openSUSE 16 Security Update : spice-vdagent (openSUSE-SU-2026:21506-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21506-1 advisory. - CVE-2026-57965: integer overflow in udscswrite allows a compromised SPICE host to crash the spice- vdagent daemon via a specially crafted...

openSUSE 16: WebKitGTK-4.0-lang / WebKitGTK-4.1-lang / WebKitGTK-6.0-lang / etc (openSUSE-SU-2026:21508-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21508-1 advisory. - CVE-2024-4367: missing type check when handling fonts in PDF.js can allow arbitrary JavaScript execution bsc1271638. - CVE-2026-39872:...

FreeBSD : Weechat -- Multiple vulnerabilities (12d42997-8e54-11f1-8144-8447094a420f)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 12d42997-8e54-11f1-8144-8447094a420f advisory. The Weechat project reports: Tenable has extracted the preceding description block directly fr...

Hanwha Vision Cameras Improper Input Validation (CVE-2024-54011)

Penetration Testing engineers at Amazon have discovered a flaw where the camera system fails to properly handle data supplied in certain requests, causing a service disruption. The manufacturer has released patch firmware for the flaw, please refer to the manufacturer's report for details and...

openSUSE 16 Security Update : chromium (openSUSE-SU-2026:21514-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21514-1 advisory. Changes in chromium: - Chromium 151.0.7922.71 boo1272936: CVE-2026-17650: Use after free in Compositing CVE-2026-17651: Insufficient validation ...

Konica Bizhub Multifunction Printers Insufficiently Protected Credentials (CVE-2022-29588)

Konica Minolta bizhub MFP devices before 2022-04-14 use cleartext password storage for the /var/log/nginx/html/ADMINPASS and /etc/shadow files. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc...

GeoVision GV-LPC2011 and GV-LPC2211 Cross-site Scripting (CVE-2026-42366)

Multiple reflected cross-site scripting xss vulnerabilities exist in the Web Interface / ssi.cgi functionality of GeoVision LPC2011/LPC2211 1.10. A specially crafted malicious url can lead to an arbitrary javascript code execution. An attacker can provide a crafted URL to trigger this...

GeoVision GV-LPC2011 and GV-LPC2211 Predictable from Observable State (CVE-2026-42365)

A guessable session cookie vulnerability exists in the Web Interface functionality of GeoVision LPC2011/LPC2211 1.10. A specially crafted series of HTTP requests can lead to an authentication bypas. An attacker can bruteforce session cookies to trigger this vulnerability. This plugin only works...

Mitsubishi Electric MELSEC iQ-F Series FX5-EIP EtherNet/IP Module and FX5-ENET/IP Ethernet Module Always-Incorrect Control Flow Implementation (CVE-2026-1874)

Always-Incorrect Control Flow Implementation vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series FX5-ENET/IP Ethernet Module FX5-ENET/IP versions 1.106 and prior and Mitsubishi Electric Corporation MELSEC iQ-F Series FX5-EIP EtherNet/IP Module FX5-EIP versions 1.000 and prior allo...

openSUSE 16: warewulf4 / warewulf4-dracut / warewulf4-man / warewulf4-overlay / etc (openSUSE-SU-2026:21509-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21509-1 advisory. Changes in warewulf4: - updated golang.org/x/text to v0.40.0 to fix CVE-2026-56852 bsc1272014 Tenable has extracted the preceding description block...

GeoVision GV-LPC2011 and GV-LPC2211 Cross-site Scripting (CVE-2026-7371)

Multiple reflected cross-site scripting xss vulnerabilities exist in the Web Interface / ssi.cgi functionality of GeoVision LPC2011/LPC2211 1.10. A specially crafted malicious url can lead to an arbitrary javascript code execution. An attacker can provide a crafted URL to trigger this...

Hanwha Vision Cameras OS Command Injection (CVE-2024-54012)

Penetration Testing engineers at Amazon discovered a vulnerability where the camera system failed to properly validate input, allowing specially crafted requests containing malicious commands to be executed on the device. The manufacturer has released patch firmware for the flaw; please refer to...

Cisco Small Business SPA500 Series IP Phones Local Code Execution (CVE-2019-15959)

A vulnerability in Cisco Small Business SPA500 Series IP Phones could allow a physically proximate attacker to execute arbitrary commands on the device. The vulnerability is due to the presence of development testing and verification scripts that remained on the device. An attacker could exploit...

openSUSE 16 Security Update : python-joserfc (openSUSE-SU-2026:21515-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21515-1 advisory. Changes in python-joserfc: - CVE-2026-62995: acceptance of JWTs with trailing padding can lead to JWT malleability and allows for bypass of token...

