openSUSE 16 Security Update : hauler (openSUSE-SU-2026:21841-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21841-1 advisory. Changes in hauler: - update vendor.tar to fix: bsc1278584, CVE-2026-56855,CVE-2026-56854,CVE-2026-78662: hauler: golang.org/x/crypto/ssh:...

Fedora 43 : python-configargparse (2026-2e605e01a6)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-2e605e01a6 advisory. Update to 1.7.7. Version 1.7.6 is a security fix for GHSA-6m27-337c-jcgf. Config file or environment variable can trigger writing out a config file,...

MiracleLinux 8 : osbuild-composer-101.5-3.el8_10.ML.1 (AXSA:2026-1846:11)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1846:11 advisory. crypto/internal/nistec: golang: Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec CVE-2025-22866 crypto/x509: golang: Go crypto/x509...

Debian dsa-6500 : tor - security update

The remote Debian 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6500 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6500-1 [email protected] https://www.debian.org/security/ Moritz...

Linux Distros Unpatched Vulnerability : CVE-2026-89794

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ksmbd: zero pipe read compound padding Compound response handling extends the last response iov to an eight-byte boundary. smb2readpipe allocates only the paylo...

SUSE SLES15 Security Update : perl-Mojolicious (SUSE-SU-2026:4151-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2026:4151-1 advisory. This update for perl-Mojolicious fixes the following issue: - CVE-2026-15747: exposing a stable representation of the session CSRF token to a BREACH...

Linux Distros Unpatched Vulnerability : CVE-2026-90039

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NFSD: Guard admin state-revocation walks with NFSDNETUP Writing to /proc/fs/nfsd/unlockfilesystem, or sending the NFSDCMDUNLOCKFILESYSTEM or NFSDCMDUNLOCKEXPORT...

Oracle Linux 8 : ELSA-2026-67315-0: / nginx:1.24 (ELSA-2026-673150)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-673150 advisory. - Resolves: RHEL-212457 - nginx:1.24/nginx: NGINX: Arbitrary code execution via crafted HTTP requests CVE-2026-42533 - Resolves: RHEL-217957 - nginx:1.24/ngin...

Linux Distros Unpatched Vulnerability : CVE-2026-90016

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - staging: rtl8723bs: fix OOB read in rtwrestructwmmie rtwrestructwmmie scans inie for a WMM IE with: while i inlen ... if i + 5 inlen && iniei == 0xDD &&...

Linux Distros Unpatched Vulnerability : CVE-2026-89895

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - media: cobalt: Avoid freeing ALSA private data twice sndcobaltcardcreate stores cobsc in sc-privatedata and installs sndcobaltcardprivatefree as sc-privatefree...

SUSE SLES15: strongswan / strongswan-doc / strongswan-hmac / strongswan-ipsec / etc (SUSE-SU-2026:4146-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4146-1 advisory. - CVE-2026-78123: Undefined Memory Access When Handling PKCS7 Containers bsc1276533. - CVE-2026-78124: Memory Leak When Processing...

Linux Distros Unpatched Vulnerability : CVE-2026-89803

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/nouveau: unsubscribe the channel-kill event before the fence context nouveauchanneldel tears the fence context down first and only drops the channel-kill...

Linux Distros Unpatched Vulnerability : CVE-2026-89891

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - media: em28xx: fix use-after-free of devnext-devlist on disconnect When a device with hasdualts=1 is probed and the isaudioonly path is taken, both dev and...

Linux Distros Unpatched Vulnerability : CVE-2026-89983

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - i2c: core: fix debugfs UAF on adapter removal i2cdeladapter frees the adapter's debugfs directory before it unregisters the adapter device, but the newdevice...

Oracle Linux 9 : ELSA-2026-67308-0: / nginx:1.24 (ELSA-2026-673080)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-673080 advisory. - Resolves: RHEL-212508 - nginx:1.24/nginx: NGINX: Arbitrary code execution via crafted HTTP requests CVE-2026-42533 - Resolves: RHEL-219310 - nginx: NGINX:...

