XZ Utils 5.6.1 Backdoor Detection

XZ Utils versions 5.6.0 and 5.6.1 contain the backdoor tracked as CVE-2024-3094. This Bash tool checks XZ/LZMA versions, sshd linkage, and known liblzma byte patterns for possible exposure...

RHEL 9 : rsyslog (RHSA-2026:86124)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:86124 advisory. The rsyslog packages provide an enhanced, multi-threaded syslog daemon. It supports MySQL, syslog/TCP, RFC 3195, permitted sender lists,...

FreeRDP BMP Recording Heap Buffer Overflow DoS

The vulnerability of the clipboardsynthesizeimageformattobmp function in the FreeRDP BMP recording module is related to integer overflow. Exploiting this vulnerability could allow an attacker to cause a service failure...

SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:4595-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4595-1 advisory. The SUSE Linux Enterprise 15 SP5 kernel was updated to fix various security issues: The following security issues were fixed: -...

RHEL 9 : kpatch-patch-5_14_0-687_10_1 and kpatch-patch-5_14_0-687_42_1 (RHSA-2026:81452)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:81452 advisory. This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the code of a running kernel. This patc...

AlmaLinux 9 : postgresql:18 (ALSA-2026:85814)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:85814 advisory. pgvector: pgvector: Arbitrary code execution via out-of-bounds write during IVFFlat index build CVE-2026-103484 Tenable has extracted the preceding description...

PT-2026-120173

FreeRDP from 2.0.0 before 3.32.0 contains an improper certificate validation vulnerability in its proxy that accepts untrusted target TLS certificates when no verification module is configured. Network-positioned attackers can intercept the proxy's outbound connection and present a self-signed,...

PT-2026-120801

Name of the Vulnerable Software and Affected Versions Jupyter Server versions 2.0.0 through 2.6.0 Description An authorization bypass exists when GatewayClient.url is enabled, causing the KernelWebsocketHandler to be replaced by WebSocketChannelsHandler. While this handler authenticates the user,...

Linux Distros Unpatched Vulnerability : CVE-2026-96888

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A BIND resolver that is configured with both a redirect zone and qname-minimization strict may abort with an assertion failure while processing the redirect. Th...

Linux Distros Unpatched Vulnerability : CVE-2026-97313

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A recursive BIND server that receives a query with recursion desired RD=1 followed by a non-recursive query RD=0 may exit with an assertion failure, resulting i...

PT-2026-120578

ZenTao PMS before 22.3 contains an authorization bypass vulnerability in commonModel::isOpenMethod that lets logged-in users skip group-based ACL checks for any method containing 'ajax'. Minimal-privilege users can call methods like task.ajaxGetByID, system.ajaxDBAuthUrl and...

SUSE SLED15 / SLES15 Security Update : emacs (SUSE-SU-2026:4594-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4594-1 advisory. This update for emacs fixes the following issue: - CVE-2026-96442: arbitrary code execution when viewing or editing...

RHEL 9 : ruby:3.3 (RHSA-2026:86208)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:86208 advisory. Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management task...

Linux Distros Unpatched Vulnerability : CVE-2026-109249

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP 3.0.0 before 3.32.0 contains a heap out-of-bounds read in freerdpassistanceparseallelementsof because it advances its parsing cursor without reducing th...

Atlassian Confluence 9.1.x < 9.2.26 / 9.3.x < 10.2.19 / 11.0.0 (CONFSERVER-104515)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-104515 advisory. - The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength when decoding JSON object property...

Linux Distros Unpatched Vulnerability : CVE-2026-109679

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP 3.0.0-beta4 before 3.32.0 contains a NULL pointer dereference in armhandlerequestok when an ARM endpoint returns an empty HTTP 200 body. Attackers...

Linux Distros Unpatched Vulnerability : CVE-2026-109248

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP 3.0.0 before 3.32.0 contains a heap out-of-bounds read in the WinPR clipboard function convertfiledescriptorstofilelist, which scans a server-controlled...

Oracle HTTP Server 14c (October 2026 CPU)

The version of Oracle HTTP Server installed on the remote host is affected by multiple vulnerabilities as referenced in the October 2026 CPU advisory. - Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware component: OSSL Module. Supported versions that are affected are...

Linux Distros Unpatched Vulnerability : CVE-2026-109241

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the client video redirection channel that allows malicious servers to crash clients b...

Amazon Linux 2023 : bind, bind-chroot, bind-devel (ALAS2023-2026-3221)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3221 advisory. Amazon Linuxvended DNS resolvers shipped with an older DNSSEC root signing key. For hosts configured with DNSSEC validation enabled, this could result in DNS resolution failures, including for names in...