Lexmark Printers Improper Input Validation (CVE-2013-6032)

cgi-bin/postpf/cgi-bin/dynamic/config/config.html on Lexmark X94x before LC.BR.P142, X85x through LC4.BE.P487, X644 and X646 before LC2.MC.P374, X642 through LC2.MB.P318, W840 through LS.HA.P252, T64x before LS.ST.P344, X64xef through LC2.TI.P325, C935dn through LC.JO.P091, C920 through LS.TA.P15...

openSUSE 16 Security Update : perl-Date-Manip (openSUSE-SU-2026:21510-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21510-1 advisory. Changes in perl-Date-Manip: - CVE-2026-60074: corrupted dates returned when processing non-ASCII decimal digits that pass the numeric range test...

openSUSE 16: libipa_hbac-devel / libipa_hbac0 / libnfsidmap-sss / etc (openSUSE-SU-2026:21507-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21507-1 advisory. This update for sssd fixes the following issue: - CVE-2026-12610: cancelled or completed PAM request while the asynchronous child process is still runni...

GeoVision GV-LPC2011 and GV-LPC2211 Improper Neutralization of Special Elements used in an OS Command (CVE-2026-42364)

An os command injection vulnerability exists in the DdnsSetting.cgi functionality of GeoVision LPC2011/LPC2211 1.10. A specially crafted DDNS configuration can lead to arbitrary command execution. An attacker can modify a configuration value to trigger this vulnerability. This plugin only works...

Hanwha Vision Cameras Missing Authentication for Critical Function (CVE-2024-54013)

Penetration Testing engineers at Amazon have identified a security flaw related to request handling in the web server component that could, under certain conditions, lead to unintended access to protected functions. The manufacturer has released patch firmware for the flaw, please refer to the...

Lexmark Printers Cross-site Scripting (CVE-2013-6033)

Multiple cross-site scripting XSS vulnerabilities on Lexmark W840 through LS.HA.P252, T64x before LS.ST.P344, C935dn through LC.JO.P091, C920 through LS.TA.P152, C53x through LS.SW.P069, C52x through LS.FA.P150, E450 through LM.SZ.P124, E350 through LE.PH.P129, and E250 through LE.PM.P126 printer...

AlmaLinux 8 : fence-agents (ALSA-2026:47736)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:47736 advisory. httplib2: httplib2: Denial of Service via unbounded decompression of HTTP response bodies CVE-2026-59939 Tenable has extracted the preceding description block...

RockyLinux 9 : kernel (RLSA-2026:49212)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:49212 advisory. kernel: ipc: limit nextid allocation to the valid ID range CVE-2026-52923 kernel: tipc: fix double-free in tipcbufappend CVE-2026-52993 kernel: net:...

Fedora 43 : postgresql16 (2026-821de6e6a6)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-821de6e6a6 advisory. Automatic update for postgresql16-16.14-1.fc43. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...

Fedora 43 : exim (2026-d6839a7c95)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-d6839a7c95 advisory. This is new version fixing command execution with alternate privilege. Tenable has extracted the preceding description block directly from the Fedora securit...

AlmaLinux 8 : perl:5.32 (ALSA-2026:48225)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:48225 advisory. perl-Archive-Tar: perl-Archive-Tar: Denial of Service via crafted tar header with large entry size CVE-2026-9538 Tenable has extracted the preceding description...

Fedora 44 : curl (2026-e691fbbfe7)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-e691fbbfe7 advisory. - Fix trailing dot domain super cookie CVE-2026-8924 - Fix SSH improper host validation CVE-2026-9547 - Fix password leak with netrc and user in URL...

Fedora 44 : gh (2026-4e77362489)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-4e77362489 advisory. Update to 2.97.0 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested f...

Fedora 43 : libgit2 / rust-libgit2-sys (2026-61dffcfbe9)

The remote Fedora 43 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-61dffcfbe9 advisory. - Update libgit2 to version 1.9.6. - Update the libgit2-sys Rust crate to the corresponding version 0.18.7. This includes fixes for various security...

