Oracle Linux 10 : ELSA-2026-65816-0: / qt6-qt5compat (ELSA-2026-658160)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-658160 advisory. 6.10.1-1.1 - Fix out-of-bounds read in QTextCodec::codecForName CVE-2026-9499 Resolves: RHEL-247204 Tenable has extracted the preceding description block...

Linux Distros Unpatched Vulnerability : CVE-2026-89044

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final fail to properly validate the final transfer coding in the...

Linux Distros Unpatched Vulnerability : CVE-2026-53939

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption JOSE. In versions 0.6.1 through 0.6.2.5, when cjose encrypts a JWE using ...

Fedora 43 : valkey (2026-cda5ad190f)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-cda5ad190f advisory. Valkey 8.1.10 - Released Mon 31 August 2026 Upgrade urgency SECURITY: This release includes security fixes we recommend you apply as soon as possible. Securi...

Linux Distros Unpatched Vulnerability : CVE-2026-88048

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Tesseract is an open source OCR engine. In version 5.5.3 and earlier, FullyConnected::DeSerialize in src/lstm/fullyconnected.cpp does not validate the...

Amazon Linux 2 : containerd (ALASECS-2026-136)

The version of containerd installed on the remote host is prior to 2.2.7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2026-136 advisory. Fix GHSA-p7v4-vr35-mj6f; containerd CRI plugin: Checkpoint restore bypasses destination security context.A...

Unity Linux 20.1060a / 20.1070a Security Update: LibRaw (UTSA-2024-002265)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2024-002265 advisory. Buffer Overflow vulnerability in LibRaw linux/unix v0.20.0 allows attacker to escalate privileges via the LibRawbufferdatastream::getschar, int in...

Oracle Linux 7 : python-urllib3 (ELSA-2026-9031)

The remote Oracle Linux 7 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-9031 advisory. 1.10.2-7.0.3 - Backport fix for CVE-2025-66471 Orabug: 39233228 Tenable has extracted the preceding description block directly from the Oracle Linux security...

Ubuntu 22.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS : GNU C Library vulnerabilities (USN-8737-1)

The remote Ubuntu 22.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8737-1 advisory. It was discovered that GNU C Library had a buffer overflow in the strfmon function when handling right- justificatio...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS : OpenSSH vulnerabilities (USN-8721-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8721-1 advisory. It was discovered that OpenSSH's ssh-agent incorrectly handled interactions...

Fedora 43 : perl-Net-DNS (2026-1237afef8a)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-1237afef8a advisory. Update to Net-DNS 1.56 from 1.53. Security fixes: - CVE-worthy: Remote code injection via EDNS EXTENDED ERROR rt.cpan 179945 - Denial of Service via...

Python Library Tornado < 6.5.8 DoS (CVE-2026-82397)

The version of the Tornado Python package installed on the remote host is prior to 6.5.8. It is, therefore, affected by a denial of service vulnerability: - Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded...

MikroTik RouterOS 7.9 < 7.23.4 / 7.24.x < 7.24.2 SSH Authentication Bypass (CVE-2026-67276)

According to its self-reported version, the remote networking device is running a version of MikroTik RouterOS 7.9 prior to 7.23.4, or 7.24.x prior to 7.24.2. It is, therefore, affected by an authentication bypass vulnerability. RouterOS does not compare the complete RSA public key when matching ...

Linux Distros Unpatched Vulnerability : CVE-2026-89045

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length parameters in ZstdInputStreamNoFinalizer.read, allowing attackers to trigger infinit...

AlmaLinux 9 : opentelemetry-collector (ALSA-2026:65117)

The remote AlmaLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:65117 advisory. net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 net/mail: golang: Go net/mail: Denial of Service via...

Security Updates for Microsoft Office Online Server (September 2026)

The Microsoft Office Online Server or Office Web Apps installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. CVE-2026-81947...

Linux Distros Unpatched Vulnerability : CVE-2026-88924

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the...

JetBrains YouTrack < 2025.3.160480 / 2026.1.x < 2026.1.14047 Improper Access Control (CVE-2026-86498)

The version of JetBrains YouTrack installed on the remote host is prior to 2025.3.160480, or 2026.1.x prior to 2026.1.14047. It is, therefore, affected by an improper access control vulnerability: - In JetBrains YouTrack before 2025.3.160480, 2026.1.14047 PUT requests on link sub-resources allowe...

Amazon Linux 2023 : nginx, nginx-all-modules, nginx-core (ALAS2023-2026-2130)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2130 advisory. An HTTP/2 denial of service vulnerability was found in nginx. Prior to the fix, there was no limit on the number of request headers a client could send. An attacker could seed the HPACK dynamic table...

JetBrains TeamCity < 2025.11.6 / 2026.1.x < 2026.1.2 Code Execution (CVE-2026-65906)

The version of JetBrains TeamCity installed on the remote host is prior to 2025.11.6, or version 2026.1 up to but not including 2026.1.2. It is, therefore, affected by a vulnerability: - In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution via Kotlin DSL sandbox escape was possible...