Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: ffmpeg (UTSA-2026-106183)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106183 advisory. FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processed with...

MiracleLinux 9 : pipewire-1.4.11-1.el9_8.2 (AXSA:2026-1754:03)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1754:03 advisory. pipewire: RAOP RTSP NULL Deref CVE-2026-14324 pipewire: Pulse Server alloca Stack Overflow CVE-2026-14330 Tenable has extracted the preceding...

Linux Distros Unpatched Vulnerability : CVE-2026-84933

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header. In...

Linux Distros Unpatched Vulnerability : CVE-2026-19534

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never...

MAL-2026-16012 Malicious code in orbitron-cli (npm)

The npm package orbitron-cli is malicious. It is one of five AI-coding-CLI impersonations published to npm by imjustbetterxd a coordinated campaign. On use, the CLI reads the developer's LLM/provider API key - from environment variables e.g. EXAAPIKEY, NVIDIAAPIKEY and its own config - and routes...

Linux Distros Unpatched Vulnerability : CVE-2026-76174

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Unrestricted file upload vulnerability in the CSV file upload functionality of the Ocsreports admininfo endpoint. The application validates files solely based o...

FreeBSD : njs -- heap buffer overflow in XML exclusive canonicalization (0bfb082c-a7b6-11f1-a655-3497f65b111b)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 0bfb082c-a7b6-11f1-a655-3497f65b111b advisory. F5 reports: A flaw in the NGINX JavaScript XML module allows an out-of-bounds write when...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mysql (UTSA-2026-106175)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106175 advisory. Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Replication. Supported versions that are affected are MySQL Server:...

Linux Distros Unpatched Vulnerability : CVE-2026-80752

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Input: psxpad-spi - set driver data before use psxpadspisuspend retrieves the controller state with spigetdrvdata, but probe never stores it, so suspend...

Fedora 43 : mrtg (2026-4522f50b2c)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-4522f50b2c advisory. Fix CVE-2026-72694: symlink-following privilege escalation in PID file handling Tenable has extracted the preceding description block directly from...

Oracle Linux 10 : ELSA-2026-61378-0: / freerdp (ELSA-2026-613780)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-613780 advisory. - Backport several CVE fixes CVE-2026-55194, CVE-2026-63633, CVE-2026-63652, CVE-2026-67288, CVE-2026-67291, CVE-2026-67296, CVE-2026-67297,...

MiracleLinux 8 : nodejs:22 (AXSA:2026-1753:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1753:01 advisory. nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw CVE-2026-58043 nodejs: Node.js: Remote memory exhaustion vi...

Linux Distros Unpatched Vulnerability : CVE-2026-80747

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amdkfd: Add bounds check for CRAT subtype length The CRAT parser validates that the subtype header fits within the image, but does not verify that the...

Linux Distros Unpatched Vulnerability : CVE-2026-80743

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ASoC: xilinx: formatterpcm: pass auddrvdata to irq handlers The irq handlers take a struct device pointer and call devgetdrvdata to obtain the driver data...

Linux Distros Unpatched Vulnerability : CVE-2026-85498

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - policykit-1 - None Red Hat Enterprise Linux - polkit: Regression in CVE-2026-4897 fix polkit readcookie - stack buffer underflow Ubuntu Linux -...

RHEL 10 : grafana-pcp (RHSA-2026:63119)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:63119 advisory. The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and...

Linux Distros Unpatched Vulnerability : CVE-2026-80843

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xfrm: fix xfrmstateconstruct auth-trunc leak attachauthtrunc can allocate x-aalg while leaving x-props.aalgo at zero when the selected auth algorithm has no...

Linux Distros Unpatched Vulnerability : CVE-2026-80797

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nfc: pn533: purge fragmented skbs during cleanup pn53xcommonclean purges respq before freeing the common PN533 state, but it leaves fragmentskb untouched. The...

Linux Distros Unpatched Vulnerability : CVE-2026-80762

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: hcisync: Fix accept list UAF during suspend hciupdateeventfiltersync walks hdev-acceptlist while sending a synchronous HCI command for each...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mysql (UTSA-2026-106171)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106171 advisory. Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Pluggable Auth. Supported versions that are affected are MySQL Server:...