Linux Distros Unpatched Vulnerability : CVE-2026-89860

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scsi: qla2xxx: Initialize NVMe abortwork once at submission qlanvmefcpabort and qlanvmelsabort ran INITWORK on priv-abortwork immediately before schedulework...

Linux Distros Unpatched Vulnerability : CVE-2026-89854

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scsi: qla2xxx: Fix cs84xx use-after-free on host teardown qla84xxputchip drops the last reference to ha-cs84xx and frees it via qla84xxchiprelease without...

Linux Distros Unpatched Vulnerability : CVE-2026-92068

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Site isolation issue in the Reader Mode component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3...

Oracle Linux 9 : tesseract (ELSA-2026-67831)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-67831 advisory. 4.1.1-8 - Resolves: CVE-2026-73066 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus has...

RHEL 9 : gstreamer1-plugins-ugly-free (RHSA-2026:67931)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:67931 advisory. GStreamer is a streaming media framework, based on graphs of elements which operate on media data. This package contains plug-ins whose license is n...

RHEL 8 : tesseract (RHSA-2026:67832)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:67832 advisory. A commercial quality OCR engine originally developed at HP between 1985 and 1995. In 1995, this engine was among the top 3 evaluated by UNLV. It was...

Debian dsa-6502 : mkvtoolnix - security update

The remote Debian 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6502 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6502-1 [email protected] https://www.debian.org/security/ Moritz...

Linux Distros Unpatched Vulnerability : CVE-2026-89928

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: x86/mmu: Consume the locked rmap value in the lockless rmap walk kvmrmaplock deliberately elides the rmap lock when it observes an empty rmap. In that case...

Linux Distros Unpatched Vulnerability : CVE-2026-90020

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - USB: gadget: fix NULL pointer dereference in gadgetdevioctl gadgetdevioctl reads dev-gadget before acquiring dev-lock, but dev-state is checked after acquiring...

Linux Distros Unpatched Vulnerability : CVE-2026-92043

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Privilege escalation due to incorrect boundary conditions in the Audio/Video component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3,...

Mozilla Thunderbird < 153.3

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 153.3. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-96 advisory. - Privilege escalation in the Enterprise Policies component. This vulnerability was fixed in Firefox 156,...

Linux Distros Unpatched Vulnerability : CVE-2026-89972

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nvme: add missing SRCU grace period in error path nvmeallocns error path at outunlinkns removes ns from the namespace head siblings list with...

Mozilla Thunderbird < 156.0

The version of Thunderbird installed on the remote Windows host is prior to 156.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-94 advisory. - Privilege escalation in the Enterprise Policies component. This vulnerability was fixed in Firefox 156, Firefox ES...

SUSE SLES15 Security Update : kernel RT (Live Patch 19 for SUSE Linux Enterprise 15 SP7) (SUSE-SU-2026:4168-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4168-1 advisory. This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.7.72 fixes various security issues: The following security issues were fixed: -...

AlmaLinux 9 : nginx:1.26 (ALSA-2026:67283)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:67283 advisory. nginx: NGINX: Arbitrary code execution via crafted HTTP requests CVE-2026-42533 Tenable has extracted the preceding description block directly from the AlmaLinux...

MiracleLinux 8 : nginx:1.24 nginx-1.24.0-3.module+el8+2045+adfc96b2.5.ML.1 (AXSA:2026-1852:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1852:01 advisory. nginx: NGINX: Arbitrary code execution via crafted HTTP requests CVE-2026-42533 Tenable has extracted the preceding description block directly from the...

Linux Distros Unpatched Vulnerability : CVE-2026-80225

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on...

SUSE SLED15 / SLES15 Security Update : python-GitPython (SUSE-SU-2026:4191-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4191-1 advisory. - CVE-2026-87817: failure to properly validade the git directory location allows attackers to impersonate the...

Linux Distros Unpatched Vulnerability : CVE-2026-89965

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nvdimm/btt: reject an arena whose nfree is below the lane count The BTT info block's nfree field, the number of reserve free blocks, is read from the medium...

Linux Distros Unpatched Vulnerability : CVE-2026-92067

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3...

Ubuntu 24.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (Azure) vulnerabilities (USN-8761-1)

"The remote Ubuntu 24.04 LTS / Pro Realtime 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8761-1 advisory. Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. Thi...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS : polkit vulnerability (USN-8762-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8762-1 advisory. It was discovered that polkit incorrectly handled cookie input. A local attacker could...

Linux Distros Unpatched Vulnerability : CVE-2026-48717

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Open Access Management OpenAM is an access management solution. Prior to 16.1.1, AuthorizationCodeGrantTypeHandler requires a codeverifier only when the...

Linux Distros Unpatched Vulnerability : CVE-2026-92051

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Spoofing issue due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 156 and Thunderbird 156. CVE-2026-92051 Note that Nessu...

Linux Distros Unpatched Vulnerability : CVE-2026-41573

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Open Access Management OpenAM is an access management solution. Prior to 16.1.1, IdentityResourceV1.queryCollection passes the queryId parameter from...

