CentOS Linux 8.4 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1792979607)

"The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1792979607 advisory. - In the Linux kernel, the following vulnerability has been resolved: mrp: introduce active flags to prevent UAF when applicant...

CentOS Linux 8.5 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1792979985)

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1792979985 advisory. - In the Linux kernel, the following vulnerability has been resolved: net: bridge: fix vlan tunnel dst refcnt when egressing The...

CentOS Linux 7 [TuxCare] Security Update: xorg-x11-server-Xdmx / xorg-x11-server-Xephyr / etc (CENTOS7:CLSA-2026:1792772509)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1792772509 advisory. - xorg-x11-server: xwayland: xorg-x11-server: Arbitrary code execution via double-free in XKB geometry handling CVE-2026-88812 Note that Nessus h...

Debian dla-4859 : libcrypto3-udeb - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4859 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4859-1 [email protected]...

RHEL 9 : bind (RHSA-2026:89745)

"The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:89745 advisory. The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named %NASLMINLEVEL...

AlmaLinux 8 : firefox (ALSA-2026:76850)

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:76850 advisory. firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics component CVE-2026-92035 firefox: thunderbird: Use-after-free i...

CentOS Linux 7 [TuxCare] Security Update: freerdp / freerdp-devel / freerdp-libs / libwinpr / libwinpr-devel Multiple Vulnerabilities (CENTOS7:CLSA-2026:1792805176)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1792805176 advisory. - FreeRDP from 2.0.0 before 3.32.0 contains an insecure permission vulnerability in winpr-makecert that creates unencrypted private keys...

Linux Distros Unpatched Vulnerability : CVE-2026-98886

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/gma500: return errors from Oaktrail HDMI I2C reads xferread waits for the HDMI I2C transaction to reach I2CTRANSACTIONDONE, but it ignores both timeout and...

Palo Alto Networks PAN-OS 11.2.x / 12.1.x / 12.2.x Vulnerability

The version of Palo Alto Networks PAN-OS running on the remote host is a vulnerable version of 11.2.x, 12.1.x, or 12.2.x. It is, therefore, affected by a vulnerability. Palo Alto Networks is aware of the vulnerability in Brotli: CVE-2026-111497. A buffer overflow vulnerability in the Brotli decod...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: nodejs (UTSA-2026-146095)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146095 advisory. A buffer overflow vulnerability in the Brotli decoder c/dec/decode.c in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated...

Oracle Linux 9 : nodejs:22 (ELSA-2026-500517)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-500517 advisory. - Fix out-of-bounds write in bundled Brotli decoder CVE-2026-111497 Tenable has extracted the preceding description block directly from the Oracle Linux...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: nodejs (UTSA-2026-144011)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-144011 advisory. A buffer overflow vulnerability in the Brotli decoder c/dec/decode.c in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated...

RHEL 8 : kernel-rt (RHSA-2026:89814)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:89814 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements...

Fedora 45 : brotli / perl-Alien-Brotli (2026-6a639d1308)

The remote Fedora 45 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-6a639d1308 advisory. Fixes CVE-2026-111497 in new upstream release of brotli-1.2.1 Tenable has extracted the preceding description block directly from the Fedora security advisor...

Oracle Linux 8 : brotli (ELSA-2026-500512)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-500512 advisory. 1.0.6-4.0.1 - Fix CVE-2026-111497: reject invalid Brotli block switches Tenable has extracted the preceding description block directly from the Oracle Linux...

Oracle Linux 10 : nodejs24 (ELSA-2026-500515)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-500515 advisory. - Fix out-of-bounds write in bundled Brotli decoder CVE-2026-111497 Tenable has extracted the preceding description block directly from the Oracle Linux...

RHEL 10 : grafana (RHSA-2026:89751)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:89751 advisory. Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: net/http:...

Rocky Linux 9.6 [TuxCare] Security Update: go-toolset / golang / golang-bin / golang-docs / golang-misc / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1793028092)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793028092 advisory. - When parsing a Range header containing a large number of small ranges, FileServerFS, ServeContent, and ServeFileFS can consume a...

RHEL 9 : Red Hat OpenStack Platform 17.1 security advisory (Important) (RHSA-2026:90329)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:90329 advisory. Red Hat OpenStack Platform provides the facilities for building, deploying and monitoring a private or public infrastructure-as-a-service...

Oracle Linux 9 : grafana (ELSA-2026-89744)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-89744 advisory. - CVE-2026-17183 grafana: Grafana: Information disclosure vulnerability in Unified Alerting - Resolves RHEL-253159: CVE-2026-15815 - CVE-2026-42504...

RHEL 9 : rhc (RHSA-2026:89914)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:89914 advisory. rhc is a client tool and daemon that connects the system to Red Hat hosted services enabling system and subscription management. Security...

RHEL 9 : rhc (RHSA-2026:89915)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:89915 advisory. rhc is a client tool and daemon that connects the system to Red Hat hosted services enabling system and subscription management. Security...

RHEL 9 : rhc (RHSA-2026:89740)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:89740 advisory. rhc is a client tool and daemon that connects the system to Red Hat hosted services enabling system and subscription management. Security...

Oracle Linux 8 : perl:5.32 (ELSA-2026-85917)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-85917 advisory. - Fixes: CVE-2026-13221 - Don't create a trie that would overflow - Fix CVE-2026-9538: Denial of Service via crafted tar header with large entry size Resolves:...

Linux Distros Unpatched Vulnerability : CVE-2026-116191

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by sending an...

