CVE-2026-91815: Out-of-bounds Write

Foxit PDF Editor/Reader does not perform sufficient verification of the JPEG2000 image metadata in the PDF file, which leads to out-of-bounds write in the heap buffer during decoding, potentially causing the program to crash and introducing the risk of arbitrary code execution...

CVE-2026-88830: Incorrect Calculation of Buffer Size

A unit confusion in BusyBox TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted ClientKeyExchange message...

PT-2026-97416

Name of the Vulnerable Software and Affected Versions BusyBox affected versions not specified Description A unit confusion bug in the TLS Montgomery reduction buffer allocation leads to a heap buffer overflow. This occurs during the processing of a crafted ClientKeyExchange message during the...

RockyLinux 9 : postgresql (RLSA-2026:69607)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:69607 advisory. postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions CVE-2026-14662 postgresql: PostgreSQL: Arbitra...

MiracleLinux 8 : apr-util-1.6.1-9.el8_10.1 (AXSA:2026-1895:02)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1895:02 advisory. apr-util: Apache Portable Runtime Utility: Heap buffer overflow in redis client CVE-2026-34501 apr-util: Apache Portable Runtime Utility: Informatio...

RockyLinux 10 : rsyslog (RLSA-2026:69541)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:69541 advisory. rsyslog: rsyslog: Denial of service via heap buffer overflow in RainerScript replace function CVE-2026-78002 Tenable has extracted the preceding description blo...

FreeBSD : angie-module-njs -- multiple vulnerabilities (6cf326a2-b38c-11f1-a655-3497f65b111b)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 6cf326a2-b38c-11f1-a655-3497f65b111b advisory. The njs development team reports: Access control bypass in jsaccess when an asynchronous reque...

RockyLinux 10 : postgresql16 (RLSA-2026:70186)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:70186 advisory. postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions CVE-2026-14662 postgresql: PostgreSQL:...

RockyLinux 8 : coreutils (RLSA-2026:69964)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:69964 advisory. coreutils: Heap Buffer Under-Read in GNU Coreutils sort via Key Specification CVE-2025-5278 Tenable has extracted the preceding description block directly from t...

Critical: unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fixes: unbound: Unbound: Remote Code Execution Vulnerability in CNAME Synthesis CVE-2026-82717 unbound: Unbound: Heap buffer overflow via malicious DNSSEC response CVE-2026-81634 unbound: Unbound:...

PT-2026-97234

Name of the Vulnerable Software and Affected Versions Foxit PDF Editor/Reader affected versions not specified Description Insufficient verification of JPEG2000 image metadata within a PDF file leads to an out-of-bounds write in the heap buffer during the decoding process. This memory corruption c...

Linux Distros Unpatched Vulnerability : CVE-2026-63273

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing an encrypted document. The length of the decryption key was taken from...

RHEL 9 : postgresql:15 (RHSA-2026:70762)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:70762 advisory. PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL: Arbitrary code executi...

Oracle Linux 8 : apr-util (ELSA-2026-69113)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-69113 advisory. - Resolves: RHEL-236630 - apr-util: Apache Portable Runtime Utility: Information disclosure via timing attack in password validation CVE-2025-49506 -...

Linux Distros Unpatched Vulnerability : CVE-2016-15059

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Net::IDN::Punycode versions before 2.301 for Perl allow a heap buffer overflow via unchecked writes past the output buffer in encodepunycode. The XS backend...

ALSA-2026:70754 Critical: unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fixes: unbound: Unbound: Remote Code Execution Vulnerability in CNAME Synthesis CVE-2026-82717 unbound: Unbound: Heap buffer overflow via malicious DNSSEC response CVE-2026-81634 unbound: Unbound:...

Linux Distros Unpatched Vulnerability : CVE-2026-63272

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - LibreOffice can import WMF graphics, which may be embedded in documents. A heap buffer overflow existed when importing a text record that carries its own...

AlmaLinux 10 : postgresql16 (ALSA-2026:70186)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:70186 advisory. postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions CVE-2026-14662 postgresql: PostgreSQL: Arbitra...

apr-util security update

1.6.1-9.1 - Resolves: RHEL-236630 - apr-util: Apache Portable Runtime Utility: Information disclosure via timing attack in password validation CVE-2025-49506 - Resolves: RHEL-236267 - apr-util: Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client CVE-2026-34502 - Resolves...

Oracle Linux 9 : rsyslog (ELSA-2026-69540)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-69540 advisory. - Fix CVE-2026-78002: heap buffer overflow in RainerScript replace function Resolves: RHEL-246641 Tenable has extracted the preceding description block directl...