Linux Distros Unpatched Vulnerability : CVE-2026-90040

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped Wire up a gmeminvalidaterange call for SNP VMs, and use it to force vCPUs to...

Linux Distros Unpatched Vulnerability : CVE-2026-90824

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability has been found in GPAC 26.07.0. Affected is the function gfsgdomeventbubble of the file src/scenegraph/domevents.c of the component MP4Box. The...

Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / Pro Realtime 24.04 LTS : python-sql vulnerability (USN-8765-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / Pro Realtime 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8765-1 advisory. Cdric Krier discovered that python-sql incorrectly escaped values passed to unary operators. An...

Linux Distros Unpatched Vulnerability : CVE-2026-89890

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - media: go7007: defer the ALSA v4l2 put until card release go7007sndinit already takes a v4l2device reference for the ALSA side, but go7007sndremove drops it...

SUSE SLED15: clamav / clamav-devel / clamav-docs-html / clamav-milter / etc (SUSE-SU-2026:4180-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4180-1 advisory. - CVE-2026-20337: Improper boundary checks for content in zip archive parser bsc1274597. - CVE-2026-20338:...

Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS : Shibboleth vulnerability (USN-8768-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8768-1 advisory. Florian Stuhlmann discovered that Shibboleth incorrectly escaped input when using the ODBC storage plugin. A remote attacker could possibl...

Linux Distros Unpatched Vulnerability : CVE-2026-89818

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amdgpu/vcn: fix integer overflow in decmsg buffer count check If the supplied msg2 numbuffers is 0x3FFFFFFF, the expression 6 + numbuffers 4 wraps to 2 and...

Linux Distros Unpatched Vulnerability : CVE-2026-92058

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. CVE-2026-92058...

Linux Distros Unpatched Vulnerability : CVE-2026-89869

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - media: qcom: iris: use disableirq during power-off The IRQ is registered as a threaded IRQ. Using disableirqnosync in irisvpupoweroff does not wait for an alrea...

Linux Distros Unpatched Vulnerability : CVE-2026-89948

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - batman-adv: bla: fix freeing of claims on meshif deletion When the mesh interface is getting deleted, then batadvbladelbackboneclaims via batadvblapurgebackbone...

Linux Distros Unpatched Vulnerability : CVE-2026-89918

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: arm64: Correctly handle end of VA space TLBI invalidation Our TLB invalidation by VA code is based on comparing two ranges, one defined by the TLB, and one...

Linux Distros Unpatched Vulnerability : CVE-2026-89932

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: nVMX: Always flush vpid02 on first use Make sure vpid02 is always flushed on first use by setting lastvpid=0 when allocating vpid02...

Linux Distros Unpatched Vulnerability : CVE-2026-91090

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was determined in GPAC up to f1219cde. The affected element is the function gfnodeactivateex of the file scenegraph/basescenegraph.c. This...

Linux Distros Unpatched Vulnerability : CVE-2026-89973

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nvme-tcp: check the data direction of a C2HData PDU nvmetcphandlec2hdata finds the request by command id and checks that it has a payload, but it does not check...

Linux Distros Unpatched Vulnerability : CVE-2026-90019

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: gadget: fix null pointer dereference in usbputfunctioninstance usbputfunctioninstance attempts to dereference fd inside fi struct to get mod in uvcallocins...

Linux Distros Unpatched Vulnerability : CVE-2026-89957

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed The vfioapmdevhotunplugcfg function uses the return value of bitmapandnot to determi...

Mozilla Thunderbird < 140.16

The version of Thunderbird installed on the remote Windows host is prior to 140.16. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-95 advisory. - Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerabilit...

Linux Distros Unpatched Vulnerability : CVE-2026-89840

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - f2fs: validate MOVERANGE destination size F2FSIOCMOVERANGE checks the source range, but not the destination end before updating isize. A source hole can expose...

Linux Distros Unpatched Vulnerability : CVE-2026-89911

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: arm64: Correctly cap TLBI Range to the architural limit TLB Invalidation by Range has a fairly powerful way of encoding pretty large ranges in a small numb...

Linux Distros Unpatched Vulnerability : CVE-2026-89851

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scsi: qla2xxx: Fix FCE trace enable parsing in debugfs qla2x00dfsfcewrite called kstrtoul with a NULL result pointer, so a successful parse would dereference NU...

Linux Distros Unpatched Vulnerability : CVE-2026-89859

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak qla2x00dodportdiagnostics allocates the qladportdiag response buffer with kmallocobj non-zeroing...

Linux Distros Unpatched Vulnerability : CVE-2026-85501

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Novel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have been researched under the term 'ReTrap'. These result in degradation of service wh...

Linux Distros Unpatched Vulnerability : CVE-2026-19941

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An inapplicable NSEC record may be accepted by a named resolver as proof that no wildcard exists, which could allow an attacker at the same or an upstream level...

Linux Distros Unpatched Vulnerability : CVE-2026-82720

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NLnet Labs Unbound 1.12.0 up to and including 1.26.0 has a use-after-free vulnerability when compiled for DNS-over-HTTPs support with '--with-libnghttp2'. Durin...

