Fedora 44 : perl / perl-Devel-Cover / perl-PAR-Packer / polymake (2026-475559cbb9)

The remote Fedora 44 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-475559cbb9 advisory. Update Perl to 5.42.3 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

MiracleLinux 9 : containernetworking-plugins-1.9.0-3.el9_8 (AXSA:2026-1426:03)

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-1426:03 advisory. net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient...

RockyLinux 8 : unbound (RLSA-2023:2771)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2023:2771 advisory. unbound: NRDelegation attack leads to uncontrolled resource consumption Non-Responsive Delegation Attack CVE-2022-3204 Tenable has extracted the preceding...

nodejs26-26.5.1-1.1 on GA media (moderate)

nodejs26-26.5.1-1.1 on GA media Announcement ID: openSUSE-SU-2026:11440-1 Rating: moderate Cross-References: CVE-2026-56846 CVE-2026-56847 CVE-2026-56848 CVE-2026-56850 CVE-2026-58039 CVE-2026-58040 CVE-2026-58041 CVE-2026-58042 CVE-2026-58043 CVE-2026-58044 CVE-2026-58045 CVSS scores:...

Important: python3

Issue Overview: CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host. CVE-2026-1502 The incremental HTML parser html.parser.HTMLParser allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data. CVE-2026-15308 When...

MiracleLinux 9 : mariadb:11.8 (AXSA:2026-1449:01)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1449:01 advisory. mariadb: MariaDB Server: Arbitrary code execution via wsrepnotifycmd CVE-2026-49261 Tenable has extracted the preceding description block directly from the...

Amazon Linux 2023 : php8.3, php8.3-bcmath, php8.3-cli (ALAS2023-2026-2044)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2044 advisory. Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24...

Amazon Linux 2 : runfinch-finch, --advisory ALAS2DOCKER-2026-137 (ALASDOCKER-2026-137)

The version of runfinch-finch installed on the remote host is prior to 1.17.2-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2026-137 advisory. On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root wh...

RHEL 10 : fence-agents (RHSA-2026:49911)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:49911 advisory. The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachabl...

Amazon Linux 2023 : aws-nitro-enclaves-cli, aws-nitro-enclaves-cli-devel, aws-nitro-enclaves-cli-integration-tests (ALAS2023-2026-2034)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2034 advisory. rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.7 to before 0.10.79, X509Ref::ocspresponders returns OCSP responder URLs from a certificate's AIA extension as...

Medium: libxml2

Issue Overview: libxml2 is vulnerable to multiple stack-based buffer overflows in the xmlcatalog utility when running in --shell mode. The usershell function processes user input using fixed-size stack buffers without proper bounds checking. By supplying an overly long input line, an attacker can...

Mozilla Firefox < 153.0.3

The version of Firefox installed on the remote Windows host is prior to 153.0.3. It is, therefore, affected by a vulnerability as referenced in the mfsa2026-73 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number...

Important: python3.11

Issue Overview: CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host. CVE-2026-1502 The incremental HTML parser html.parser.HTMLParser allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data. CVE-2026-15308 In the...

Important: python

Issue Overview: CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host. CVE-2026-1502 The incremental HTML parser html.parser.HTMLParser allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data. CVE-2026-15308 When...

Important: vim

Issue Overview: Vim is an open source, command line text editor. Prior to 9.2.0736, the PHP omni-completion script in runtime/autoload/phpcomplete.vim interpolates a class or trait name, taken from the contents of the edited buffer, into a search pattern that is run via winexecute without escapin...

SUSE SLED15 / SLES15 Security Update : containerd (SUSE-SU-2026:3450-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3450-1 advisory. - CVE-2026-35469: github.com/moby/spdystream: memory amplification in SPDY frame parsing leads to denial of...

Amazon Linux 2 : rclone, --advisory ALAS2-2026-3834 (ALAS-2026-3834)

The version of rclone installed on the remote host is prior to 1.55.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3834 advisory. Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to...

Photon OS 5.0: Nginx PHSA-2026-5.0-0935

An update of the nginx package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-0935. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Amazon Linux 2 : java-1.8.0-amazon-corretto, --advisory ALAS2CORRETTO8-2026-024 (ALASCORRETTO8-2026-024)

The version of java-1.8.0-amazon-corretto installed on the remote host is prior to 1.8.0502.b07-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2CORRETTO8-2026-024 advisory. Vulnerability in Oracle Java SE component: JSSE. Supported versions that are affected ar...

Amazon Linux 2 : aws-nitro-enclaves-cli, --advisory ALAS2NITRO-ENCLAVES-2026-115 (ALASNITRO-ENCLAVES-2026-115)

The version of aws-nitro-enclaves-cli installed on the remote host is prior to 1.4.5-0. It is, therefore, affected by a vulnerability as referenced in the ALAS2NITRO-ENCLAVES-2026-115 advisory. rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.7 to before 0.10.79,...