Linux Distros Unpatched Vulnerability : CVE-2026-91961

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.31.0 contains a denial-of-service vulnerability in the URBDRC control-transfer request path that fails to validate OutputBufferSize before...

Oracle Linux 8 : ELSA-2026-67266-0: / libkcapi (ELSA-2026-672660)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-672660 advisory. - CVE-2026-71226: Fix memory corruption via uncanceled AIO requests on error in libkcapi's one-shot AIO path Resolves: RHEL-224809 - CVE-2026-71227:...

RHEL 9 : rsyslog (RHSA-2026:67583)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:67583 advisory. The rsyslog packages provide an enhanced, multi-threaded syslog daemon. It supports MySQL, syslog/TCP, RFC 3195, permitted sender lists, filtering o...

Debian dsa-6499 : libcjose-dev - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6499 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6499-1 [email protected] https://www.debian.org/securit...

Linux Distros Unpatched Vulnerability : CVE-2026-91990

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Tornado before 6.5.8 contains a memory amplification vulnerability in parsemultipartformdata that splits multipart data before validating the maxparts limit...

Linux Distros Unpatched Vulnerability : CVE-2026-55073

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - WeasyPrint helps web developers to create PDF documents. Prior to 70.0, server-side applications that configure a restrictive urlfetcher and pass...

AlmaLinux 9 : rust (ALSA-2026:67285)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:67285 advisory. libgit2: libgit2: Denial of Service due to heap out-of-bounds read from malicious Git server CVE-2026-53587 Tenable has extracted the preceding description block...

Fedora 44 : ruby (2026-da06bdeb38)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-da06bdeb38 advisory. This rpm updates included resolv gem to 0.7.2 to resolve CVE security issues. Tenable has extracted the preceding description block directly from th...

Fedora 44 : rubygems (2026-2857104379)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-2857104379 advisory. Update rubygems to 4.0.20. Additionally, several security issues were found in resolv gem bundled in rubygems. This update resolves these issues by...

MiracleLinux 9 : apr-util-1.6.1-23.el9_8.1 (AXSA:2026-1836:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1836:01 advisory. apr-util: Apache Portable Runtime Utility: Heap buffer overflow in redis client CVE-2026-34501 apr-util: Apache Portable Runtime Utility: Informatio...

Linux Distros Unpatched Vulnerability : CVE-2026-91786

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in GNOME Shell. When processing icons from a remote search provider via D-Bus, the system fails to validate the icon's declared dimensions...

RHCOS 4 : OpenShift Container Platform 4.20.38 (RHSA-2026:66375)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:66375 advisory. - encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 - golang: Go...

Oracle Linux 9 : ELSA-2026-67265-0: / libkcapi (ELSA-2026-672650)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-672650 advisory. - CVE-2026-71226: Fix memory corruption via uncanceled AIO requests on error in libkcapi's one-shot AIO path Resolves: RHEL-224815 - CVE-2026-71227:...

Fedora 43 : perl-DBI (2026-a4674c5df6)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a4674c5df6 advisory. 1.653 Fix test for 32bit-perl Fix arbitrary module and file loading via dbmtype/dbmmldbm CVE-2026-78030 Tighten symlink outside of fdir CVE-2026-153...

Linux Distros Unpatched Vulnerability : CVE-2026-91959

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.31.0 contains a buffer over-read vulnerability in the rtsreadresult function within the RPC gateway transport parser. Attackers can send a...

Linux Distros Unpatched Vulnerability : CVE-2026-91986

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gitoxide gix-transport before 0.59.2 fails to filter control characters in git-daemon connect requests, allowing attackers to inject NUL/CR/LF bytes via crafted...

AlmaLinux 9 : nginx:1.24 (ALSA-2026:67308)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:67308 advisory. nginx: NGINX: Arbitrary code execution via crafted HTTP requests CVE-2026-42533 Tenable has extracted the preceding description block directly from the AlmaLinux...

