Linux Distros Unpatched Vulnerability : CVE-2026-72018

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - dibs: loopback: validate offset and size in movedata The loopback movedata performs a memcpy into the registered DMB without checking whether offset + size...

Linux Distros Unpatched Vulnerability : CVE-2026-74266

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/sched: schdualpi2: Do not call qdisctreereducebacklog during peek before restoring qlen Whenever dualpi2 drops packets during peek, it calls...

Linux Distros Unpatched Vulnerability : CVE-2026-74393

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/syncobj: Fix memory leak in drmsyncobjfindfence Commit 18226ba52159 drm/syncobj: reject invalid flags in drmsyncobjfindfence forgot to take into account the...

Zoom Workplace VDI Client < 7.0.11 Vulnerability (ZSB-26016)

The version of Zoom Workplace VDI Client installed on the remote host is prior to 7.0.11. It is, therefore, affected by a vulnerability as referenced in the ZSB-26016 advisory. - Missing bounds check in the annotator function of Zoom Clients allows buffer over-read, which may allow a meeting...

Linux Distros Unpatched Vulnerability : CVE-2026-72036

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/sched: schmultiq: Replace direct dequeue call with peek and qdiscdequeuepeeked multiqdequeue takes a packet from a band's child with a direct -dequeue call...

MiracleLinux 8 : osbuild-composer-101.5-1.el8_10.ML.1 (AXSA:2026-1558:08)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1558:08 advisory. google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation CVE-2026-33186...

Linux Distros Unpatched Vulnerability : CVE-2026-72145

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: platform/x86/intel/tpmi: use cleanup helpers in memwrite In memwrite, the temporary array...

Linux Distros Unpatched Vulnerability : CVE-2026-72050

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - octeontx2-af: Free BPID bitmap on setup failure nixsetupbpids allocates bp-bpids with rvuallocbitmap, which uses a plain kcalloc. If any of the following...

AlmaLinux 9 : kernel (ALSA-2026:54443)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:54443 advisory. kernel: accel/ivpu: Fix signed integer truncation in IPC receive CVE-2026-53202 kernel: net/sched: actapi: use RCU with deferred freeing for action...

Linux Distros Unpatched Vulnerability : CVE-2026-72371

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - afs: Fix the volume AFSVOLUMERMTREE is set on Fix afsinsertvolumeintocell to set AFSVOLUMERMTREE on the volume replaced, not the new volume, as it's now removed...

Amazon Linux 2 : qemu, --advisory ALAS2-2026-3866 (ALAS-2026-3866)

The version of qemu installed on the remote host is prior to 3.1.0-8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3866 advisory. In QEMU's VNC server implementation ui/vnc.c, the setpixelformat function does not properly validate the redmax, greenmax, an...

RHEL 9 : gstreamer1-plugins-bad-free and gstreamer1-plugins-ugly-free (RHSA-2026:55865)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:55865 advisory. GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package...

Amazon Linux 2 : firefox, --advisory ALAS2FIREFOX-2026-063 (ALASFIREFOX-2026-063)

The version of firefox installed on the remote host is prior to 140.13.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2FIREFOX-2026-063 advisory. Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox...

MiracleLinux 8 : firefox-140.13.0-1.el8_10.ML.1 (AXSA:2026-1560:19)

The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-1560:19 advisory. libaom: libaom: heap buffer overflow in AV1 encoder first-pass stats buffer via LAP mode CVE-2026-56208 firefox: thunderbird: Site isolation issue i...

Mozilla Firefox < 154.0

The version of Firefox installed on the remote Windows host is prior to 154.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-74 advisory. - Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14,...

Linux Distros Unpatched Vulnerability : CVE-2026-53524

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - WeeChat Wee Enhanced Environment for Chat is a free chat client. In versions 4.3.0 through 4.9.0, the WeeChat relay module's WebSocket permessage-deflate...

Photon OS 5.0: Linux PHSA-2026-5.0-91-0837

An update of the linux package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-91-0837. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

RHEL 9 : haproxy (RHSA-2026:55772)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:55772 advisory. The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications. Security Fixes: haprox...

RockyLinux 8 : unbound (RLSA-2026:55784)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:55784 advisory. unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes CVE-2026-44690 Tenable has extracted the preceding...

Linux Distros Unpatched Vulnerability : CVE-2026-72460

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - apparmor: check label build before nonewprivs test aachangeprofile builds a replacement label with fnlabelbuildinscope before the nonewprivs subset check. The...

AlmaLinux 10 : nodejs22 (ALSA-2026:55541)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:55541 advisory. brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand function CVE-2026-14257 brace-expansion: brace-expansion: Denial of...

Linux Distros Unpatched Vulnerability : CVE-2026-72175

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fs/proc/taskmmu: fix makeuffdwphugepte prot-update race Patch series userfaultfd/pagemap: pre- existing fixes. These are pre-existing bug fixes that were carrie...

Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-2045)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2045 advisory. In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix race condition during PASID entry replacement CVE-2026-45945 In the Linux kernel, the following vulnerabilit...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102130)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102130 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/amd/pp: Fix potential NULL pointer dereference in atomctrlinitializemcregtable The function...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102129)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102129 advisory. In the Linux kernel, the following vulnerability has been resolved: xfrm: clear trailing padding in buildpolexpire buildexpire clears the trailing padding bytes of...

