Amazon Linux 2023 : perl-Date-Manip (ALAS2023-2026-2050)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2050 advisory. Date::Manip versions through 6.99 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check. The parse regexes capture year, month and day with th...

AlmaLinux 10 : libXfont2 (ALSA-2026:55448)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:55448 advisory. libxfont2: Font Server Client encoding Out-Of-Bounds Read/Write CVE-2026-59679 libxfonts2: libXfont2: Privilege Escalation via Heap Buffer Overflow in...

RHEL 10 : grafana-pcp (RHSA-2026:56143)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:56143 advisory. The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-101966)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101966 advisory. In the Linux kernel, the following vulnerability has been resolved: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes Reject invalid...

Linux Distros Unpatched Vulnerability : CVE-2026-72251

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfilter: nfnatsip: reload possible stale data pointer quoting sashiko: ------------------------------------------------------------------------ .. noticed a...

Linux Distros Unpatched Vulnerability : CVE-2026-72372

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - afs: Fix lack of locking around modifications of net-cellsdynino Fix the lack of locking around modifications of net-cellsdynino by taking net-cellslock...

Linux Distros Unpatched Vulnerability : CVE-2026-72278

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: arm64: nv: Re-translate VNCR before injecting abort KVM faults in the VNCR page with FOLLWRITE whenever the guest aborts for a write, similar to how a...

Linux Distros Unpatched Vulnerability : CVE-2026-72354

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid stale runlist element dereference in MFT writeback ntfswritemftblock maps each...

AlmaLinux 8 : libXfont2 (ALSA-2026:55446)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:55446 advisory. libxfont2: Font Server Client encoding Out-Of-Bounds Read/Write CVE-2026-59679 libxfonts2: libXfont2: Privilege Escalation via Heap Buffer Overflow in Fo...

Amazon Linux 2023 : wget (ALAS2023-2026-2047)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2047 advisory. GNU Wget through 1.25.0, fixed in commit 37a40fc, contains a heap buffer underread vulnerability in the cleanmetalinkstring function within src/metalink.c that allows a malicious server to trigger memo...

Linux Distros Unpatched Vulnerability : CVE-2026-72011

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - s390/diag: Add missing arrayindexnospec call to memtopgetpagecount 'level' is user space controlled and used to read from an array. Add the missing...

Linux Distros Unpatched Vulnerability : CVE-2026-75007

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the LDAP search filter was subject to injection via unescaped %u/%fu/%d substitution, which may lead ...

Linux Distros Unpatched Vulnerability : CVE-2026-72264

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fbdev: tridentfb: fix potential memory leak in tridentpciprobe In tridentpciprobe, the memory allocated for modelist using fbvideomodetomodelist is not freed in...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-101974)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101974 advisory. In the Linux kernel, the following vulnerability has been resolved: usbnet: gl620a: fix out-of-bounds read in genelinkrxfixup genelinkrxfixup splits an aggregated R...

Linux Distros Unpatched Vulnerability : CVE-2026-72169

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - kho: make sure scratch size is always aligned by CMAMINALIGNMENTBYTES When using scratchscale, the scratch sizes are rounded up to CMAMINALIGNMENTBYTES since th...

AlmaLinux 8 : haproxy (ALSA-2026:55859)

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:55859 advisory. haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions CVE-2026-55204 Tenable has extracted the preceding description block directly from the...

Mozilla Firefox ESR < 140.14

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 140.14. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-76 advisory. - Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 154, Firefox...

RHEL 10 : haproxy (RHSA-2026:55679)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:55679 advisory. The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications. Security Fixes:...

Linux Distros Unpatched Vulnerability : CVE-2026-74402

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - crypto: atmel-sha204a - fix blocking and non-blocking rng logic The blocking and non-blocking paths were failing to provide valid entropy due to improper buffer...

Linux Distros Unpatched Vulnerability : CVE-2026-72133

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - spi: uniphier: Fix completion initialization order before devmrequestirq The driver calls devmrequestirq before initializing the completion used by the interrup...

RHEL 8 : nghttp2 (RHSA-2026:55804)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:55804 advisory. libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 HTTP/2 protocol in C. Security Fixes: nghttp2: nghttp2: HTTP...

AlmaLinux 9 : unbound (ALSA-2026:55841)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:55841 advisory. unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes CVE-2026-44690 unbound: Unbound: Denial of Service...

Linux Distros Unpatched Vulnerability : CVE-2026-72343

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation mlx5ehvvhcastatscreate is called from mlx5enicenable, before mlx5eopen. At that point priv-statsnch is...

Amazon Linux 2023 : nodejs22, nodejs22-devel, nodejs22-full-i18n (ALAS2023-2026-2060)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2060 advisory. brace-expansion through 5.0.6 is vulnerable to denial of service. The expand function exhibits exponential-time complexity in the number of consecutive non-expanding '' brace groups. An attack...

Oracle Linux 9 : nodejs:24 (ELSA-2026-55603)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-55603 advisory. - Update brace-expansion from 5.0.6 to 5.0.9 to address CVE-2026-13149 memory exhaustion via deeply chained brace groups. as well as CVE-2026-14257...

Amazon Linux 2023 : javapackages-bootstrap (ALAS2023-2026-2055)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2055 advisory. Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core 5.4.2 and earlier, 5.5-beta1 and earlier allows an remote attacker to cause a denial of...

