AlmaLinux 8 : thunderbird (ALSA-2026:90913)

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:90913 advisory. firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics component CVE-2026-92035 firefox: thunderbird: Use-after-free i...

Linux Distros Unpatched Vulnerability : CVE-2026-98995

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - namespace: reset the old parent's -overmount in mntchangemountpoint umountmnt resets -overmount of the parent when it unmounts the mount that overmounts it...

TencentOS Server 3: postgresql:12 (TSSA-2026:1218)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1218 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

Linux Distros Unpatched Vulnerability : CVE-2026-98907

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - btrfs: protect sbwritepointer with invalidate lock sbwritepointer reads the super block from the block device page cache using readcachepagegfp. This has the sa...

Oracle Linux 10 : xdg-dbus-proxy (ELSA-2026-90523)

The remote Oracle Linux 10 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-90523 advisory. 0.1.5-4.1 - Message filtering bypass via reply serial allows sandbox escape CVE-2026-94422 Resolves: RHEL-271542 Tenable has extracted the preceding descripti...

Debian dla-4865 : bind9 - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4865 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4865-1 [email protected]...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-146333)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146333 advisory. In the Linux kernel, the following vulnerability has been resolved: audit: fix potential use-after-free in auditdelrule auditdelrule destroys e-rule.exe via...

Linux Distros Unpatched Vulnerability : CVE-2026-115388

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wasmtime-wasi-http in Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 does not enforce the wasi:io/streams check-write allowance for...

TencentOS Server 3: ruby:3.3 (TSSA-2026:1214)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1214 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

Rocky Linux 9.6 [TuxCare] Security Update: go-toolset / golang / golang-bin / golang-docs / golang-misc / etc (ALMALINUX9.6:CLSA-2026:1793133822)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793133822 advisory. - On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be update...

Linux Distros Unpatched Vulnerability : CVE-2026-101629

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: InnoDB. Supported versions that are affected are MySQL Server: 9.7.0-9.7.3,...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-146312)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146312 advisory. In the Linux kernel, the following vulnerability has been resolved: tipc: clear sock-sk on the failed-insert path in tipcskcreate When tipcskcreate fails to insert...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-146341)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146341 advisory. In the Linux kernel, the following vulnerability has been resolved: bpf: Disable preemption in bpfeventoutput We received report 1 of kernel crash, which is caused b...

Linux Distros Unpatched Vulnerability : CVE-2026-115586

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - virtualenv is a tool for creating isolated virtual python environments. From 21.14.9 until 21.14.13, the bash bin/activate script can copy an attacker-controlle...

Linux Distros Unpatched Vulnerability : CVE-2026-98998

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: drm/bridge: th1520-dw-hdmi: Fix remove callback This driver stores struct th1520hdmi in...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-146314)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146314 advisory. In the Linux kernel, the following vulnerability has been resolved: net/sched: schcake: drop WARNON1 for malformed packets in ACK filter The schcake ACK filter parse...

RockyLinux 9 : lrzsz (RLSA-2026:89755)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:89755 advisory. lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode CVE-2026-105840 lrzsz: lrzsz: Arbitrary command execution via...

RockyLinux 8 : gcc (RLSA-2026:89830)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:89830 advisory. gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: Denial of Service via use-after-free in binary heap eraseif CVE-2026-102010 gcc: libstdc++ integer overflo...

Linux Distros Unpatched Vulnerability : CVE-2026-98900

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xen/gntalloc: validate grant count before allocation gntallocioctlalloc allocates the grant-id array before checking whether the requested count fits within the...

PLANET WGS-804HPT and WGS-4215 Missing Authentication for Critical Function (CVE-2025-46275)

PLANET WGS-804HPT V2 and WGS-4215-8P2S are missing authentication that could allow an attacker to create an administrator account without knowing any existing credentials. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information...

Linux Distros Unpatched Vulnerability : CVE-2026-101777

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Security: Encryption. Supported versions that are affected are MySQL...

Linux Distros Unpatched Vulnerability : CVE-2026-115919

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. Prior to 1.22.0, RNNShapeInferenceopset1to6 processes malformed RNN...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-146268)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146268 advisory. In the Linux kernel, the following vulnerability has been resolved: mac802154: llsec: reject frames shorter than the authentication tag llsecdodecryptauth computes t...

Rocky Linux 9.6 [TuxCare] Security Update: openssl / openssl-devel / openssl-libs / openssl-perl Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1793092125)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793092125 advisory. - Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-146256)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146256 advisory. In the Linux kernel, the following vulnerability has been resolved: libceph: reject zero bucket types in crushdecode CRUSH bucket type 0 is reserved for devices. The...

Linux Distros Unpatched Vulnerability : CVE-2026-112818

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - git-annex - None Ubuntu Linux - Unknown description CVE-2026-112818 Note that Nessus relies on the presence of the package as reported by the...

Python Library Brotli 1.0.3 < 1.0.10 / 1.1.x < 1.1.1 / 1.2.x < 1.2.1 Out-of-Bounds Write (Brotli2Shell)

The detected version of the Brotli Python package is 1.0.3 or later but prior to 1.0.10, or 1.1.x prior to 1.1.1, or 1.2.x prior to 1.2.1. It is, therefore, affected by an out-of-bounds write vulnerability in the bundled Brotli decoder: - A buffer overflow vulnerability in the Brotli decoder...

