Debian dla-4861 : openjdk-17-dbg - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4861 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4861-1 [email protected]...

Linux Distros Unpatched Vulnerability : CVE-2026-116145

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick before 6.9.13-58 and 7.x before 7.1.2-32 contains a security policy bypass caused by an incomplete fix for the policy bypass reported in...

Linux Distros Unpatched Vulnerability : CVE-2026-116152

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the MAT decoder that fails to release allocated memory in a specific error path. Attackers c...

RHEL 8 : git-lfs (RHSA-2026:89925)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:89925 advisory. Git Large File Storage LFS replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing t...

CentOS Linux 7 [TuxCare] Security Update: flatpak / flatpak-builder / flatpak-devel / flatpak-libs (CENTOS7:CLSA-2026:1792770859)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1792770859 advisory. - A path traversal vulnerability in Flatpak's handling of the export/bin directory during app deployment allows a malicious Flatpak app to cause...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: php (UTSA-2026-146098)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146098 advisory. PHP uses longjmp for out-of-memory OOM errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario...

RHEL 8 : python-lxml (RHSA-2026:90326)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:90326 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic da...

RHEL 8 : gcc (RHSA-2026:89830)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:89830 advisory. The gcc packages provide compilers for C, C++, Java, Fortran, Objective C, and Ada 95 GNU, as well as related support libraries. Security...

Linux Distros Unpatched Vulnerability : CVE-2026-115683

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A race condition in Epiphany allows a malicious website to bypass the TLS/SSL certificate warning page. Epiphany registers the main-world script message handle...

MiracleLinux 9 : dotnet9.0-9.0.122-1.el9_8.ML.1 (AXSA:2026-2151:20)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2151:20 advisory. dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability CVE-2026-58280 dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET...

RHEL 10 : skopeo (RHSA-2026:89761)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:89761 advisory. The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and...

Linux Distros Unpatched Vulnerability : CVE-2026-116189

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums from unsigned bytes preceding the...

Linux Distros Unpatched Vulnerability : CVE-2026-116157

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick before 7.1.2-33 contains a memory leak vulnerability in PerlMagick that fails to free values returned when reading image properties. Attackers can...

CentOS Linux 6 [TuxCare] Security Update: python / python-devel / python-libs / python-test / python-tools / etc (CENTOS6:CLSA-2026:1792810266)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1792810266 advisory. - Use-after-free UAF was possible in the lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile when a memory allocation fails with a...

RHEL 8 : kernel-rt (RHSA-2026:89082)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:89082 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism...

Oracle Linux 9 : freeipmi (ELSA-2026-89753)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-89753 advisory. 1.6.20-1 - Update to 1.6.20, fixes buffer overflows in ipmidetect and ipmi-oem fujitsu CVE number assignment pending. 1.6.19-1 - Update to 1.6.19, fix...

RHEL 9 : delve (RHSA-2026:89888)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:89888 advisory. Delve is a debugger for the Go programming language. The goal of the project is to provide a simple, full featured debugging tool for Go...

RHEL 10 : delve (RHSA-2026:89884)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:89884 advisory. Delve is a debugger for the Go programming language. The goal of the project is to provide a simple, full featured debugging tool for Go...

RHEL 9 : rhc (RHSA-2026:89908)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:89908 advisory. rhc is a client tool and daemon that connects the system to Red Hat hosted services enabling system and subscription management. Security...

AlmaLinux 9.6 [TuxCare] Security Update: go-toolset / golang / golang-bin / golang-docs / golang-misc / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1793028092)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793028092 advisory. - When parsing a Range header containing a large number of small ranges, FileServerFS, ServeContent, and ServeFileFS can consume an...

Oracle Linux 10 : bind (ELSA-2026-90328)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-90328 advisory. - Fix CVE-2026-19662: NOQNAME proof use-after-free could crash recursive resolver. - Prevent assertion failure in dns64 mode with break-dnssec yes...

Linux Distros Unpatched Vulnerability : CVE-2026-110928

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. Note that Nessus relies on the presence of the package as reported by the vendor. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description...

F5 Networks BIG-IP : SFTP vulnerability (K000163738)

The version of F5 Networks BIG-IP installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the K000163738 advisory. sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when sftp server:/path . is...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: brotli (UTSA-2026-146094)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146094 advisory. A buffer overflow vulnerability in the Brotli decoder c/dec/decode.c in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: nodejs (UTSA-2026-146097)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146097 advisory. A buffer overflow vulnerability in the Brotli decoder c/dec/decode.c in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: nodejs (UTSA-2026-146099)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146099 advisory. A buffer overflow vulnerability in the Brotli decoder c/dec/decode.c in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated...

Oracle Linux 9 : brotli (ELSA-2026-500513)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-500513 advisory. 1.0.9-10.0.1 - Fix out-of-bounds write in the Brotli decoder CVE-2026-111497 Tenable has extracted the preceding description block directly from the Oracle...

