Fedora 43 : dnsx (2026-1c78e384e3)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-1c78e384e3 advisory. Update to 1.3.0 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested fo...

UBUNTU-CVE-2026-63941

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Correctly cap ZCREL2 provided by a guest hypervisor ZCREL2 can be updated by a VHE guest hypervisor either using ZCREL2 which traps or ZCREL1 which does not trap. KVM handles both in different way: - on ZCREL2 trap,...

UBUNTU-CVE-2026-64173

In the Linux kernel, the following vulnerability has been resolved: tracing: Do not call map-ops-eltfree if eltalloc fails In paths where tracingmapeltalloc failed to allocate objects, the map-ops-eltalloc call was never successful. In this case, map-ops-eltfree should not be called...

RHEL 9 : kernel (RHSA-2026:41063)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:41063 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: rtmutex: Use waiter::task...

CVE-2026-63953

In the Linux kernel, the following vulnerability has been resolved: mm/migratedevice: fix pgtable leak in migratevmainserthugepmdpage When migratevmainserthugepmdpage jumps to unlockabort due to a PMD check failure, the pgtable allocated earlier via pteallocone is never freed, causing a memory...

CVE-2026-63905

In the Linux kernel, the following vulnerability has been resolved: usbip: vudc: Fix use after free bug in vudcremove due to race condition This patch follows up Zheng Wang's 2023 report of a use-after-free in vudcremove. The original thread stalled on Shuah Khan's request for runtime testing of...

CVE-2026-64054

In the Linux kernel, the following vulnerability has been resolved: net: shaper: reject duplicate leaves in GROUP request netshapernlgroupdoit does not deduplicate NETSHAPERALEAVES entries. When userspace supplies the same leaf handle twice, the same old-parent pointer lands twice in oldnodes. Th...

CVE-2026-64138

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate SID in parent security descriptor during ACL inheritance Introduce smbvalidatentsdsid helper to safely validate Owner SID and Group SID inside the NT Security Descriptor smbntsd retrieved from the parent directory...

MiracleLinux 8 : xorg-x11-server-Xwayland-21.1.3-20.el8_10.3 (AXSA:2026-1277:06)

The remote MiracleLinux 8 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1277:06 advisory. xorg: X11: xserver: X.org: glamor Font Atlas Heap Buffer Overflow CVE-2026-55999 Tenable has extracted the preceding description block directly from the...

TencentOS Server 3: go-toolset:rhel8 (TSSA-2026:0648)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0648 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

Oracle Linux 10 : postgresql16 (ELSA-2026-27743)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-27743 advisory. 16.14-1.0.1 - Replace upstream reference Orabug: 37044148 16.14-1 - Update to 16.14 - Fix CVE-2026-6478 Tenable has extracted the preceding descripti...

Oracle Linux 10 : .NET / 10.0 (ELSA-2026-41897)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-41897 advisory. 10.0.110-1.0.1 - Add support for Oracle Linux 10.0.110-1 - Update to .NET SDK 10.0.110 and Runtime 10.0.10 - Resolves: RHEL-192463 10.0.109-2 - Reduc...

Fedora 44 : dnsx (2026-902340971e)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-902340971e advisory. Update to 1.3.0 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested fo...

TencentOS Server 3: postgresql:16 (TSSA-2026:0655)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0655 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

Fedora 44 : wireshark (2026-bc152c9ff6)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-bc152c9ff6 advisory. Latest wireshark version includes fixes for the following CVEs: CVE-2026-15163 CVE-2026-15164 CVE-2026-15165 CVE-2026-15166 CVE-2026-15167...

Oracle Linux 10 : php8.4 (ELSA-2026-22649)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-22649 advisory. 8.4.21-2 - rebase to 8.4.21 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus...

Fedora 43 : libtiff (2026-feac063d56)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-feac063d56 advisory. updated to 4.7.2, fixes security issues Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...

Amazon Linux 2023 : python3.13, python3.13-devel, python3.13-freethreading (ALAS2023-2026-1964)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1964 advisory. The tarfile module would still apply normalization of AREGTYPE \x00 blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPELONGNAME or GNUTYPELONGLINK. This could result ...

UBUNTU-CVE-2026-64020

In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix dmavecs leak on p2p memory We don't unmap P2P memory, so we don't need to track it. The dmavec allocation was getting leaked on the completion...

UBUNTU-CVE-2026-63978

In the Linux kernel, the following vulnerability has been resolved: net/handshake: Drain pending requests at net namespace exit The arguments to listspliceinit in handshakenetexit are reversed. The call moves the local empty "requests" list onto hn-hnrequests, leaving the local list empty, so the...