Security Update for Microsoft ASP.NET Core (October OOB 2026)

The Microsoft ASP.NET installations on the remote host are missing a security update. It is, therefore, affected by multiple vulnerabilities as referenced in the vendor advisory. - Improper control of generation of code 'code injection' in ASP.NET Core allows an unauthorized attacker to execute...

Security Update for Microsoft .NET Core SDK (October OOB 2026)

The Microsoft .NET Core SDK installations on the remote host are missing a security update. It is, therefore, affected by multiple vulnerabilities as referenced in the vendor advisory. - Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network. CVE-2026-70197 -...

Oracle Linux 10 : brotli (ELSA-2026-90449)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-90449 advisory. 1.1.0-8.0.1 - Fix out-of-bounds write in the Brotli decoder CVE-2026-111497 Tenable has extracted the preceding description block directly from the Oracle Lin...

Python Library brotlicffi 1.0.3 < 1.2.1.0 Out-of-Bounds Write (Brotli2Shell)

The detected version of the brotlicffi Python package is 1.0.3 or later but prior to 1.2.1.0. It is, therefore, affected by an out-of-bounds write vulnerability in the bundled Brotli decoder: - A buffer overflow vulnerability in the Brotli decoder c/dec/decode.c in Google Brotli versions 1.0.3...

SUSE SLES12: openssh8.4 / openssh8.4-clients / openssh8.4-common / etc (SUSE-SU-2026:4907-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4907-1 advisory. - CVE-2026-59995: sftp: a malicious server could change the the location of downloaded files bsc1271044. - CVE-2026-59997: sshd:...

Oracle Linux 8 : freeipmi (ELSA-2026-89754)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-89754 advisory. 1.6.20-1 - Update to 1.6.20, fixes buffer overflows in ipmidetect and ipmi-oem fujitsu CVE number assignment pending. 1.6.19-1 - Update to 1.6.19, fix...

RHEL 9 : compat-openssl11 (RHSA-2026:89736)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:89736 advisory. The OpenSSL toolkit provides support for secure communications between machines. This version of OpenSSL package contains only the librarie...

Linux Distros Unpatched Vulnerability : CVE-2026-116262

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was detected in libimobiledevice up to 1.4.0. The affected element is the function webinspectorreceivewithtimeout of the file src/webinspector.c...

RHEL 8 : xorg-x11-server (RHSA-2026:89747)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:89747 advisory. X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical us...

RHEL 9 : rhc (RHSA-2026:89915)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:89915 advisory. rhc is a client tool and daemon that connects the system to Red Hat hosted services enabling system and subscription management. Security...

Linux Distros Unpatched Vulnerability : CVE-2026-98879

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - isofs: handle setblocksize failures isofs uses bufferheads, which don't handle block size PAGESIZE well. Without this, mounting we will hit the BUGONoffset =...

Linux Distros Unpatched Vulnerability : CVE-2026-98885

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ima: return error early if file xattr cannot be changed During early boot, the filesystem is read-only and any changes to xattrs are not allowed. This fails in...

Linux Distros Unpatched Vulnerability : CVE-2026-98898

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized When DPM is turned off with the amdgpu.dpm=0 module parameter, the thermal work queue...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: php (UTSA-2026-146100)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146100 advisory. PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after bei...

Linux Distros Unpatched Vulnerability : CVE-2026-116141

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick before 7.1.2-33 contains a policy bypass vulnerability in the UHDR decoder that allows attackers to evade image width and height limits because exte...

RHEL 9 : flatpak (RHSA-2026:89850)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:89850 advisory. Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Security Fixes: flatpak: flatpak:...

RockyLinux 8 : container-tools:rhel8 (RLSA-2026:89760)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:89760 advisory. net/http: golang: golang: Denial of Service via crafted HTTP Range headers CVE-2026-78667 crypto/x509: golang: crypto/x509: Man-in-the-middle attacks vi...

Linux Distros Unpatched Vulnerability : CVE-2026-116196

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Rclone before v1.75.2 contains a credential exposure vulnerability in the b2 backend that leaks the live account Authorization token and SSE-C keys on HTTP...

Fedora 46 : libsidplayfp (2026-6ebd8db1af)

The remote Fedora 46 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-6ebd8db1af advisory. Automatic update for libsidplayfp-3.1.2-1.fc46. Changelog Mon Oct 26 2026 Karel Voln - 3.1.2-1 - Update to 3.1.2 rhbz2560385 - Fixes CVE-2026-111148 - possib...

AlmaLinux 9.6 [TuxCare] Security Update: hplip / hplip-common / hplip-libs / libsane-hpaio (ALMALINUX9.6:CLSA-2026:1793015517)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793015517 advisory. - HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components...

Linux Distros Unpatched Vulnerability : CVE-2026-107080

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenJPEG 2.4.0 through 2.5.4, and git master through commit 8314119b, contains an out-of-bounds read and write in opjdwtencodeanddeinterleavev in...

RHEL 9 : freeipmi (RHSA-2026:89753)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:89753 advisory. The freeipmi packages contain an Intelligent Platform Management Interface IPMI remote console and system management software based on the...

Rocky Linux 9.6 [TuxCare] Security Update: hplip / hplip-common / hplip-libs / libsane-hpaio (ALMALINUX9.6:CLSA-2026:1793015517)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793015517 advisory. - HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software componen...