SUSE SLES15 Security Update : ansible-core (SUSE-SU-2026:4154-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4154-1 advisory. - CVE-2026-16493: argument injection in ansible-galaxy collection install via git clone bsc1272369. Tenable has extracted the...

SUSE SLED15 / SLES15 Security Update : python-GitPython (SUSE-SU-2026:4191-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4191-1 advisory. - CVE-2026-87817: failure to properly validade the git directory location allows attackers to impersonate the...

Oracle Linux 9 : firewalld (ELSA-2026-67585)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-67585 advisory. 1.3.4-20.0.1 - Red Hat Satellite and Red Hat high availaibility reference found in cockpit UI Orabug: 30257573 - discard empty RH-Satellite-6.xml Orabug:...

Ubuntu 24.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (NVIDIA) vulnerabilities (USN-8760-1)

"The remote Ubuntu 24.04 LTS / Pro Realtime 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8760-1 advisory. Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. Thi...

Linux Distros Unpatched Vulnerability : CVE-2026-89846

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scsi: qla2xxx: Bound rspinfolen to avoid OOB sense-data read In qla2x00statusentry, the FWI2 status path advances sensedata and shrinks parsenselen by...

Linux Distros Unpatched Vulnerability : CVE-2023-54397

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content- Length headers accepting non-standard characters...

Linux Distros Unpatched Vulnerability : CVE-2026-89841

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - f2fs: only redirty pinned folios in redirtyblocks redirtyblocks pins folios with readcachefolio and then walks the same range again with filemaplockfolio to...

openSUSE 16 Security Update : keybase-client (openSUSE-SU-2026:21846-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21846-1 advisory. Changes in keybase-client: - CVE-2026-56855,CVE-2026-56854,CVE-2026-78662: authentication bypass and deadlocks in the crypto/ssh library Add...

Linux Distros Unpatched Vulnerability : CVE-2026-89950

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - batman-adv: mcast: linearize skbuff for packet generation batadvmcastforwpacket and batadvmcastforwscrape is not only called indirectly by the...

Linux Distros Unpatched Vulnerability : CVE-2026-89878

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - media: s2255: check firmware size before reading trailing marker s2255probe reads a 4-byte marker and version from the last 8 bytes of the firmware blob...

Linux Distros Unpatched Vulnerability : CVE-2026-90033

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: usb-audio: fix OOB write in sndusbmidius122loutput The sndusbmidius122loutput picks a count of 2 on anything slower than high speed and never relates it t...

Linux Distros Unpatched Vulnerability : CVE-2026-89848

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scsi: qla2xxx: Quiesce response IRQ before freeing request queue qla2xxxdeleteqpair deletes the request queue before the response queue. qla25xxdeletereqque fre...

Linux Distros Unpatched Vulnerability : CVE-2026-89994

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - dmaengine: fsl-edma: tracing: no ptr dereference during log output The fsl edma events store a pointer to a struct fsledmaengine in the ringbuffer and dereferen...

Linux Distros Unpatched Vulnerability : CVE-2026-89816

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm: Fix drmcrtccommit leak if signaled when PAGEFLIPEVENT is used Commit 1c6ceeee6ebb drm/atomic: Fix memleak on ERESTARTSYS during non-blocking commits fixed ...

Linux Distros Unpatched Vulnerability : CVE-2026-90029

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: storage: realtekcr: fix use-after-free on disconnect realtekcrdestructor calls timerdelete before the chip containing the timer is freed. The timer callbac...

Mozilla Thunderbird < 140.16

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 140.16. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-95 advisory. - Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component. This...

Linux Distros Unpatched Vulnerability : CVE-2026-89934

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iio: light: ltrf216a: fix runtime PM reference leak in error path ltrf216agetlux acquires a runtime PM reference by calling ltrf216asetpowerstatedata, true...

Linux Distros Unpatched Vulnerability : CVE-2026-89981

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - arm64: Don't read GMIDEL1 when MTE is disabled cpuinfostorecpu gates the GMIDEL1 read on the raw IDAA64PFR1EL1, so it reads the register even when the kernel ha...

AlmaLinux 9 : nginx:1.26 (ALSA-2026:67283)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:67283 advisory. nginx: NGINX: Arbitrary code execution via crafted HTTP requests CVE-2026-42533 Tenable has extracted the preceding description block directly from the AlmaLinux...

Linux Distros Unpatched Vulnerability : CVE-2026-90016

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - staging: rtl8723bs: fix OOB read in rtwrestructwmmie rtwrestructwmmie scans inie for a WMM IE with: while i inlen ... if i + 5 inlen && iniei == 0xDD &&...

SUSE SLES15: strongswan / strongswan-doc / strongswan-hmac / strongswan-ipsec / etc (SUSE-SU-2026:4146-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4146-1 advisory. - CVE-2026-78123: Undefined Memory Access When Handling PKCS7 Containers bsc1276533. - CVE-2026-78124: Memory Leak When Processing...

Linux Distros Unpatched Vulnerability : CVE-2026-89895

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - media: cobalt: Avoid freeing ALSA private data twice sndcobaltcardcreate stores cobsc in sc-privatedata and installs sndcobaltcardprivatefree as sc-privatefree...

Linux Distros Unpatched Vulnerability : CVE-2026-89978

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - accel/amdxdna: return early from a zero-length flush SYNCBO does not constrain its size, so a request for zero bytes reaches drmclflushvirtrange, which ends wit...

Linux Distros Unpatched Vulnerability : CVE-2026-89992

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - cpuidle: dtidlegenpd: kfree the original name allocation dtidlepdalloc kasprintfs the full node path, then points pd-name at kbasename of that string...

