpn-devel (ALAS2023-2026-2038)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2038 advisory. OpenVPN memory-leak in tls-crypt-v2 client key handling that could lead to out-of-memory situations and subsequent server crashes CVE-2026-12932 When dynamic tls-crypt is active, it is possibl...

Important: aws-nitro-enclaves-cli

Issue Overview: rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.7 to before 0.10.79, X509Ref::ocspresponders returns OCSP responder URLs from a certificate's AIA extension as OpensslString, whose Deref wraps the raw bytes with str::fromutf8unchecked. OpenSSL doe...

Important: ansible-core

Issue Overview: A flaw was found in ansible-core. The extractcollectionfromgit function in ansible-core's concreteartifactmanager.py constructs git clone commands without a '--' end-of-options separator before user-supplied URLs when installing collections from git sources. An attacker who provid...

Important: rclone

Issue Overview: Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, with -l/--links, rclone serializes symlinks as .rclonelink text objects and recreates them on a local destination without validating the target, allowing ...

Important: python3

Issue Overview: CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host. CVE-2026-1502 The incremental HTML parser html.parser.HTMLParser allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data. CVE-2026-15308 When...

MiracleLinux 9 : containernetworking-plugins-1.9.0-3.el9_8 (AXSA:2026-1426:03)

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-1426:03 advisory. net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient...

Fedora 44 : perl / perl-Devel-Cover / perl-PAR-Packer / polymake (2026-475559cbb9)

The remote Fedora 44 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-475559cbb9 advisory. Update Perl to 5.42.3 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

Amazon Linux 2023 : 7zip, 7zip-reduced, 7zip-standalone (ALAS2023-2026-2037)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2037 advisory. NOTE: Since p7zip/16.02+transitional.1 src:p7zip is only an empty source packageNOTE: depending on 7zip. Mark this version as fixed version.NOTE:...

Fedora 43 : doctl (2026-a36bdff8d7)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a36bdff8d7 advisory. Update to 1.164.0 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested...

SUSE SLES15 Security Update : libssh (SUSE-SU-2026:3463-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3463-1 advisory. - CVE-2026-59843: denial of service via zero advertised channel packet size bsc1272164. - CVE-2026-59844: denial of service via...

MiracleLinux 9 : git-lfs-3.7.1-4.el9_8.1 (AXSA:2026-1441:10)

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1441:10 advisory. golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVE-2026-39821 Tenable has extracted the...

AlmaLinux 9 : perl-DBI (ALSA-2026:49612)

The remote AlmaLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:49612 advisory. DBI: DBI: Arbitrary code execution via caller-influenced Profile attribute CVE-2026-14380 DBI: DBI: Heap overflow when preparsing SQL statements with...

Amazon Linux 2023 : python3.11, python3.11-devel, python3.11-idle (ALAS2023-2026-1998)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1998 advisory. CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host. CVE-2026-1502 The incremental HTML parser html.parser.HTMLParser allows for CPUdenial-of-service through repeated...

RockyLinux 8 : ldns (RLSA-2026:49520)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:49520 advisory. ldns: ldns: Off-path poisoning attacks due to insufficient query-response matching CVE-2026-10846 Tenable has extracted the preceding description block directly...

RockyLinux 8 : unbound (RLSA-2023:2771)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2023:2771 advisory. unbound: NRDelegation attack leads to uncontrolled resource consumption Non-Responsive Delegation Attack CVE-2022-3204 Tenable has extracted the preceding...

Amazon Linux 2023 : php8.3, php8.3-bcmath, php8.3-cli (ALAS2023-2026-2044)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2044 advisory. Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24...