Linux Distros Unpatched Vulnerability : CVE-2026-89990

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ceph: lock mutex in cephmdscheckaccess MDS session OPEN handling replaces mdsc-scapauths under mdsc-mutex, freeing the previous array and its strings...

Linux Distros Unpatched Vulnerability : CVE-2026-44202

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the /sessionservice addSessionListener operation allows an authenticated user t...

Linux Distros Unpatched Vulnerability : CVE-2026-89938

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iio: chemical: atlas-sensor: use iiotriggerpollnested to fix remove UAF The atlas driver requests its hardware data-ready IRQ with devmrequestthreadedirq...

Linux Distros Unpatched Vulnerability : CVE-2026-92239

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A maliciously constructed IMAP line could cause an out-of-bounds buffer read. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbi...

Linux Distros Unpatched Vulnerability : CVE-2026-89960

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - s390/vfio-ap: fix stale pqaphook pointer on error in vfioapmdevsetkvm In vfioapmdevsetkvm, kvm-arch.crypto.pqaphook is set to &matrixmdev-pqaphook before the...

Linux Distros Unpatched Vulnerability : CVE-2026-81642

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in the DNSSEC validator that enables denial of service and possible remote code...

SUSE SLES15 Security Update : libpcap (SUSE-SU-2026:4195-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4195-1 advisory. - CVE-2026-0799: the BPF interpreter does not validate values in BPF instructions that load/store a value from/to a scratch memory...

Linux Distros Unpatched Vulnerability : CVE-2026-89819

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amd/display: validate plane degamma LUT size for private color prop Unlike the CRTC degamma path, which is guarded by amdgpudmverifylutsizes, the per-plane...

Linux Distros Unpatched Vulnerability : CVE-2026-89800

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/nouveau/uvmm: clear the dirty flag when unwinding an OPUNMAPSPARSE A successful OPUNMAPSPARSE marks its region dirty with nouveauuvmaregiondirty and defers...

Linux Distros Unpatched Vulnerability : CVE-2026-63127

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.0.0, the rmcp crate's OAuth implementation in crates/rmcp/src/transport/auth.rs omits th...

Linux Distros Unpatched Vulnerability : CVE-2026-89935

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iio: light: apds9306: fix PM reference leak in apds9306readdata apds9306readdata calls pmruntimeresumeandget but several error paths return directly without...

Linux Distros Unpatched Vulnerability : CVE-2026-90025

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: typec: ucsi: displayport: Fix OOB altmode array index The UCSI displayport driver indexes the connector's port altmode array with the GETCURRENTCAM respons...

Ubuntu 24.04 LTS / 26.04 LTS : kitty vulnerabilities (USN-8763-1)

The remote Ubuntu 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8763-1 advisory. It was discovered that kitty incorrectly escaped error messages when handling specially crafted terminal escape sequences. A remote attacker...

Linux Distros Unpatched Vulnerability : CVE-2026-92062

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Privilege escalation in the Session Restore component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3...

Fedora 44 : roundcubemail (2026-38c637be37)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-38c637be37 advisory. Release 1.7.4 - Use X-Content-Type-Options:nosniff for attachment previews and downloads 10308 - zipdownload: Fix attachment filename sanitisation of backsla...

Linux Distros Unpatched Vulnerability : CVE-2026-89844

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scsi: qla2xxx: Hold vportslock for host map update in report ID acquisition qla24xxreportidacquisition format-1 handling drops vportslock after taking the vport...

Linux Distros Unpatched Vulnerability : CVE-2026-92240

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an untagged ' ID' response, crashing Thunderbird...

Slackware Linux 15.0 / current mozilla-thunderbird Multiple Vulnerabilities (SSA:2026-259-02)

The version of mozilla-thunderbird installed on the remote host is prior to 140.16.0esr / 153.3.0esr. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2026-259-02 advisory. New mozilla-thunderbird packages are available for Slackware 15.0 and -current to fix securit...