Linux Distros Unpatched Vulnerability : CVE-2026-55244

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ASTEVAL is an evaluator of Python expressions and statements. Prior to 1.0.9, FROMPY in asteval/astutils.py exposes BaseException, SystemExit, KeyboardInterrupt...

Linux Distros Unpatched Vulnerability : CVE-2026-89871

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - media: video-i2c: fix kthread error pointer left in kthreadvidcap on failure kthreadrun returns an ERRPTR on failure, not NULL. When startstreaming fails,...

Linux Distros Unpatched Vulnerability : CVE-2026-62280

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Open Access Management OpenAM is an access management solution. From 13.0.0 until 16.1.2, the OAuth2 authorize endpoint's display=wap consent page reflects...

Linux Distros Unpatched Vulnerability : CVE-2026-89959

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - s390/vfio-ap: Fix control domain removal in vfioapmdevcfgremove The vfioapconfigremove function uses the bitmapandnot function to clear bits from the...

Linux Distros Unpatched Vulnerability : CVE-2026-89941

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iio: buffer: Make IIO DMA fence release RCU-safe The dmafence documentation states that if a custom release implementation is provided, the dmafence object must...

Linux Distros Unpatched Vulnerability : CVE-2026-77955

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD configured zones zonemd-check: yes which are located below but not at a trust...

Linux Distros Unpatched Vulnerability : CVE-2026-89875

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - media: ti: vpe: quiesce overflow recovery before freeing streams The VIP overflow recovery worker is armed from the hardirq handler when a FIFO overflow is...

Linux Distros Unpatched Vulnerability : CVE-2026-90017

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - staging: rtl8723bs: fix OOB read in rtwactionframeparse rtwactionframeparse takes a framelen parameter but never actually checks it before indexing into the...

TencentOS Server 4: samba (TSSA-2026:1007)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1007 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

GitLab 15.3 < 19.1.8 / 19.2 < 19.2.6 / 19.3 < 19.3.2 (CVE-2026-78252)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an authenticated user could ha...

Linux Distros Unpatched Vulnerability : CVE-2026-92037

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect boundary conditions in the DOM: Animation component. This vulnerability was fixed in Firefox 156 and Thunderbird 156. CVE-2026-92037 Note that Nessus...

Linux Distros Unpatched Vulnerability : CVE-2026-90006

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - samples/damon/mtier: handle damonstop failure damonsamplemtierstop assumes its damonstop call will always successfully stops the two DAMON contexts. Hence it...

Linux Distros Unpatched Vulnerability : CVE-2026-89884

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - media: platform: mtk-mdp3: fix NULL deref on failed SCP lookup Add the missing sanity check after looking up the SCP to avoid dereferencing a NULL-pointer in ca...

Linux Distros Unpatched Vulnerability : CVE-2026-89874

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - media: v4l2-async: avoid deleting unlinked ASC entry on link error v4l2asyncmatchnotify creates ancillary media links before adding asc-ascsubdeventry to...

Linux Distros Unpatched Vulnerability : CVE-2026-92053

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Privilege escalation in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird...

Linux Distros Unpatched Vulnerability : CVE-2026-62379

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Open Access Management OpenAM is an access management solution. Prior to 16.1.2, the pre-authentication /authservice PLL endpoint accepts a CustomCallback XML...

Linux Distros Unpatched Vulnerability : CVE-2026-89952

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mtd: rawnand: validate ONFI extended parameter page sections nandflashdetectextparampage allocates the length declared by the ONFI parameter page, then treats t...

Fedora 43 : python-configargparse (2026-2e605e01a6)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-2e605e01a6 advisory. Update to 1.7.7. Version 1.7.6 is a security fix for GHSA-6m27-337c-jcgf. Config file or environment variable can trigger writing out a config file,...

RHEL 10 / 9 : Red Hat Edge Manager Version 1.1.4 Security Update (Important) (RHSA-2026:68334)

The remote Redhat Enterprise Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:68334 advisory. Red Hat Edge Manager RHEM provides simple, scalable, and security-focused management of edge devices and applications. It supports...

openSUSE 16 Security Update : trivy (openSUSE-SU-2026:21835-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21835-1 advisory. - CVE-2026-53495: containerd: CRI ExecSync goroutine leak can lead to node-level denial of service bsc1280111. - CVE-2026-56854:...

openSUSE 16 Security Update : hauler (openSUSE-SU-2026:21841-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21841-1 advisory. Changes in hauler: - update vendor.tar to fix: bsc1278584, CVE-2026-56855,CVE-2026-56854,CVE-2026-78662: hauler: golang.org/x/crypto/ssh:...

Linux Distros Unpatched Vulnerability : CVE-2026-84635

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27,...

MiracleLinux 8 : osbuild-composer-101.5-3.el8_10.ML.1 (AXSA:2026-1846:11)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1846:11 advisory. crypto/internal/nistec: golang: Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec CVE-2025-22866 crypto/x509: golang: Go crypto/x509...

Linux Distros Unpatched Vulnerability : CVE-2026-82717

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap memory and under certain systems and...

SUSE SLES12 Security Update : google-cloud-sap-agent (SUSE-SU-2026:4178-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4178-1 advisory. Security issues fixed: - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input bsc1272128....

Linux Distros Unpatched Vulnerability : CVE-2026-81634

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap buffer overflow during the RRSet...