AlmaLinux 8 : unbound (ALSA-2026:37282)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:37282 advisory. unbound: Unbound: Denial of Service via excessive EDNS options CVE-2026-41292 unbound: Unbound: Cache manipulation via 'ghost domain names' attack...

Linux Distros Unpatched Vulnerability : CVE-2026-67321

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - axios before 0.33.0 contains an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in ''. Attackers who control...

Linux Distros Unpatched Vulnerability : CVE-2026-67300

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.29.0 contains client-side heap use-after-free vulnerabilities in the async update message proxy for RAIL WINDOWSTATEORDER and...

AlmaLinux 8 : osbuild-composer (ALSA-2026:48790)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:48790 advisory. google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation CVE-2026-33186...

Linux Distros Unpatched Vulnerability : CVE-2026-9335

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability in keras-team/keras versions = 3.14.0 allows arbitrary local HDF5 file content disclosure due to improper handling of HDF5 ExternalLinks. The...

Linux Distros Unpatched Vulnerability : CVE-2026-66402

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.29.0 affected versions = 3.28.0 contains multiple TLS certificate identity validation weaknesses in tlsverifycertificate, tlsmatchhostname, and...

Fedora 44 : lemonldap-ng (2026-f9b48b47af)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-f9b48b47af advisory. Update to 2.23.2 ---- Update to 2.23.1, fixes CVE-2026-12804 Tenable has extracted the preceding description block directly from the Fedora security...

AlmaLinux 8 : .NET 10.0 (ALSA-2026:41900)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:41900 advisory. dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM CVE-2026-50651 dotnet: .NET Core: Denial of Service via type...

AlmaLinux 10 : kernel (ALSA-2026:47017)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:47017 advisory. kernel: net: bridge: use a stable FDB dst snapshot in RCU readers CVE-2026-46086 kernel: ipv6: fix possible UAF in icmpv6rcv CVE-2026-53006 kernel: tipc...

Linux Distros Unpatched Vulnerability : CVE-2026-67302

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.29.0 affected versions = 3.28.0 contains a divide-by-zero vulnerability in the rdpecam camera redirection client...

Linux Distros Unpatched Vulnerability : CVE-2026-67317

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStream request bodies in the fetch adapter when Content-Length cannot be...

Linux Distros Unpatched Vulnerability : CVE-2026-67354

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - guzzlehttp/guzzle versions before 7.15.1 contain an information disclosure vulnerability in RedirectMiddleware. When the optional allowredirects.referer setting...

Linux Distros Unpatched Vulnerability : CVE-2026-67301

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.29.0 contains out-of-bounds read vulnerabilities in the async update message proxy for the PolygonSC and PolygonCB primary drawing orders. When...

AlmaLinux 8 : .NET 9.0 (ALSA-2026:41899)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:41899 advisory. dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM CVE-2026-50651 dotnet: .NET Core: Denial of Service via type...

Linux Distros Unpatched Vulnerability : CVE-2026-67320

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios hardens merged request configuration by...

Linux Distros Unpatched Vulnerability : CVE-2026-67290

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.29.0 contains a heap out-of-bounds read vulnerability in the TSMF FFmpeg decoder when parsing AVC1 MPEG2VIDEOINFO media types with insufficient...

Linux Distros Unpatched Vulnerability : CVE-2026-67313

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments...

Linux Distros Unpatched Vulnerability : CVE-2026-67303

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.29.0 contains a reachable assertion WINPRASSERTOutputBufferLength == BytesReturned in serialprocessirpdevicecontrol in...

Linux Distros Unpatched Vulnerability : CVE-2026-67355

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - guzzlehttp/guzzle versions before 7.15.1 fail to preserve host-only cookie scope, storing the request host in the Domain field instead of marking cookies as...

Linux Distros Unpatched Vulnerability : CVE-2026-67338

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata...

Linux Distros Unpatched Vulnerability : CVE-2026-67293

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.29.0 affected versions = 3.28.0 contains an improper certificate hostname validation vulnerability. The TLS hostname matcher tlsmatchhostname i...

Fedora 43 : GitPython (2026-7dfa949ea9)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-7dfa949ea9 advisory. Update to 3.1.55: Fixes GHSA-2f96-g7mh-g2hx, GHSA-v396-v7q4-x2qj, GHSA-956x-8gvw-wg5v, GHSA-rwj8-pgh3-r573, GHSA-3rp5-jjmw-4wv2, GHSA-r9mr-m37c-5fr3,...