Oracle Linux 9 : nodejs:24 (ELSA-2026-500518)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-500518 advisory. - Fix out-of-bounds write in bundled Brotli decoder CVE-2026-111497 Tenable has extracted the preceding description block directly from the Oracle Linux...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: nodejs (UTSA-2026-146101)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146101 advisory. A buffer overflow vulnerability in the Brotli decoder c/dec/decode.c in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated...

RHEL 9 : openssh (RHSA-2026:89739)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:89739 advisory. OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files...

Oracle Linux 8 : nodejs:22 (ELSA-2026-500519)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-500519 advisory. - Backport upstream fix for CVE-2026-111497 in the bundled Brotli decoder Tenable has extracted the preceding description block directly from the Oracle Linux...

Oracle Linux 8 : nodejs:24 (ELSA-2026-500520)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-500520 advisory. - Fix out-of-bounds write in bundled Brotli decoder CVE-2026-111497 Tenable has extracted the preceding description block directly from the Oracle Linux...

Linux Distros Unpatched Vulnerability : CVE-2026-99073

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipv4: stop exception dump when nexthop group shrinks Commit 4ce5dc9316de inet: switch inetdumpfib to RCU protection allowed IPv4 FIB dumps to run concurrently...

RHEL 10 : rhc (RHSA-2026:89832)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:89832 advisory. rhc is a client tool and daemon that connects the system to Red Hat hosted services enabling system and subscription management. Security...

MiracleLinux 8 : go-toolset:rhel8 (AXSA:2026-2159:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2159:01 advisory. net/http: golang: golang: Denial of Service via crafted HTTP Range headers CVE-2026-78667 crypto/tls: golang: crypto/tls: Denial of Service via...

MiracleLinux 9 : grafana-pcp-5.1.1-17.el9_8.2 (AXSA:2026-2160:13)

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-2160:13 advisory. crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references CVE-2026-97031 net/http: net/http/internal/http2:...

MiracleLinux 8 : kernel-4.18.0-553.176.1.el8_10 (AXSA:2026-2154:108)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2154:108 advisory. kernel: xfrm: espintcp: do not reuse an in-progress partial send CVE-2026-52935 kernel: USB: serial: ioti: fix heap overflow in getmanufinfo...

RHEL 9 : RHOSO 18.0 os-diff (RHSA-2026:90332)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:90332 advisory. Security Fixes: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates CVE-2026-111943 golang: golang...

Oracle Linux 10 : httpd (ELSA-2026-89860)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-89860 advisory. - Related: RHEL-275253 - httpd: Arbitrary code execution via oversized Host header in modvhostalias CVE-2026-63292 - Resolves: RHEL-280355 - httpd:...

Amazon Linux 2023 : yq (ALAS2023-2026-3257)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3257 advisory. When Trailer headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map,...

Amazon Linux 2023 : runc (ALAS2023-2026-3323)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3323 advisory. Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority CA, the Go's crypto/x509 package is updated to not trust certificates...

Amazon Linux 2023 : openvpn, openvpn-devel (ALAS2023-2026-3226)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3226 advisory. When using the OpenSSL library, we escaped embedded null-bytes in a certificate's subject in x509getsubject, but in extractx509fieldssl, we copied any null-bytes that are contained in the field value...

Amazon Linux 2 : amazon-ecr-credential-helper (ALASECS-2026-146)

The version of amazon-ecr-credential-helper installed on the remote host is prior to 0.12.0-5. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2026-146 advisory. The HTTP/2 server could refund connection-level flow control twice for the same data: Once when a...

Amazon Linux 2023 : mariadb114, mariadb114-backup, mariadb114-client-utils (ALAS2023-2026-3288)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3288 advisory. MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account...

Amazon Linux 2023 : gstreamer1-plugins-good, gstreamer1-plugins-good-gtk (ALAS2023-2026-3276)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3276 advisory. A flaw was found in GStreamer's gst-plugins-good. A heap-based out-of-bounds read of 4 bytes can occur when parsing FLAC audio stream headers embedded in a Matroska or WebM container file. The...

Amazon Linux 2023 : curl, curl-minimal, libcurl (ALAS2023-2026-3267)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3267 advisory. During an upload, curl mishandles HTTP/2 RSTSTREAM received from the server with reason HTTP11REQUIRED or REFUSEDSTREAM leading to a use after free of a struct Curleasy object. CVE-2026-92392 Tenable h...

Amazon Linux 2023 : jackson-databind (ALAS2023-2026-3305)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3305 advisory. jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string...

Amazon Linux 2023 : libreswan (ALAS2023-2026-3253)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3253 advisory. A null pointer dereference flaw was found in Libreswan's PKCS7 certificate payload handling. When processing a crafted IKEv2 IKEAUTH packet containing a PKCS7 bundle with a certificate...

Amazon Linux 2023 : edk2-aarch64, edk2-ovmf, edk2-shell-aa64 (ALAS2023-2026-3227)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3227 advisory. Issue summary: A certificate with many nameRelativeToCRLIssuer CRLdistribution points causes disproportionate heap growth when OpenSSL cachesX.509 extensions. Impact summary: Receiving a craft...

Amazon Linux 2023 : ecs-init (ALAS2023-2026-3321)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3321 advisory. When Trailer headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each ent...