Linux Distros Unpatched Vulnerability : CVE-2026-80817

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iommu/iommufd: Fix NULL pointer deref in iommufdioaschangeprocess when racing with ioptmapfilepages iommufdioaschangeprocess iterates every IOAS area while only...

Linux Distros Unpatched Vulnerability : CVE-2026-18453

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in 389 Directory Server. A missing NULL pointer check in the paged results handling of opsharedsearch allows an unauthenticated remote attacker...

Linux Distros Unpatched Vulnerability : CVE-2026-86091

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools an...

TencentOS Server 4: buildah (TSSA-2026:0954)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0954 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

MiracleLinux 9 : grafana-10.2.6-23.el9_8.3 (AXSA:2026-1777:26)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1777:26 advisory. net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 net/mail: golang: Go net/mail: Denial of Service...

LOYTEC L-IP BACnet/IP Routers Out-of-bounds Read (CVE-2026-55732)

The BACnet packet parser of a LOYTEC L-IP BACnet/IP router reads out of bounds of the internal 'bacdtdaystillmonth' lookup table in 'bacdtdatetimetotod' when it processes a malformed BACnet TimeSynchronization or UTC-TimeSynchronization packet carrying an invalid month value. An unauthenticated...

Debian dla-4775 : thunderbird - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4775 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4775-1 [email protected]...

Linux Distros Unpatched Vulnerability : CVE-2026-86420

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick before 7.1.2-30 and 6.9.13-55 fails to properly lower the memory budget when an operation inside OpenPixelCache fails. Repeated triggering of such...

Fedora 44 : gegl04 (2026-79b351972c)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-79b351972c advisory. This update fixes an overflow in parsing RGBE/HDR image files. Tenable has extracted the preceding description block directly from the Fedora security...

Linux Distros Unpatched Vulnerability : CVE-2025-56534

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A cross-site scripting XSS vulnerability in the custom authenticator driver of opennebula v6.10.0.1 allows attackers to execute arbitrary web scripts or HTML vi...

Linux Distros Unpatched Vulnerability : CVE-2026-86227

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A weakness has been identified in valkey-io valkey up to 9.0.5/9.1.1. This affects the function kvstoreGetHashtable of the file src/kvstore.c. This manipulation...

LOYTEC L-IP BACnet/IP Routers Stack-based Buffer Overflow (CVE-2026-55728)

The 'cmdipaddrconflict' subcommand of the SUID-root '/usr/bin/ltsudo' utility on a LOYTEC L-IP BACnet/IP router copies a user-supplied network interface name into a fixed 20-byte stack buffer using 'strcpy' without bounds checking. A 'superadmin'-group attacker can supply an overly long interface...

Linux Distros Unpatched Vulnerability : CVE-2026-80779

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/ionic: avoid OOB TX partner lookup for hwstamp RXQ The dedicated hardware timestamp RX queue is allocated with q-index equal to lif-ionic-nrxqsperlif. The...

TencentOS Server 4: vim (TSSA-2026:0957)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0957 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

TencentOS Server 4: java-17-konajdk (TSSA-2026:0977)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0977 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

Fedora 46 : libcupsfilters (2026-5cce49502a)

The remote Fedora 46 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-5cce49502a advisory. Automatic update for libcupsfilters-2.2.1-3.fc46. Changelog Fri Sep 4 2026 Zdenek Dohnal - 1:2.2.1-3 - fix multiple copies not working for raster drivers...

Linux Distros Unpatched Vulnerability : CVE-2026-78254

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The ftp and scp tasks of Apache Ant can download files from a remote server. A malicious server can provide relative paths that allow it to write outside of the...

Malicious code in eacq-payform-core (npm)

Source: amazon-inspector ac90938ceb191a40f640c12f11258ef8a518d24480072eeaa0791a155a49c724 On require of the package, index.js loads vendor.js which selects a platform-specific endpoint, fetches an opaque binary over HTTPS from Cloudflare Workers subdomains whose hostnames are reconstructed at...

Malicious code in eacq-acq-menu-core (npm)

Source: amazon-inspector daaba295870311c8170bc4ec82050e0f4ba2989be2b3e10de136647fc18ea6fc On require, index.js loads helpers.js which reconstructs C2 hostnames from split-string arrays e.g., 'oob-worker.cf.workers.dev' and 'sdk.dl.wel1.ru' and downloads a platform-specific binary via https.get. T...

Malicious code in eacq-acq-menu (npm)

Source: amazon-inspector ae7929c06f789a6fc910fd4ce4697fd5d32f06b55a0c9b5e406110f90676c239 On require of the package, index.js loads adapter.js which unconditionally executes a setup routine that fetches a platform-specific binary from runtime-reconstructed hosts Cloudflare workers.dev subdomains...