RHEL 10 : tomcat9 (RHSA-2026:67163)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:67163 advisory. Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages...

Amazon Linux 2023 : gstreamer1-plugins-base, gstreamer1-plugins-base-devel, gstreamer1-plugins-base-tools (ALAS2023-2026-2158)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2158 advisory. GStreamer OGG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer...

Oracle Linux 10 : ELSA-2026-67154-0: / openssl (ELSA-2026-671540)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-671540 advisory. 3.5.8-1.0.1 - Replace upstream references Orabug: 34340177 - Update FIPS provider name Orabug: 35824276 1:3.5.8-1 - Rebase to OpenSSL 3.5.8 Resolves...

Linux Distros Unpatched Vulnerability : CVE-2026-86231

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A security flaw has been discovered in mwiede jsch up to 2.28.5. Affected is the function getRevokedKeys of the file...

RHEL 9 : delve (RHSA-2026:67313)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:67313 advisory. Delve is a debugger for the Go programming language. The goal of the project is to provide a simple, full featured debugging tool for Go...

SUSE SLED15: libzypp / libzypp-devel / zypper / zypper-log / etc (SUSE-SU-2026:4096-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4096-1 advisory. Security issue fixed: - invalidating legacy libzypp unsigned-repository cache state LIBZYPP-LEGACY-CACHE-01 bsc1274625....

RHEL 10 : yggdrasil (RHSA-2026:67134)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:67134 advisory. yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child worker...

Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS : Urwid vulnerabilities (USN-8751-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8751-1 advisory. Katriel Moses discovered that Urwid used a weak PRNG. A local attacker could possibly use this issue ...

Oracle Linux 8 : ELSA-2026-67145-0: / gstreamer1-plugins-base (ELSA-2026-671450)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-671450 advisory. - Add patch for CVE-2026-85150 Resolves: RHEL-253741 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory...

Amazon Linux 2023 : runc (ALAS2023-2026-2138)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2138 advisory. x509.Certificate.VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name SAN entries. This caused strings.Splithost, . to execute repeatedly on the same...

RHEL 8 : Red Hat Certificate System 10.4.4 security update for RHEL 8 (Moderate) (RHSA-2026:67110)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:67110 advisory. Red Hat Certificate System RHCS is a complete implementation of an enterprise software system designed to manage enterprise Public Key Infrastructur...

RHEL 10 : postgresql18-postgis (RHSA-2026:67166)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:67166 advisory. PostGIS adds support for geographic objects to the PostgreSQL object-relational database. In effect, PostGIS spatially enables the PostgreSQL serve...

Oracle Linux 9 : ELSA-2026-67165-0: / openssl (ELSA-2026-671650)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-671650 advisory. 3.5.8-1.0.1 - Replace upstream references Orabug: 34340177 3.5.8.openela.0.1 - Add OpenELA specific changes 1:3.5.8-1 - Rebase to OpenSSL 3.5.8...

RHEL 9 : ansible-core (RHSA-2026:67467)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:67467 advisory. Ansible is a radically simple model-driven configuration management, multi-node deployment, and remote task execution system. Ansible works over SSH...

Fedora 45 : perl-DBI (2026-2bf3261da2)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-2bf3261da2 advisory. 1.653 Fix test for 32bit-perl Fix arbitrary module and file loading via dbmtype/dbmmldbm CVE-2026-78030 Tighten symlink outside of fdir CVE-2026-153...

Oracle Linux 9 : ELSA-2026-67285-0: / rust (ELSA-2026-672850)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-672850 advisory. 1.92.0-2 - Apply libgit2 fix for CVE-2026-53587 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note...

Sophos Firewall <= 19.0 MR1 - Remote Code Execution

Sophos Firewall version v19.0 MR1 and older is vulnerable to code injection in the User Portal and Webadmin, allowing a remote unauthenticated attacker to execute arbitrary code. id: CVE-2022-3236 info: name: Sophos Firewall = 19.0 MR1 - Remote Code Execution author: daffainfo severity: critical...

DotCMS - Arbitrary File Upload

DotCMS management system contains an arbitrary file upload vulnerability via the /api/content/ path which can allow attackers to upload malicious Trojans to obtain server permissions. id: CVE-2022-26352 info: name: DotCMS - Arbitrary File Upload author: h1ei1 severity: critical description: DotCM...

GeoServer <1.2.2 - Remote Code Execution

Programs run on GeoServer before 1.2.2 which use jt-jiffle and allow Jiffle script to be provided via network request are susceptible to remote code execution. The Jiffle script is compiled into Java code via Janino, and executed. In particular, this affects downstream GeoServer 1.1.22. id:...

Ivanti Sentry - Authentication Bypass

A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration. id: CVE-2023-38035 info: name: Ivanti...