Oracle Linux 10 : coreutils (ELSA-2026-67886)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-67886 advisory. - uniq: fix CVE-2026-56391 RHEL-216794 - fix read overrun with -w Tenable has extracted the preceding description block directly from the Oracle Linu...

Linux Distros Unpatched Vulnerability : CVE-2026-89881

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - media: rtl2832sdr: use vb2videounregisterdevice on remove to fix DMA leak rtl2832sdrremove runs on USB disconnect and clears dev-udev to NULL before any pendin...

Linux Distros Unpatched Vulnerability : CVE-2026-41573

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Open Access Management OpenAM is an access management solution. Prior to 16.1.1, IdentityResourceV1.queryCollection passes the queryId parameter from...

Linux Distros Unpatched Vulnerability : CVE-2024-14029

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a...

SUSE SLES12: NetworkManager-devel / libnm-glib-vpn1 / libnm-glib4 / libnm-util2 / etc (SUSE-SU-2026:4181-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4181-1 advisory. - CVE-2025-9615: avoid non-admin user using other users' certificate bsc1257359. - CVE-2026-10805: Local privilege escalation via...

Linux Distros Unpatched Vulnerability : CVE-2026-92051

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Spoofing issue due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 156 and Thunderbird 156. CVE-2026-92051 Note that Nessu...

Linux Distros Unpatched Vulnerability : CVE-2026-89923

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: s390: Free guest debug data on vcpu destroy kvms390clearbpdata is only called from kvmarchvcpuioctlsetguestdebug, i.e. when user space changes or disables...

Linux Distros Unpatched Vulnerability : CVE-2026-89807

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amdkfd: guard against NULL restoremqd in CRIU queue restore Both createqueuecpsch and createqueuenocpsch unconditionally call mqdmgr-restoremqd when a CRIU...

Oracle Coherence 15.1.1.0.x < 15.1.1.0.5 Multiple Vulnerabilities (September 2026 CSPU)

The 15.1.1.0.0 version of Coherence installed on the remote host is affected by multiple vulnerabilities as referenced in the September 2026 CSPU advisory. - Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware component: Core. The supported version that is affected is...

GitLab 13.9 < 19.1.8 / 19.2 < 19.2.6 / 19.3 < 19.3.2 (CVE-2026-7514)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.9 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that an authenticated user with developer-role permissions cou...

Linux Distros Unpatched Vulnerability : CVE-2026-92050

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Sandbox escape due to race condition in the XPConnect component. This vulnerability was fixed in Firefox 156 and Thunderbird 156. CVE-2026-92050 Note that Nessu...

Linux Distros Unpatched Vulnerability : CVE-2026-89860

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scsi: qla2xxx: Initialize NVMe abortwork once at submission qlanvmefcpabort and qlanvmelsabort ran INITWORK on priv-abortwork immediately before schedulework...

Linux Distros Unpatched Vulnerability : CVE-2026-89972

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nvme: add missing SRCU grace period in error path nvmeallocns error path at outunlinkns removes ns from the namespace head siblings list with...

Linux Distros Unpatched Vulnerability : CVE-2026-89925

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: s390: Fix memory leak in guest debug handling bpdata is freed only for the error case by kfreebpdata. Every successful KVMSETGUESTDEBUG will leak bpdata...

Linux Distros Unpatched Vulnerability : CVE-2026-90027

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: typec: qcom-pmic-typec: disable ccdebouncedwork on stop ccdebouncedwork is queued from the setcc and starttoggling callbacks, which run from TCPM's kthread...

RHEL 9 : gstreamer1-plugins-ugly-free (RHSA-2026:67931)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:67931 advisory. GStreamer is a streaming media framework, based on graphs of elements which operate on media data. This package contains plug-ins whose license is n...

Linux Distros Unpatched Vulnerability : CVE-2026-89946

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ASoC: cs35l33: drain threaded IRQ before runtime suspend cs35l33runtimesuspend currently switches the codec into regcachecacheonlytrue and powers it down withou...

Linux Distros Unpatched Vulnerability : CVE-2026-89868

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - media: chips-media: wave5: Add timeout while stopstreaming When stopstreaming is called, an infinite loop may occur in some cases. Add a bounded poll of the que...

Linux Distros Unpatched Vulnerability : CVE-2026-89986

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mm/mempolicy: fix sleeping allocation in allocpagesbulkweightedinterleave syzbot reported a sleeping function called from invalid context splat in...

TencentOS Server 4: gvfs (TSSA-2026:1011)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1011 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

RHEL 10 : opentelemetry-collector (RHSA-2026:67974)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:67974 advisory. Collector with the supported components for a Red Hat build of OpenTelemetry Security Fixes: net/mail: golang: net/mail: Denial of Service...

RHEL 9 : opentelemetry-collector (RHSA-2026:67975)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:67975 advisory. Collector with the supported components for a Red Hat build of OpenTelemetry Security Fixes: net/mail: golang: net/mail: Denial of Service...

RHEL 10 / 9 : Red Hat Edge Manager Version 1.2.1 Security Update (Important) (RHSA-2026:68335)

The remote Redhat Enterprise Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:68335 advisory. Red Hat Edge Manager RHEM provides simple, scalable, and security-focused management of edge devices and applications. It supports...

Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS : Snapcast vulnerability (USN-8767-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8767-1 advisory. It was discovered that Snapcast incorrectly handled crafted JSON-RPC requests. A remote attacker could possibly use this issue to execute...

Arista Networks EOS 802.1X Per-Supplicant ACL Bypass (SA0150) (CVE-2026-77191)

The version of Arista Networks EOS running on the remote device is affected by an access control bypass vulnerability as referenced in security advisory SA0150. - On affected releases of Arista EOS configured as an 802.1X authenticator with per-supplicant access control lists, the ACL assigned to...

Linux Distros Unpatched Vulnerability : CVE-2026-15789

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs t...