RHEL 7 / 8 / 9 : Java 11 OpenJDK ELS Security Update (Moderate) (RHSA-2026:55778)

The remote Redhat Enterprise Linux 7 / 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:55778 advisory. The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. This...

ROS-20260819-73-0004

The vulnerability in gobgp is related to the assignment of the zero pointer. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2026-78717

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandlerdecode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records can cause...

PT-2026-78575

Snipe-IT is an IT asset/license management system. Prior to 8.6.3, a company-scoped user in FMCS floater mode can access users whose company id is null because broad API queries and bulk web actions do not consistently apply isCurrentUserHasAccess. The /api/v1/users and /api/v1/users/id/licenses...

PT-2026-78396

phpMyFAQ before 4.1.7 affected versions = 4.1.5 fails to persist the WebAuthn login challenge generated by prepareForLogin, because neither WebAuthn controller saves the mutated key objects back to the database. At login the anti-replay comparison is skipped by its own null guard, allowing an...

PT-2026-78530

FFmpeg before commit 983dae9 contains an out-of-bounds read in the AV1 RTP packetizer libavformat/rtpenc av1.c. The keyframe detection loop that searches for a sequence header OBU advanced its pointer and remaining-size counter by the encoded header length plus the OBU payload size without first...

PT-2026-78579

Tapo C100/C101 V5 contains a null pointer dereference vulnerability in the RTSP service. An attacker on the local network can send specially crafted requests that cause the service to dereference an invalid pointer, resulting in a service crash and device reboot. Successful exploitation can disru...

Fedora 44 : radsecproxy (2026-099bb42b08)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-099bb42b08 advisory. radsecproxy 1.11.4 2026-08-10 Bug Fixes - Fix potential crash when rewrite is too big - Fix Message-Authenticator verification for CoA/Disconnect-Request - F...

AlmaLinux 8 : php:7.4 (ALSA-2026:47750)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:47750 advisory. php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD CVE-2026-14355 Bug Fixes and Enhancements: Backport fix for...

RHEL 9 : gegl04 (RHSA-2026:56982)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:56982 advisory. GEGL Generic Graphics Library is a graph-based image processing framework. Security Fixes: gimp: GIMP: Arbitrary code execution via heap-based buffe...

RHEL 9 : gegl04 (RHSA-2026:56963)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:56963 advisory. GEGL Generic Graphics Library is a graph-based image processing framework. Security Fixes: gimp: GIMP: Arbitrary code execution via heap-based buffe...

PT-2026-78593

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to the use of an uninitialized stack pointer...

RHEL 10 / 8 / 9 : java-21-openjdk (RHSA-2026:55787)

The remote Redhat Enterprise Linux 10 / 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:55787 advisory. The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security...

Oracle Linux 9 : curl (ELSA-2026-55439)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-55439 advisory. - fix HTTP Negotiate connection reuse auth bypass CVE-2026-1965 - fix OAuth2 bearer token leak via redirect and netrc CVE-2026-3783 - fix SSH host key...

Fedora 44 : lemonldap-ng (2026-55e1334aed)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-55e1334aed advisory. Update to 2.23.3 Fixes CVE-2026-19349 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: bind (UTSA-2026-103699)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-103699 advisory. It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. This...

SUSE SLED15: jetty-continuation / jetty-http / jetty-io / jetty-security / etc (SUSE-SU-2026:3631-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3631-1 advisory. - CVE-2026-10050: ISO-8859-1 lossy encoding allows authentication bypass via character substitution bsc1272393. Tenable...

RHEL 7 : java-1.8.0-openjdk (RHSA-2026:55774)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:55774 advisory. The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: gstreamer1-plugins-good (UTSA-2026-102691)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102691 advisory. A flaw was found in GStreamer's gst-plugins-good. A heap-based out-of-bounds read of 4 bytes can occur when parsing FLAC audio stream headers embedded in a Matroska ...

SUSE SLES12 Security Update : rsync (SUSE-SU-2026:3629-1)

The remote SUSE Linux SLES12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3629-1 advisory. - CVE-2026-29518: Symlink-Race TOCTOU in Daemon bsc1264511. - CVE-2026-43619: Symlink Race Condition via Path-Based Syscalls bsc1264514. Tenabl...