RockyLinux 8 : unbound (RLSA-2026:55784)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:55784 advisory. unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes CVE-2026-44690 Tenable has extracted the preceding...

Linux Distros Unpatched Vulnerability : CVE-2026-72177

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mm/damon/sysfs-schemes: fix dir put orders in accesspatternadddirs Patch series mm/damon/sysfs- schemes: fix wrong directories put orders in error paths. Error...

RockyLinux 8 : haproxy (RLSA-2026:55859)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:55859 advisory. haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions CVE-2026-55204 Tenable has extracted the preceding description block directly from the...

RHEL 8 : 389-ds:1.4 (RHSA-2026:55794)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:55794 advisory. 389 Directory Server is an LDAP version 3 LDAPv3 compliant server. The base packages include the Lightweight Directory Access Protocol LDAP...

Linux Distros Unpatched Vulnerability : CVE-2026-74578

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - crypto: algifskcipher - force synchronous processing on trees without ctx-state The AIO/async path in skcipherrecvmsg passes the socket-wide ctx-iv directly int...

RHEL 9 : unbound (RHSA-2026:55841)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:55841 advisory. The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fixes: unbound: Unbound: Cache poisoning...

Linux Distros Unpatched Vulnerability : CVE-2026-74335

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Fix NULL pointer dereference in bpftaskfromvpid bpftaskfromvpid looks up a task in the pid namespace of the current task, via findtaskbyvpid:...

Linux Distros Unpatched Vulnerability : CVE-2026-72046

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gve: fix header buffer corruption with header-split and HW-GRO The DQO RX datapath programs a per-buffer- queue-descriptor headerbufaddr at post time and reads...

Linux Distros Unpatched Vulnerability : CVE-2026-72127

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netdev-genl: report NAPI thread PID in the caller's pid namespace netdevnlnapifillone reports the NAPI kthread PID in NETDEVANAPIPID using taskpidnr, which...

Linux Distros Unpatched Vulnerability : CVE-2026-74352

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - of: reservedmem: avoid post-init UAF when allocreservedmemarray fails The global pointer 'reservedmem' continues to reference the reservedmemarray which lives i...

Linux Distros Unpatched Vulnerability : CVE-2026-68518

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, sanitizemustachedict in glances/actions.py sanitizes individual Mustache values...

Linux Distros Unpatched Vulnerability : CVE-2026-74425

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - afs: handle CB.InitCallBackState3 requests without a server record The cache manager callback path now attaches the server record to an incoming call through th...

Linux Distros Unpatched Vulnerability : CVE-2026-72018

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - dibs: loopback: validate offset and size in movedata The loopback movedata performs a memcpy into the registered DMB without checking whether offset + size...

Linux Distros Unpatched Vulnerability : CVE-2026-72361

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/xe/hwengine: Fix double-free of managed BO in error path The error path in hwengineinit explicitly frees a BO allocated with xemanagedbocreatepinmap via...

Linux Distros Unpatched Vulnerability : CVE-2026-74396

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RDMA/mlx5: Fix UMR XLT cleanup on ODP populate failure mlx5rumrupdatexlt allocates and DMA maps an XLT buffer with mlx5rumrcreatexlt. The buffer is released by...

Linux Distros Unpatched Vulnerability : CVE-2026-74288

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: fibrules: Don't dump dying fibrule in fibrulesdump. rockerrouterfibevent calls fibruleget during RCU dump. If the fibrule is dying, refcountinc will compla...

Linux Distros Unpatched Vulnerability : CVE-2026-74332

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ASoC: amd: acp-sdw-sof: Bound DAI link iteration createsdwdailinks walks sofdais until it finds an entry with initialised cleared, but sofdais is allocated with...

Linux Distros Unpatched Vulnerability : CVE-2026-72220

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sunrpc: harden rqprocinfo lifecycle to prevent double-free The svcreleaserqst function executes the callback inside rqstp-rqprocinfo-pcrelease. However, if a...

Linux Distros Unpatched Vulnerability : CVE-2026-72233

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - batman-adv: bla: reacquire gw address after skb realloc The pskbmaypull called by batadvblaisbackbonegw could reallocate the buffer behind the skb. Variables...

Fedora 43 : php-phpseclib (2026-b2ce3f8e3e)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-b2ce3f8e3e advisory. Update to v2.0.55 - contains fix for CVE-2026-44167 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note th...

Linux Distros Unpatched Vulnerability : CVE-2026-72277

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: arm64: nv: Inject SEA if guest VNCR isn't normal memory When constructing an L1 VNCR mapping, KVM unconditionally uses cacheable memory attributes, even if...

Amazon Linux 2 : sg3_utils, --advisory ALAS2-2026-3860 (ALAS-2026-3860)

The version of sg3utils installed on the remote host is prior to 1.37-12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3860 advisory. A flaw was found in sg3utils. The sginq command, when invoked with the --export option, outputs device identification data without...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102120)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102120 advisory. In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Validate XDomain request packet size before type cast tbxdphandlerequest casts the...

Linux Distros Unpatched Vulnerability : CVE-2026-74276

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - spi: xilinx: use FIFO occupancy register to determine buffer size The method the driver uses to determine the size of the FIFO has a problem. What it currently...

Linux Distros Unpatched Vulnerability : CVE-2026-72176

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mm/damon/sysfs-schemes: put stats for schemeadddirs internal error damonsysfsschemeadddirs setup the triedregions directory after the stats directory setup is...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-101996)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101996 advisory. In the Linux kernel, the following vulnerability has been resolved: net: strparser: fix skbhead leak in strpabortstrp When the stream parser is aborted, for example...

