Oracle Linux 8 : ELSA-2026-67278-0: / perl:5.32 (ELSA-2026-672780)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-672780 advisory. - Fixes: CVE-2026-13221 - Don't create a trie that would overflow - Fix CVE-2025-40909 - Clone dirhandles without fchdir - Fix CVE-2023-47038 - Fix...

Oracle Linux 8 : ELSA-2026-67468-0: / kernel (ELSA-2026-674680)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-674680 advisory. - EDAC/bluefield: Fix potential integer overflow Joel Savitz RHEL-234337 CVE-2024-53161 - scsi: libiscsitcp: Bound SCSI Response data segment to the...

openSUSE 16: gimp / gimp-devel / gimp-extension-goat-excercises / gimp-lang / etc (openSUSE-SU-2026:21839-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21839-1 advisory. Changes in gimp: - CVE-2026-66757: Fixed signed integer overflow in file-sgi causes the plugin to crash when RLE- compressed SGI images are processed...

Linux Distros Unpatched Vulnerability : CVE-2026-89942

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iio: buffer: Fix potential use-after-free in anonymous buffer release An anonymous buffer handle holds a reference to the underlying IIO device. The reference i...

Linux Distros Unpatched Vulnerability : CVE-2026-92055

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Privilege escalation in the DevTools component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3...

SUSE SLED15 / SLES15 Security Update : python-sqlparse (SUSE-SU-2026:4145-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4145-1 advisory. This update for python-sqlparse fixes the following issue: - CVE-2026-84305: Reindentation of tuple lists causes near-c...

RHEL 9 : gstreamer1-plugins-base (RHSA-2026:67891)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:67891 advisory. GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-base packages contain a...

Linux Distros Unpatched Vulnerability : CVE-2026-92034

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 156 and Thunderbird 156. CVE-2026-92034 Note that Nessus relies on the...

GitLab 18.3 < 18.11.12 / 19.0 < 19.0.9 / 19.1 < 19.1.8 / 19.2 < 19.2.6 / 19.3 < 19.3.2 (CVE-2026-87719)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue that, under certain conditions, could allow an authenticated user with Duo Chat access to obtain Advanced Search instance configurations and sensitive credentials using ...

Linux Distros Unpatched Vulnerability : CVE-2026-89951

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - batman-adv: fix stale receive device on merged fragments Fragment reassembly reuses the skb from the highest-numbered buffered fragment as the merged packet. Wh...

Oracle Coherence CVE-2026-83411 (September 2026 CSPU)

The 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 versions of Coherence installed on the remote host are affected by a vulnerability as referenced in the September 2026 CSPU advisory. - Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware component: Core. Supported versions that are...

Debian dsa-6503 : thunderbird - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6503 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6503-1 [email protected] https://www.debian.org/securit...

Linux Distros Unpatched Vulnerability : CVE-2026-89864

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scsi: qla2xxx: Bound i2c-length in I2C bsg handlers struct qlai2caccess carries a 16-bit length field alongside a fixed 64-byte buffer: struct qlai2caccess...

Linux Distros Unpatched Vulnerability : CVE-2026-19666

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - On a resolver configured to use dns64, if an applicable answer from the authoritative server is malformed in a specific way, the resolver named process will exi...

Linux Distros Unpatched Vulnerability : CVE-2026-89824

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/panel-edp: fix i2c adapter leak on probe failure Make sure to drop the i2c adapter reference on probe failure e.g. probe deferral and on driver unbind also ...

Linux Distros Unpatched Vulnerability : CVE-2026-89835

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - f2fs: avoid NULL checkpoint thread access in sysfs checkpointmerge can be enabled even when no checkpoint merge thread is running. A read-only mount is one case...

Linux Distros Unpatched Vulnerability : CVE-2026-75029

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In a query response, an attacker may send named multiple copies of a record that should only exist once such as an SOA record. If the RDATA is the same on all t...

Security Updates for Microsoft Office Products (September 2026) (macOS)

The version of Microsoft Office for Mac installed on the remote host is affected by multiple vulnerabilities as referenced in the september-16-2026 advisory. - Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network. CVE-2026-69678,...

Linux Distros Unpatched Vulnerability : CVE-2026-92071

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird...

RHEL 9 : gstreamer1-plugins-ugly-free (RHSA-2026:67882)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:67882 advisory. GStreamer is a streaming media framework, based on graphs of elements which operate on media data. This package contains plug-ins whose license is n...

Linux Distros Unpatched Vulnerability : CVE-2026-63128

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.0.0, the rmcp crate's stateful Streamable HTTP server in...

Linux Distros Unpatched Vulnerability : CVE-2026-92052

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Privilege escalation due to uninitialized memory in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3,...

Linux Distros Unpatched Vulnerability : CVE-2026-89908

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - LoongArch: KVM: Preserve memslot arch flags on KVMMRFLAGSONLY kvmarchpreparememoryregion computes new-arch.flags, i.e. whether a memslot is KVMMEMHUGEPAGECAPABL...

Linux Distros Unpatched Vulnerability : CVE-2026-89977

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - accel/ethosu: check MMIO mapping errors in probe devmplatformioremapresource returns an error pointer when the register resource cannot be mapped. ethosuprobe...

Linux Distros Unpatched Vulnerability : CVE-2026-89837

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - f2fs: fix dentry folio leak in findinlevel findinlevel gets a dentry folio with f2fsfinddatafolio before calling findinblock. If findinblock returns an error, t...

