RHCOS 4 : Red Hat build of MicroShift 4.19.43 (RHSA-2026:54883)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:54883 advisory. - net/mail: golang: Go net/mail: Denial of Service via crafted email inputs CVE-2026-39820 Note that Nessus has not tested for this issue bu...

RockyLinux 8 : python3 (RLSA-2026:56219)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:56219 advisory. python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory CVE-2026-11940 Tenable has extracted the preceding descripti...

AlmaLinux 9 : php:8.2 (ALSA-2026:40416)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:40416 advisory. php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD CVE-2026-14355 Bug Fixes and Enhancements: Rebase PHP to 8.2.32 for...

Fedora 44 : GitPython (2026-166bfc4f18)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-166bfc4f18 advisory. Update to 3.1.59 close RHBZ2499503 - Fixes GHSA-5xxx-qhh7-9287, GHSA-3wxw-xv34-2frg, GHSA-8mcc-hrx5-hvxc, GHSA-284h-m62q-gf8w, GHSA-7833-fr7j-v32q,...

RHEL 8 : kpatch-patch-4_18_0-477_107_1, kpatch-patch-4_18_0-477_120_1, kpatch-patch-4_18_0-477_130_1, kpatch-patch-4_18_0-477_143_1, and kpatch-patch-4_18_0-477_97_1 (RHSA-2026:55761)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:55761 advisory. This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the code of a running kernel. This patc...

Debian dsa-6452 : designate - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6452 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6452-1 [email protected] https://www.debian.org/securit...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libssh2 (UTSA-2026-102685)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102685 advisory. libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftpopen function in src/sftp.c that allows a malicious SSH server to...

SUSE SLES15 Security Update : redis7 (SUSE-SU-2026:3636-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3636-1 advisory. This update for redis7 fixes the following issue: - CVE-2026-66373: remote code execution via a RESTORE payload where the same NACK pending...

Linux Distros Unpatched Vulnerability : CVE-2026-72490

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix stainfo check in rtwaesdecrypt The null-pointer-guard was incorrect,...

The vulnerability of the Windows operating system’s kernel allows a perpetrator to elevate their privileges and cause service failures.

The vulnerability of the Windows operating system’s kernel is related to unreliable pointer aliasing. Exploiting this vulnerability can allow an attacker to increase their privileges and cause service interruptions...

Linux Distros Unpatched Vulnerability : CVE-2026-76014

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability has been found in BusyBox up to 1.30.1. This vulnerability affects unknown code of the file networking/wget.c of the component FEATUREWGETTIMEOU...

CVE-2026-74947

Privilege escalation due to invalid pointer in the Graphics component...

MAL-2026-14169 Malicious code in comand (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d3576e830f201f4264c061dc377c51fa35bab19543a98c0feb316305051190b On npm install, scripts/postinstall.js executes automatically. It first POSTs a JSON body containing the resolved host platform Windows/MacOS/Linux,...

Malicious code in comand (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d3576e830f201f4264c061dc377c51fa35bab19543a98c0feb316305051190b On npm install, scripts/postinstall.js executes automatically. It first POSTs a JSON body containing the resolved host platform Windows/MacOS/Linux,...

MAL-2026-14180 Malicious code in lodahs-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15cec128c194761de8cd73923062ece7e4104b5e6130ca40882c5ac9d3f83914 The postinstall lifecycle script in scripts/postinstall.js executes automatically on npm install and performs three attacker-benefiting actions. Firs...

Malicious code in lodahs-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15cec128c194761de8cd73923062ece7e4104b5e6130ca40882c5ac9d3f83914 The postinstall lifecycle script in scripts/postinstall.js executes automatically on npm install and performs three attacker-benefiting actions. Firs...

MAL-2026-14167 Malicious code in chalk-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57cc6705c0b1dabca055a6531e36802822a4441a367459efb4ba8ecbc4a92ce5 chalk-lib is a typosquat of the popular chalk package with an empty library body index.js exports whose entire effect is the postinstall lifecycle...

Malicious code in chalk-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57cc6705c0b1dabca055a6531e36802822a4441a367459efb4ba8ecbc4a92ce5 chalk-lib is a typosquat of the popular chalk package with an empty library body index.js exports whose entire effect is the postinstall lifecycle...

Malicious code in lodash-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ae5d5ee58992e051846753bb190ad3f357538cf5ed570ac825b8b7c9d2a3619 [email protected] typosquats lodash; index.js exports an empty object and the package's only real behavior lives in scripts/postinstall.js. On npm...

MAL-2026-14182 Malicious code in lodash-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ae5d5ee58992e051846753bb190ad3f357538cf5ed570ac825b8b7c9d2a3619 [email protected] typosquats lodash; index.js exports an empty object and the package's only real behavior lives in scripts/postinstall.js. On npm...