Linux Distros Unpatched Vulnerability : CVE-2026-89868

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - media: chips-media: wave5: Add timeout while stopstreaming When stopstreaming is called, an infinite loop may occur in some cases. Add a bounded poll of the que...

RHEL 9 : tesseract (RHSA-2026:67831)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:67831 advisory. A commercial quality OCR engine originally developed at HP between 1985 and 1995. In 1995, this engine was among the top 3 evaluated by UNLV. It was...

Linux Distros Unpatched Vulnerability : CVE-2026-89925

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: s390: Fix memory leak in guest debug handling bpdata is freed only for the error case by kfreebpdata. Every successful KVMSETGUESTDEBUG will leak bpdata...

Linux Distros Unpatched Vulnerability : CVE-2026-90003

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - futex: Prevent rcuwait use-after-free during requeue PI On PREEMPTRT, FUTEXCMPREQUEUEPI can trigger a KASAN report slab-out-of-bounds in futexrequeuepicomplete...

Linux Distros Unpatched Vulnerability : CVE-2026-89872

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - media: v4l2-fwnode: Fix fwnode leak in v4l2fwnodeparselink In v4l2fwnodeparselink, the remote endpoint fwnode reference is acquired using...

Linux Distros Unpatched Vulnerability : CVE-2026-90027

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: typec: qcom-pmic-typec: disable ccdebouncedwork on stop ccdebouncedwork is queued from the setcc and starttoggling callbacks, which run from TCPM's kthread...

Linux Distros Unpatched Vulnerability : CVE-2026-89999

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HID: wacom: validate report length in wacomintuospro2btirq wacomintuospro2btirq receives the wire report length in len but never consults it before parsing...

Linux Distros Unpatched Vulnerability : CVE-2026-89847

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scsi: qla2xxx: Avoid double completion in async IOCB timeout qla2x00asynciocbtimeout tries to abort a timed-out async IOCB. When qla24xxasyncabortcmd fails, bo...

Linux Distros Unpatched Vulnerability : CVE-2026-89937

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iio: chemical: sgp30: Handle IAQ thread creation failure kthreadrun can fail and return an error pointer, but sgpprobe stores it and returns success, so the...

Linux Distros Unpatched Vulnerability : CVE-2026-89929

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU When emulating INVVPID, KVM executes INVVPID on the physical CPU using vpid02 instead of the L1...

Linux Distros Unpatched Vulnerability : CVE-2026-89838

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - f2fs: limit recovery filename logging to stored length F2FS stores recovery filenames as a length plus a fixed-size iname buffer. The buffer is not...

SUSE SLES15: strongswan / strongswan-doc / strongswan-hmac / strongswan-ipsec / etc (SUSE-SU-2026:4152-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4152-1 advisory. - CVE-2026-78123: Undefined Memory Access When Handling PKCS7 Containers bsc1276533. - CVE-2026-78124: Memory Leak When Processing...

Linux Distros Unpatched Vulnerability : CVE-2026-92076

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153....

Linux Distros Unpatched Vulnerability : CVE-2026-77692

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An attacker can cause named to abort by sending a crafted DNS-over-HTTPS request with a cryptographically invalid SIG0 record, and then closing the transport...

Linux Distros Unpatched Vulnerability : CVE-2026-89946

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ASoC: cs35l33: drain threaded IRQ before runtime suspend cs35l33runtimesuspend currently switches the codec into regcachecacheonlytrue and powers it down withou...

Linux Distros Unpatched Vulnerability : CVE-2026-46623

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the OAuth2 authentication module updates an existing local account with profile...

Linux Distros Unpatched Vulnerability : CVE-2026-89978

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - accel/amdxdna: return early from a zero-length flush SYNCBO does not constrain its size, so a request for zero bytes reaches drmclflushvirtrange, which ends wit...