AlmaLinux 8 : nginx:1.24 (ALSA-2026:67315)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:67315 advisory. nginx: NGINX: Arbitrary code execution via crafted HTTP requests CVE-2026-42533 Tenable has extracted the preceding description block directly from the AlmaLinux...

Mozilla Firefox < 156.0

The version of Firefox installed on the remote Windows host is prior to 156.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-90 advisory. - Privilege escalation in the Memory component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3...

Mozilla Firefox ESR < 153.3

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 153.3. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-93 advisory. - Privilege escalation in the Enterprise Policies component. This vulnerability was fixed in Firefox 156 a...

MiracleLinux 9 : freerdp-2.11.7-7.el9_8.7 (AXSA:2026-1843:29)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1843:29 advisory. FreeRDP: FreeRDP: Remote code execution or client crash via malicious TS Gateway CVE-2026-55193 Tenable has extracted the preceding description block directl...

SUSE SLES15 Security Update : azure-storage-azcopy (SUSE-SU-2026:4125-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4125-1 advisory. - CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via...

Linux Distros Unpatched Vulnerability : CVE-2026-90828

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A security flaw has been discovered in GNU Binutils 2.47. This vulnerability affects the function elforphancompatible of the file ld/ldelf.c of the component EL...

Linux Distros Unpatched Vulnerability : CVE-2026-90686

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was found in GPAC up to f1219cde. This affects the function gfbtreport of the file scenemanager/loaderbt.c of the component MP4Box. The...

Linux Distros Unpatched Vulnerability : CVE-2026-90711

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions...

Oracle Linux 9 : ELSA-2026-67133-0: / firefox (ELSA-2026-671330)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-671330 advisory. 140.15.0-1.0.1 - Fix firefox-oracle-default-prefs.js for new nss Orabug: 37079773 - Add firefox-oracle-default-prefs.js and remove the corresponding...

RockyLinux 9 : openssl (RLSA-2026:67165)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:67165 advisory. openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server CVE-2026-14456 openssl: QUIC server may trigger double free when processi...

Linux Distros Unpatched Vulnerability : CVE-2026-90685

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability has been found in GPAC up to f1219cde. Affected by this issue is the function lsrexeccommandlist of the file laser/lsrdec.c of the component...

SUSE SLED15: libzypp / libzypp-devel / zypper / zypper-log / etc (SUSE-SU-2026:4129-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4129-1 advisory. Security issue fixed: - invalidating legacy libzypp unsigned-repository cache state LIBZYPP-LEGACY-CACHE-01 bsc1274625....

Fedora 45 : environment-modules (2026-972718725c)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-972718725c advisory. Update to 5.6.2 fix CVE-2026-85013 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

Linux Distros Unpatched Vulnerability : CVE-2026-90793

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability has been found in GPAC up to f1219cde. Impacted is the function gfnodegetname of the file scenegraph/basescenegraph.c of the component MP4Box...

SUSE SLED15 / SLES15 Security Update : opensc (SUSE-SU-2026:4123-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4123-1 advisory. This update for opensc fixes the following issue: - CVE-2026-40510: stack buffer overflow in pivprocesshistory allows...

Fedora 44 : python-configargparse (2026-e3b2220f12)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-e3b2220f12 advisory. Update to 1.7.7. Version 1.7.6 is a security fix for GHSA-6m27-337c-jcgf. Config file or environment variable can trigger writing out a config file,...

Fedora 43 : perl-Data-Entropy (2026-8924ee53fe)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-8924ee53fe advisory. Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP. This update fixes that issue CVE-2026-18536. Tenable has extracted...

Google Chrome < 153.0.8010.47 Multiple Vulnerabilities

The version of Google Chrome installed on the remote macOS host is prior to 153.0.8010.47. It is, therefore, affected by multiple vulnerabilities as referenced in the 202609stable-channel-update-for-desktop0541751186 advisory. - Use after free in Workers in Google Chrome prior to 153.0.8010.47...