SUSE SLES15 Security Update : perl-Protocol-HTTP2 (SUSE-SU-2026:4182-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2026:4182-1 advisory. This update for perl-Protocol-HTTP2 fixes the following issue: - CVE-2026-16028: memory exhaustion leading to denial of service due to closed streams...

Apple TV < 27 Multiple Vulnerabilities (149036)

According to its banner, the version of Apple TV on the remote device is prior to 27. It is therefore affected by multiple vulnerabilities as described in the 149036 %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid346260; scriptversion"1.2";...

RHEL 9 : opentelemetry-collector (RHSA-2026:67975)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:67975 advisory. Collector with the supported components for a Red Hat build of OpenTelemetry Security Fixes: net/mail: golang: net/mail: Denial of Service...

openSUSE 16 Security Update : google-cloud-sap-agent (openSUSE-SU-2026:21834-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21834-1 advisory. Security issues fixed: - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input bsc1272128. -...

RHEL 8 : tesseract (RHSA-2026:67832)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:67832 advisory. A commercial quality OCR engine originally developed at HP between 1985 and 1995. In 1995, this engine was among the top 3 evaluated by UNLV. It was...

MiracleLinux 8 : nginx:1.24 nginx-1.24.0-3.module+el8+2045+adfc96b2.5.ML.1 (AXSA:2026-1852:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1852:01 advisory. nginx: NGINX: Arbitrary code execution via crafted HTTP requests CVE-2026-42533 Tenable has extracted the preceding description block directly from the...

Linux Distros Unpatched Vulnerability : CVE-2026-89986

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mm/mempolicy: fix sleeping allocation in allocpagesbulkweightedinterleave syzbot reported a sleeping function called from invalid context splat in...

TencentOS Server 2: compat-glibc (TSSA-2026:1019)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1019 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:...

Linux Distros Unpatched Vulnerability : CVE-2026-89823

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm: fix race between partial drmdevregister failure and ioctl If drmdevregister fails after registering a minor e.g. render minor registered, primary minor...

Linux Distros Unpatched Vulnerability : CVE-2026-92070

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Information disclosure in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3...

Oracle Linux 10 : ELSA-2026-67471-0: / kernel (ELSA-2026-674710)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-674710 advisory. - smb: smbdirect: introduce smbdirectsocket.recvio.credits.available Paulo Alcantara RHEL-230559 CVE-2026-31539 - scsi: libiscsitcp: Bound SCSI...

Linux Distros Unpatched Vulnerability : CVE-2026-89965

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nvdimm/btt: reject an arena whose nfree is below the lane count The BTT info block's nfree field, the number of reserve free blocks, is read from the medium...

Fedora 43 : erlang (2026-02481296e8)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-02481296e8 advisory. Backported fixes for CVE-2026-58227 and CVE-2026-59251 ---- Fix for CVE-2026-55953 Tenable has extracted the preceding description block directly fr...

RockyLinux 8 : kernel (RLSA-2026:67468)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:67468 advisory. kernel: EDAC/bluefield: Fix potential integer overflow CVE-2024-53161 kernel: wifi: mac80211: Discard Beacon frames to non-broadcast address...

Linux Distros Unpatched Vulnerability : CVE-2026-90025

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: typec: ucsi: displayport: Fix OOB altmode array index The UCSI displayport driver indexes the connector's port altmode array with the GETCURRENTCAM respons...

Linux Distros Unpatched Vulnerability : CVE-2026-89872

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - media: v4l2-fwnode: Fix fwnode leak in v4l2fwnodeparselink In v4l2fwnodeparselink, the remote endpoint fwnode reference is acquired using...

Slackware Linux 15.0 / current mozilla-thunderbird Multiple Vulnerabilities (SSA:2026-259-02)

The version of mozilla-thunderbird installed on the remote host is prior to 140.16.0esr / 153.3.0esr. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2026-259-02 advisory. New mozilla-thunderbird packages are available for Slackware 15.0 and -current to fix securit...

Linux Distros Unpatched Vulnerability : CVE-2026-89803

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/nouveau: unsubscribe the channel-kill event before the fence context nouveauchanneldel tears the fence context down first and only drops the channel-kill...

Linux Distros Unpatched Vulnerability : CVE-2026-89854

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scsi: qla2xxx: Fix cs84xx use-after-free on host teardown qla84xxputchip drops the last reference to ha-cs84xx and frees it via qla84xxchiprelease without...

Linux Distros Unpatched Vulnerability : CVE-2026-92068

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Site isolation issue in the Reader Mode component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3...

Mozilla Thunderbird < 156.0

The version of Thunderbird installed on the remote Windows host is prior to 156.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-94 advisory. - Privilege escalation in the Enterprise Policies component. This vulnerability was fixed in Firefox 156, Firefox ES...

Linux Distros Unpatched Vulnerability : CVE-2026-89799

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Disable preemption in bpfgetstackid The getperfcallchain call needs disabled preemption plus we need it disabled as long as we access its returned trace...

RockyLinux 10 : kernel (RLSA-2026:67471)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:67471 advisory. kernel: tls: Use skdstget and dstdevrcu in getnetdevforsock CVE-2025-40149 kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improp...

Linux Distros Unpatched Vulnerability : CVE-2026-89903

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - LoongArch: Do not save/restore percpu base register in rethook trampoline The rethook trampoline saves $r21 $u0, the percpu base, into its frame at entry and...

Linux Distros Unpatched Vulnerability : CVE-2026-90003

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - futex: Prevent rcuwait use-after-free during requeue PI On PREEMPTRT, FUTEXCMPREQUEUEPI can trigger a KASAN report slab-out-of-bounds in futexrequeuepicomplete...