MiracleLinux 9 : [security - high] nodejs:22 (AXSA:2026-1561:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1561:01 advisory. brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity CVE-2026-13149 tar: Node-tar: Denial of Service via malformed...

Amazon Linux 2023 : nodejs24, nodejs24-devel, nodejs24-full-i18n (ALAS2023-2026-2059)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2059 advisory. brace-expansion through 5.0.6 is vulnerable to denial of service. The expand function exhibits exponential-time complexity in the number of consecutive non-expanding '' brace groups. An attack...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2026-129 (ALASKERNEL-5.10-2026-129)

The version of kernel installed on the remote host is prior to 5.10.262-262.1063. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2026-129 advisory. In the Linux kernel, the following vulnerability has been resolved: net: Drop the lock in...

Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-2057)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2057 advisory. In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Clear Present bit before tearing down context entry CVE-2026-45944 In the Linux kernel, the following...

Debian dla-4745 : ata-modules-6.12.100+deb12-armmp-di - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4745 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4745-1 [email protected]...

Linux Distros Unpatched Vulnerability : CVE-2026-72241

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - leds: uleds: Fix potential buffer overread The name string supplied by userspace is not guaranteed to be null-terminated, so using strchr on it might result in ...

MiracleLinux 9 : kernel-5.14.0-687.22.1.el9_8 (AXSA:2026-1543:61)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1543:61 advisory. kernel: fs/smb/client: fix out-of-bounds read in cifssanitizeprepath CVE-2026-43112 kernel: net: mana: Fix double destroyworkqueue on service rescan...

Amazon Linux 2023 : containerd, containerd-stress (ALAS2023-2026-2063)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2063 advisory. A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes. CVE-2026-56852 Tenable has extracted the preceding description block directly from the tested product security...

Amazon Linux 2 : docker, --advisory ALAS2DOCKER-2026-138 (ALASDOCKER-2026-138)

The version of docker installed on the remote host is prior to 25.0.16-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2DOCKER-2026-138 advisory. A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes. CVE-2026-56852 Tenable has extract...

Amazon Linux 2 : containerd, --advisory ALAS2NITRO-ENCLAVES-2026-117 (ALASNITRO-ENCLAVES-2026-117)

The version of containerd installed on the remote host is prior to 2.1.9-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2NITRO-ENCLAVES-2026-117 advisory. A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes. CVE-2026-56852 Tenable h...

Linux Distros Unpatched Vulnerability : CVE-2026-74285

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: net: Stop leased rxq before uninstalling its memory provider netifrxqcleanupunlease tears...

Photon OS 5.0: Postgresql16 PHSA-2026-5.0-92-0959

An update of the postgresql16 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-92-0959. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Linux Distros Unpatched Vulnerability : CVE-2026-63347

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - suricata-update - None Ubuntu Linux - Unknown description CVE-2026-63347 Note that Nessus relies on the presence of the package as reported by th...

Linux Distros Unpatched Vulnerability : CVE-2026-72453

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - regcache: Do not overwrite error code when finalizing cache after error During regcache initialization, if an error occurs in the cacheops-populate callback, an...

Linux Distros Unpatched Vulnerability : CVE-2026-72381

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ksmbd: fix use-after-free of fp-owner.name in durable handle owner check Two concurrent SMB2 durable reconnects DH2C/DHnC on the same persistentid race the...

Linux Distros Unpatched Vulnerability : CVE-2026-72049

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ieee802154: admin-gate legacy LLSEC dump operations In net/ieee802154/netlink.c, the legacy IEEE802154NL family ops table builds the LLSEC dump entries...

Linux Distros Unpatched Vulnerability : CVE-2026-68456

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect ueagle-atm uses the asynchronous requestfirmwarenowait in .probe, but does not wait for its...

Linux Distros Unpatched Vulnerability : CVE-2026-15803

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Eclipse RDF4J, several XML parser entry points do not fully restrict XML External Entity XXE processing when parsing untrusted XML-based RDF data or query...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-101999)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101999 advisory. In the Linux kernel, the following vulnerability has been resolved: tracing: Prevent out-of-bounds read in glob matching String event fields are not necessarily...

RockyLinux 10 : .NET 10.0 (RLSA-2026:55858)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:55858 advisory. .NET: .NET Core: .NET Security Feature Bypass Vulnerability CVE-2026-62899 .NET: .NET Information Disclosure Vulnerability CVE-2026-62900 .NET: .NET...

Linux Distros Unpatched Vulnerability : CVE-2026-72171

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mtd: slram: remove failed entries from the device list registerdevice links a new slrammtdlist entry before allocating all of the state needed by the entry. If ...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-101969)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101969 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header before using ethhdr ip6teui64, xtmac, the bitmap:ip,mac,...

Linux Distros Unpatched Vulnerability : CVE-2026-72425

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ice: fix FDIR CTRL VSI resource leak in iceresetallvfs Resetting all VFs causes resource leak on VFs with FDIR filters enabled as CTRL VSIs are only invalidated...

Linux Distros Unpatched Vulnerability : CVE-2026-61666

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.8.2, WebSocket::Driver.server passes a malformed Host header to URI.parse in...