RockyLinux 9 : libkcapi (RLSA-2026:67265)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:67265 advisory. libkcapi: IV reuse in libkcapi one-shot symmetric cipher chunking causes cipher state reset across chunk boundaries CVE-2026-71225 libkcapi: Memory...

Linux Distros Unpatched Vulnerability : CVE-2026-90611

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was determined in GPAC up to f1219cde. This impacts the function xmtparseelement of the file scenemanager/loaderxmt.c of the component MP4Box...

RHEL 10 : .NET 8.0 (RHSA-2026:67525)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:67525 advisory. .NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly...

Ubuntu 24.04 LTS / 26.04 LTS / Pro Realtime 24.04 LTS : libinput vulnerability (USN-8753-1)

The remote Ubuntu 24.04 LTS / 26.04 LTS / Pro Realtime 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8753-1 advisory. It was discovered that libinput did not properly escape device properties. A local attacker could possibly use this issue to...

Linux Distros Unpatched Vulnerability : CVE-2026-90612

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was identified in GPAC up to f1219cde. Affected is the function gfsmdumpcommandlist of the file scenemanager/scenedump.c of the component MP4Box...

RHEL 9 : firewalld (RHSA-2026:67585)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:67585 advisory. firewalld is a firewall service daemon that provides a dynamic customizable firewall with a D-Bus interface. Security Fixes: firewalld: firewalld:...

Fedora 43 : perl-Dancer2 (2026-d0bededb87)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-d0bededb87 advisory. Dancer2 gnrates sessions id from low-entropy sources if Crypt::URandom and Math::Random::ISAAC::XS are not present. With this update, they are always there...

RockyLinux 10 : python-tornado (RLSA-2026:67147)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:67147 advisory. tornado: Tornado: Information disclosure via improper handling of credentials during HTTP redirects CVE-2026-49853 tornado: Tornado: Denial of Service...

Linux Distros Unpatched Vulnerability : CVE-2026-90683

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was detected in GPAC up to f1219cde. Affected is the function gfnodeunregister of the file scenegraph/basescenegraph.c of the component MP4Box...

SUSE SLED15 / SLES15 Security Update : python-Authlib (SUSE-SU-2026:4111-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4111-1 advisory. This update for python-Authlib fixes the following issue: - CVE-2026-41479: crafted authorization requests with...

Linux Distros Unpatched Vulnerability : CVE-2026-91952

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP versions before 3.31.0 contain an infinite-loop denial of service in the pooldecoderect function when decoding AVC444 metablocks with more region...

TrueConf Server < 5.3.9.10013 / 5.4.9.10018 / 5.5.5.10010 Multiple Vulnerabilities

The version of TrueConf Server installed on the remote host is prior to 5.3.9.10013, 5.4.9.10018, or 5.5.5.10010. It is, therefore, affected by multiple vulnerabilities: - A remote unauthenticated attacker connecting to TrueConf Server over 4307/TCP can invoke an undocumented critical function an...

RockyLinux 9 : python-tornado (RLSA-2026:67146)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:67146 advisory. tornado: Tornado: Information disclosure via improper handling of credentials during HTTP redirects CVE-2026-49853 tornado: Tornado: Denial of Service v...

Linux Distros Unpatched Vulnerability : CVE-2026-91947

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP server versions before 3.31.0 contain a use-after-free vulnerability in the DRDYNVC parser that dereferences a channel pointer after releasing the...

SUSE SLES12: java-1_8_0-ibm / java-1_8_0-ibm-alsa / java-1_8_0-ibm-devel / etc (SUSE-SU-2026:4107-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4107-1 advisory. Update to Java 8.0 Service Refresh 8 Fix Pack 71 bsc1277833: - CVE-2026-8400: flaw in the ORB component may allow a malicious IIOP...