Oracle Linux 9 : flatpak (ELSA-2026-89850)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-89850 advisory. - Use fd-relative operations for files/etc during runtime deploy CVE-2026-97024 Resolves: RHEL-272190 Tenable has extracted the preceding description...

Linux Distros Unpatched Vulnerability : CVE-2026-116192

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rclone from 1.37 before 1.74.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to redirect http and netstorage backen...

RHEL 9 : compat-openssl11 (RHSA-2026:89738)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:89738 advisory. The OpenSSL toolkit provides support for secure communications between machines. This version of OpenSSL package contains only the librarie...

Linux Distros Unpatched Vulnerability : CVE-2026-99095

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/vc4: drain the hangcheck timer and works on V3D unbind Nothing stops the hangcheck timer that submitted jobs arm, or the jobdonework that the render-done...

Linux Distros Unpatched Vulnerability : CVE-2026-98881

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: bridge: remove stale rcubarrier in brmulticastdevdel This rcubarrier came from a time callrcu calls were used in net/bridge/brmulticast.c. Now kfreercu is...

RHEL 8 : container-tools:rhel8 (RHSA-2026:89760)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:89760 advisory. The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fixes: net/http:...

CentOS Linux 7 [TuxCare] Security Update: rpm / rpm-apidocs / rpm-build / rpm-build-libs / rpm-cron / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1792689093)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1792689093 advisory. - A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec function in...

Linux Distros Unpatched Vulnerability : CVE-2026-98876

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - host1x: bus: Fix missing ops null check in error teardown In host1xdeviceinit, the error teardown paths do not check client-ops before dereferencing it, unlike...

Linux Distros Unpatched Vulnerability : CVE-2026-115823

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections. For a HEAD request Starman...

macOS 26.x < 26.7.2 Multiple Vulnerabilities (149522)

The remote host is running a version of macOS / Mac OS X that is 26.x prior to 26.7.2. It is, therefore, affected by multiple vulnerabilities: - This issue was addressed with improved permissions checking. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequoi...

RHEL 9 : jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base (RHSA-2026:89734)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:89734 advisory. Core part of Jackson that defines Streaming API as well as basic shared abstractions. Security Fixes:...

Amazon Linux Unpatched Vulnerability : CVE-2026-109618

The remote Amazon Linux host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PHP uses longjmp for out-of-memory OOM errors to exit the current context and abort handling of the request. Some contexts may not properly account for...

Linux Distros Unpatched Vulnerability : CVE-2026-99091

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: MGMT: Fix status of pending commands flushed on power off cmdcompletersp receives a struct cmdlookup and, for a pending command that has no cmdcomple...

CentOS Linux 7 [TuxCare] Security Update: dovecot / dovecot-devel / dovecot-mysql / dovecot-pgsql / etc (CENTOS7:CLSA-2026:1792764059)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1792764059 advisory. - An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing cod...

Oracle Linux 10 : kernel (ELSA-2026-88477)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-88477 advisory. - drm/amdgpu: Bound GPIO I2C table entry count from VBIOS Anusha Srivatsa RHEL-278280 CVE-2026-97493 - drm/amdkfd: Add TLB flush after MES queue...

CentOS Linux 6 [TuxCare] Security Update: libarchive / libarchive-devel Multiple Vulnerabilities (CENTOS6:CLSA-2026:1792818341)

The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1792818341 advisory. - An improper link resolution flaw while extracting an archive can lead to changing the access control list ACL of the target of the lin...

Amazon Corretto Java 11.x < 11.0.33.0.10 Vulnerability

The version of Amazon Corretto installed on the remote host is 11 prior to 11.0.33.0.10. It is, therefore, affected by a vulnerability as referenced in the corretto-11-2026-Oct-24 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-report...

Oracle Linux 10 : freeipmi (ELSA-2026-89905)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-89905 advisory. 1.6.20-1 - Update to 1.6.20, fixes buffer overflows in ipmidetect and ipmi-oem fujitsu CVE number assignment pending. 1.6.19-1 - Update to 1.6.19,...

Linux Distros Unpatched Vulnerability : CVE-2026-116154

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in its XML parsing code, where allocated memory is not released when parsing reaches...

CentOS Linux 6 [TuxCare] Security Update: rsync Multiple Vulnerabilities (CENTOS6:CLSA-2026:1792767553)

The CentOS Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1792767553 advisory. - rsync before 3.5.0 contains a time-of-check to time-of-use TOCTOU race condition vulnerability in the rrsync restricted shell wrapper...

CentOS Linux 7 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-filesystem / nginx-mod-devel / etc (CENTOS7:CLSA-2026:1792768772)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1792768772 advisory. - NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpssimodule module. This vulnerability may exist when the Server-Side Include...

RHEL 10 : freeipmi (RHSA-2026:89905)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:89905 advisory. The freeipmi packages contain an Intelligent Platform Management Interface IPMI remote console and system management software based on the...

Linux Distros Unpatched Vulnerability : CVE-2026-116053

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A weakness has been identified in dbcli mycli up to 2.29.4/2.30.1. The impacted element is the function sourcespecialcommandissafe of the file...

RHEL 9 : sudo (RHSA-2026:90287)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:90287 advisory. The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged...

Fedora 44 : nix (2026-d9fe9e0ac3)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-d9fe9e0ac3 advisory. - Update to 2.35: https://nix.dev/manual/nix/2.35/release-notes/rl-2.35.html Version 2.35.3 addresses: - CVE-2026-110450 High,...