Linux Distros Unpatched Vulnerability : CVE-2026-89881

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - media: rtl2832sdr: use vb2videounregisterdevice on remove to fix DMA leak rtl2832sdrremove runs on USB disconnect and clears dev-udev to NULL before any pendin...

Linux Distros Unpatched Vulnerability : CVE-2026-89823

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm: fix race between partial drmdevregister failure and ioctl If drmdevregister fails after registering a minor e.g. render minor registered, primary minor...

Fedora 44 : php-pecl-mongodb2 (2026-358d3ccdfe)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-358d3ccdfe advisory. Version 2.1.9 - PHPC-2744 Fix out-of-bounds read when building BSON field path by @paulinevos & @GromNaN in 2081 CVE-2026-84968 Tenable has extracted the...

Linux Distros Unpatched Vulnerability : CVE-2026-89873

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - media: v4l2-ctrls: validate HEVC EXT SPS RPS counts The HEVC SPS control carries the short-term and long- term RPS counts that decoder drivers use to walk the...

TencentOS Server 2: compat-glibc (TSSA-2026:1019)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1019 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:...

Linux Distros Unpatched Vulnerability : CVE-2026-92070

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Information disclosure in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3...

Linux Distros Unpatched Vulnerability : CVE-2024-14029

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a...

Oracle Linux 8 : tesseract (ELSA-2026-67832)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-67832 advisory. 4.1.1-3 - Resolves: CVE-2026-73066 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus has...

Linux Distros Unpatched Vulnerability : CVE-2026-89923

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: s390: Free guest debug data on vcpu destroy kvms390clearbpdata is only called from kvmarchvcpuioctlsetguestdebug, i.e. when user space changes or disables...

Linux Distros Unpatched Vulnerability : CVE-2026-89992

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - cpuidle: dtidlegenpd: kfree the original name allocation dtidlepdalloc kasprintfs the full node path, then points pd-name at kbasename of that string...

Oracle Linux 10 : coreutils (ELSA-2026-67886)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-67886 advisory. - uniq: fix CVE-2026-56391 RHEL-216794 - fix read overrun with -w Tenable has extracted the preceding description block directly from the Oracle Linu...

Fedora 44 : python-django6 (2026-6613125727)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-6613125727 advisory. Update python-django6 providing python3-django to the latest 6.1.1 release Tenable has extracted the preceding description block directly from the...

SUSE SLES12: NetworkManager-devel / libnm-glib-vpn1 / libnm-glib4 / libnm-util2 / etc (SUSE-SU-2026:4181-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4181-1 advisory. - CVE-2025-9615: avoid non-admin user using other users' certificate bsc1257359. - CVE-2026-10805: Local privilege escalation via...

RHEL 8 : .NET 8.0 (RHSA-2026:68316)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:68316 advisory. .NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly...

Linux Distros Unpatched Vulnerability : CVE-2026-89886

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - media: intel/ipu6: fix async notifier cleanup leak on parse error isysnotifierinit calls v4l2asyncnfinit and then adds fwnode remote subdevs in a loop with...

Oracle Linux 10 : ELSA-2026-67471-0: / kernel (ELSA-2026-674710)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-674710 advisory. - smb: smbdirect: introduce smbdirectsocket.recvio.credits.available Paulo Alcantara RHEL-230559 CVE-2026-31539 - scsi: libiscsitcp: Bound SCSI...

Linux Distros Unpatched Vulnerability : CVE-2026-89878

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - media: s2255: check firmware size before reading trailing marker s2255probe reads a 4-byte marker and version from the last 8 bytes of the firmware blob...

Linux Distros Unpatched Vulnerability : CVE-2026-89950

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - batman-adv: mcast: linearize skbuff for packet generation batadvmcastforwpacket and batadvmcastforwscrape is not only called indirectly by the...

Fedora 44 : open62541 (2026-6d919ea521)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-6d919ea521 advisory. Update to 1.5.8 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested fo...

Linux Distros Unpatched Vulnerability : CVE-2026-90047

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/xe: Don't hand out the flat CCS storage as usable VRAM getflatccsoffset reads the base of the flat CCS storage from the hardware, scales it by the number of...

Linux Distros Unpatched Vulnerability : CVE-2026-90014

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tracing: Have showeventfilters/triggers files take trace array ref The newly added files showeventfilters and showeventtriggers that show all filters or trigger...

Linux Distros Unpatched Vulnerability : CVE-2026-92044

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Information disclosure in the Networking: HTTP component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3...

Linux Distros Unpatched Vulnerability : CVE-2026-89876

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - media: tda18250: fix possible integer overflow Integer overflow may occur, when variable exp equals to zero. Result of shift 1 exp - 1 may then leads to undefin...

Linux Distros Unpatched Vulnerability : CVE-2026-90004

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: handle region split failure in applyminnrregions damonapplyminnrregions...

TencentOS Server 4: gvfs (TSSA-2026:1011)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1011 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...