Oracle Linux 8 : ELSA-2026-64794-0: / httpd:2.4 (ELSA-2026-647940)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-647940 advisory. - Resolves: RHEL-173558 - httpd:2.4/httpd: Apache HTTP Server modproxyajp: Arbitrary code execution via heap-based buffer overflow CVE-2026-28780 - Resolves:...

Linux Distros Unpatched Vulnerability : CVE-2026-84828

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in PCS Pacemaker Configuration System. A local attacker with membership in the 'haclient' group can exploit the 'pcs host auth --token' command...

PT-2026-89402

OpenPanel fails to enforce read-only project access level on 26 of 29 mutating procedures, allowing read-level members to modify, delete, and publish project data. Attackers with explicit read-only access can delete reports and dashboards, schedule entire projects for deletion, publish private...

CVE-2026-87640

Out of bounds read in WebView in Google Chrome on on Android prior to...

Oracle Linux 10 : ELSA-2026-65816-0: / qt6-qt5compat (ELSA-2026-658160)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-658160 advisory. 6.10.1-1.1 - Fix out-of-bounds read in QTextCodec::codecForName CVE-2026-9499 Resolves: RHEL-247204 Tenable has extracted the preceding description block...

CVE-2026-87586

Out of bounds read in ANGLE in Google Chrome prior to 153.0.8010.36 al...

CVE-2026-87596

Out of bounds read in ANGLE in Google Chrome prior to 153.0.8010.36 al...

CVE-2026-87650

Out of bounds read in WebGL in Google Chrome prior to 153.0.8010.36 al...

CVE-2026-87592

Out of bounds read in Tint in Google Chrome prior to 153.0.8010.36 all...

PT-2026-89266

The WP BackItUp Community Edition plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.0 via the 'backup file' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of...

Security Updates for Microsoft Office Online Server (September 2026)

The Microsoft Office Online Server or Office Web Apps installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. CVE-2026-81947...

Linux Distros Unpatched Vulnerability : CVE-2026-89046

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - zstd-jni versions 1.5.5-6 through 1.5.7-13 contain an out-of-bounds read vulnerability in Zstd.getFrameContentSize that fails to validate negative srcPosition...

Linux Distros Unpatched Vulnerability : CVE-2026-61908

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Cyrus IMAP before 3.12.4. A JMAP email-header blob ID can reference an out-of- bounds index. An authenticated user could attempt to...

PT-2026-89732

It was discovered that libEBML incorrectly handled certain read and write operations. An attacker could possibly use this issue to cause a buffer overflow, resulting in a denial of service...

PT-2026-89517

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, the callback form of GenericVector::read in src/ccutil/genericvector.h reads the independent int32 fields reserved and size used from a .traineddata model without a cap or an invariant check. reservereserved allocates the backi...

CVE-2026-79592

An out-of-bounds read vulnerability exists in the xlsdumpSummary function of libxls 1.6.3 due to insufficient validation of file-controlled OLE summary offsets...

AlmaLinux 9 : qt5-qtbase (ALSA-2026:65993)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:65993 advisory. qt: Qt: Denial of Service via out-of-bounds read in text codec handling CVE-2026-9499 Tenable has extracted the preceding description block directly from the...

Linux Distros Unpatched Vulnerability : CVE-2026-73324

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - VLC media player copies an RTSP response line into a fixed buffer without guaranteeing termination and then treats that buffer as a C string. RtspReadLine in...

Oracle Linux 9 : ELSA-2026-64808-0: / kernel (ELSA-2026-648080)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-648080 advisory. - KVM: arm64: Bound usedlrs when flushing the pKVM hyp vCPU Jon Maloy RHEL-234207 CVE-2026-64287 - nvmet-auth: validate reply message payload bounds...

Security Updates for Microsoft Office Products C2R (September 2026)

The Microsoft Office Products are missing security updates. It is, therefore, affected by multiple vulnerabilities: - Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network. CVE-2026-69285, CVE-2026-77898, CVE-2026-78505 - Heap-based buffer...