Linux Distros Unpatched Vulnerability : CVE-2026-72412

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - s390/mm: Fix handling of PAGEUNUSED pte bit The PAGEUNUSED softbit should not really be lying around. Its sole purpose is to signal to trytounmapone and...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-101989)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101989 advisory. In the Linux kernel, the following vulnerability has been resolved: writeback: fix race between cgroupwritebackumount and inodeswitchwbs When a container exits, the...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102127)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102127 advisory. In the Linux kernel, the following vulnerability has been resolved: fbdev: fix potential buffer overflow in doregisterframebuffer The current implementation may lead...

Linux Distros Unpatched Vulnerability : CVE-2026-74303

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: hciqca: fix NULL pointer dereference in qcadmphdr for non-serdev device hu-serdev is NULL for hciuart attached via non-serdev paths, but qcadmphdr...

Zoom Workplace < 7.1.5 Vulnerability (ZSB-26017)

The version of Zoom Workplace installed on the remote host is prior to 7.1.5. It is, therefore, affected by a vulnerability as referenced in the ZSB-26017 advisory. - Use after Free in the annotator function of Zoom Clients may allow a meeting participant to achieve remote code execution of anoth...

RHEL 8 : haproxy (RHSA-2026:55861)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:55861 advisory. The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications. Security Fixes: haproxy: HAProx...

Linux Distros Unpatched Vulnerability : CVE-2026-72331

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - accel/amdxdna: Fix VMA access race aie2populaterange and amdxdnaumaprelease access a saved VMA pointer that may have already been freed, leading to a potential...

AlmaLinux 8 : 389-ds:1.4 (ALSA-2026:55530)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:55530 advisory. 389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status check CVE-2026-11770 389-ds-base: 389-ds-base: NULL pointer dereference in...

Google Chrome < 151.0.7922.169 Multiple Vulnerabilities

The version of Google Chrome installed on the remote macOS host is prior to 151.0.7922.169. It is, therefore, affected by multiple vulnerabilities as referenced in the 202608stable-channel-update-for-desktop0826575033 advisory. - Use after free in WebGL in Google Chrome prior to 151.0.7922.169...

Linux Distros Unpatched Vulnerability : CVE-2026-72456

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - apparmor: release exe file resources on path failure getcurrentexepath takes both an exefile reference and a path reference before resolving the path name. If...

Debian dla-4744 : calibre - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4744 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4744-1 [email protected]...

RockyLinux 9 : unbound (RLSA-2026:55841)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:55841 advisory. unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes CVE-2026-44690 unbound: Unbound: Denial of Service...

Linux Distros Unpatched Vulnerability : CVE-2026-72231

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - batman-adv: tt: avoid request storms during pending request batadvsendttrequest allocates a ttreqnode when none exists for the destination originator node. This...

Linux Distros Unpatched Vulnerability : CVE-2026-72363

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfs: Fix folio state after ENOMEM whilst under writeback iteration Fix the state of the current folio when ENOMEM occurs during writeback iteration. The folio...

Linux Distros Unpatched Vulnerability : CVE-2026-59894

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse/filters/output.py fails to escape existing backslashes before quotes in...

Linux Distros Unpatched Vulnerability : CVE-2026-74346

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RDMA/irdma: Fix OOB read during CQ MR registration Sashiko pointed out an unrelated bug during a previous patch:...

Linux Distros Unpatched Vulnerability : CVE-2026-72266

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fbdev: vesafb: fix memory leak in vesafbprobe Since commit 73ce73c30ba9 fbdev: Transfer video= option strings to caller; clarify ownership the string returned...

RHEL 10 : pcp (RHSA-2026:55617)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:55617 advisory. Performance Co-Pilot PCP is a suite of tools, services, and libraries for acquisition, archiving, and analysis of system-level performance...

VMware ESX 8.0 / 9.0 / 9.1 Insufficient Logging (VMSA-2026-0006)

The version of VMware ESX installed on the remote host is 8.0 prior to build 25429389 8.0 Update 3j, or 9.0 prior to build 25595025 9.0.2.0100, or 9.1 prior to build 25370933 9.1.0.0. It is, therefore, affected by a vulnerability as referenced in the VMSA-2026-0006.1 advisory: - VMware ESX contai...

Linux Distros Unpatched Vulnerability : CVE-2026-72175

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fs/proc/taskmmu: fix makeuffdwphugepte prot-update race Patch series userfaultfd/pagemap: pre- existing fixes. These are pre-existing bug fixes that were carrie...

Linux Distros Unpatched Vulnerability : CVE-2026-72303

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ASoC: SOF: ipc4-control: Validate notification payload size Validate MODULENOTIFICATION payload length before reading bytes/channel data in control update...

VMware Fusion 25.x < 26.0.0 Information Disclosure (VMSA-2026-0006)

The version of VMware Fusion installed on the remote macOS host is 25.x 25H2 prior to 26.0.0 26H1. It is, therefore, affected by a vulnerability as referenced in the VMSA-2026-0006.1 advisory: - VMware ESX, Workstation, and Fusion contain an out-of-bounds read vulnerability. A malicious actor wit...

Linux Distros Unpatched Vulnerability : CVE-2026-74330

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - configfs: fix lockless traversals of -schildren Having the parent directory locked protects entries from removal by another thread, but it does not protect...

Linux Distros Unpatched Vulnerability : CVE-2026-72489

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - staging: nvec: fix use-after-free in nvecrxcompleted In nvecrxcompleted, when an incomplete RX transfer is detected, nvecmsgfree is called to return the message...