RockyLinux 9 : unbound (RLSA-2026:55841)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:55841 advisory. unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes CVE-2026-44690 unbound: Unbound: Denial of Service...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102006)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102006 advisory. In the Linux kernel, the following vulnerability has been resolved: smb/client: fix chown/chgrp with SMB3 POSIX Extensions Ownership chown and group chgrp...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102122)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102122 advisory. In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix out-of-bounds read in sndusbgetaudioformatuac3 In sndusbgetaudioformatuac3,...

RHEL 9 : kpatch-patch-5_14_0-284_117_1, kpatch-patch-5_14_0-284_134_1, kpatch-patch-5_14_0-284_148_1, kpatch-patch-5_14_0-284_158_1, and kpatch-patch-5_14_0-284_172_1 (RHSA-2026:55837)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:55837 advisory. This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the code of a running kernel. This patc...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-101966)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101966 advisory. In the Linux kernel, the following vulnerability has been resolved: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes Reject invalid...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-101974)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101974 advisory. In the Linux kernel, the following vulnerability has been resolved: usbnet: gl620a: fix out-of-bounds read in genelinkrxfixup genelinkrxfixup splits an aggregated R...

RHEL 9 : kpatch-patch-5_14_0-427_100_1, kpatch-patch-5_14_0-427_113_1, kpatch-patch-5_14_0-427_126_1, kpatch-patch-5_14_0-427_68_2, and kpatch-patch-5_14_0-427_84_1 (RHSA-2026:56224)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:56224 advisory. This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the code of a running kernel. This patc...

Linux Distros Unpatched Vulnerability : CVE-2026-74997

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the cmdlearn driver of the markasjunk plugin is subject to remote code execution via crafted...

RHEL 9 : pipewire (RHSA-2026:56028)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:56028 advisory. PipeWire is a multimedia server for Linux and other Unix like operating systems. Security Fixes: pipewire: PipeWire: Sandbox escape and arbitrary co...

Linux Distros Unpatched Vulnerability : CVE-2026-72153

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - irqchip/crossbar: Use correct index in crossbardomainfree crossbardomainfree resets the domain data and then uses the nulled out irqdata-hwirq member as index t...

AlmaLinux 10 : libXfont2 (ALSA-2026:55448)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:55448 advisory. libxfont2: Font Server Client encoding Out-Of-Bounds Read/Write CVE-2026-59679 libxfonts2: libXfont2: Privilege Escalation via Heap Buffer Overflow in...

Amazon Linux 2023 : javapackages-bootstrap (ALAS2023-2026-2055)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2055 advisory. Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core 5.4.2 and earlier, 5.5-beta1 and earlier allows an remote attacker to cause a denial of...

Linux Distros Unpatched Vulnerability : CVE-2026-72011

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - s390/diag: Add missing arrayindexnospec call to memtopgetpagecount 'level' is user space controlled and used to read from an array. Add the missing...

RHEL 8 : attr (RHSA-2026:56133)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:56133 advisory. The attr packages provide extended attributes, which can be used to store system objects like capabilities of executables and access control lists, ...

Linux Distros Unpatched Vulnerability : CVE-2026-74364

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Reject exclusive maps as inner maps in map-in-map An exclusive map created with exclproghash is bound to a single program by hash: checkmapprogcompatibilit...

Linux Distros Unpatched Vulnerability : CVE-2026-72474

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - dmaengine: dma-axi-dmac: use DMA pool to manange DMA descriptor For architectures like Microblaze or arm64 where this IP is used, DMADIRECTREMAP is set which...

Linux Distros Unpatched Vulnerability : CVE-2026-72343

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation mlx5ehvvhcastatscreate is called from mlx5enicenable, before mlx5eopen. At that point priv-statsnch is...

AlmaLinux 10 : gstreamer1-plugins-bad-free (ALSA-2026:55433)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:55433 advisory. gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec IMA/DVI ADPCM decoder CVE-2026-19387 Tenable has extracted the preceding...

Linux Distros Unpatched Vulnerability : CVE-2026-72064

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: mana: Sync page pool RX frags for CPU MANA allocates RX buffers from page pool fragments when fragcount is greater than 1. In that case the buffers remain...

Linux Distros Unpatched Vulnerability : CVE-2026-74286

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: pfcp: allocate per-cpu tstats for PFCP netdevs PFCP uses devgettstats64 as its ndogetstats64 callback, but pfcplinksetup does not request...

Linux Distros Unpatched Vulnerability : CVE-2026-72279

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: arm64: nv: Respect read-only PFN when mapping L1 VNCR KVM currently maps the L1 VNCR into the host stage-1 by relying entirely on the permissions of the...

RockyLinux 10 : libssh (RLSA-2026:55855)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:55855 advisory. libssh: libssh: information disclosure via short GSSAPI Curve25519 public key CVE-2026-59842 libssh: libssh: denial of service via zero advertised...

Linux Distros Unpatched Vulnerability : CVE-2026-72443

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints MIDI 2.0 input URBs are started during sndusbmidiv2create. A later setup failure can still jump to...

Amazon Linux 2023 : perl-Date-Manip (ALAS2023-2026-2050)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2050 advisory. Date::Manip versions through 6.99 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check. The parse regexes capture year, month and day with th...

Linux Distros Unpatched Vulnerability : CVE-2026-54284

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, TokenList construction and string conversion in sqlparse/sql.py repeatedly flatten...