Amazon Linux 2023 : libXtst, libXtst-devel (ALAS2023-2026-3259)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3259 advisory. An out-of-bounds read in libXtst's RECORD reply parser in libXtst before 1.2.6 could be used by malicious X servers to crash attached X clients. CVE-2026-94286 Tenable has extracted the preceding...

Linux Distros Unpatched Vulnerability : CVE-2026-116137

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - adm-zip through 0.6.1 contains a duplicate-entry validation bypass that allows attackers to evade the readEntries check by using canonically equivalent entry...

Amazon Linux 2023 : python3.13-virtualenv (ALAS2023-2026-3296)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3296 advisory. virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, downloadwheel accepts pip and setuptools seed wheels fetched for periodic updates or the --download...

CentOS Linux 8 [TuxCare] Security Update: openssh / openssh-askpass / openssh-cavs / openssh-clients / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1792932827)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1792932827 advisory. - In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication...

Amazon Linux 2023 : mariadb123, mariadb123-backup, mariadb123-client-utils (ALAS2023-2026-3311)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3311 advisory. A flaw was found in MariaDB. An authenticated user with permission to use the CONNECT storage engine can exploit an incorrect boundary check when handling DOS table types to write beyond the...

Rocky Linux 9.2 [CIQ] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc Multiple Vulnerabilities (ciqsa-2026_1719)

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261719 advisory. This advisory aggregates security fixes for the php SRPM in CIQ LTS 9.2. It addresses 2 CVEs: CVE-2026-109619, CVE-2026-109618. Tenable has extracted the...

Amazon Linux 2023 : tigervnc, tigervnc-icons, tigervnc-license (ALAS2023-2026-3262)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3262 advisory. CheckSetDoodad in xkb/xkb.c frees doodad-text.text on error but doesnot NULL the pointer. When the error path continues, XkbClearDoodad iscalled during cleanup and frees the same pointer again...

Amazon Linux 2023 : runfinch-finch (ALAS2023-2026-3264)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3264 advisory. When Trailer headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map,...

Amazon Linux 2023 : python3.11, python3.11-devel, python3.11-idle (ALAS2023-2026-3231)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3231 advisory. When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion...

Amazon Linux 2023 : python3-jwt, python3-jwt+crypto (ALAS2023-2026-3298)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3298 advisory. A flaw was found in PyJWT. A remote attacker can trigger a Denial of Service DoS through outbound request amplification by submitting tokens containing unknown key identifiers. Because the...

Amazon Linux 2023 : nerdctl (ALAS2023-2026-3274)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3274 advisory. Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global...

Amazon Linux 2023 : nginx-mod-njs (ALAS2023-2026-3300)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3300 advisory. DescriptionNGINX JavaScript njs has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the built-in njs and...

Amazon Linux 2023 : nspr, nspr-devel, nss (ALAS2023-2026-3242)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3242 advisory. Incorrect boundary conditions in the Libraries component in NSS. This vulnerability was fixed in Firefox 152 and Thunderbird 152. CVE-2026-12318 Incorrect boundary conditions, integer overflow...

Amazon Linux 2023 : java-21-amazon-corretto, java-21-amazon-corretto-devel, java-21-amazon-corretto-headless (ALAS2023-2026-3319)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3319 advisory. Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was distributed to clients via RemoteSettings the same day. This update contains the updat...

Amazon Linux 2023 : nodejs22, nodejs22-devel, nodejs22-full-i18n (ALAS2023-2026-3328)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3328 advisory. A vulnerability in Node.js HTTP Agent handling allows a keep-alive socket to process a response that was written before the corresponding request was sent. This may cause incorrect response...

Amazon Linux 2023 : ca-certificates (ALAS2023-2026-3306)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3306 advisory. Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL...

Amazon Linux 2023 : cifs-utils, cifs-utils-devel, cifs-utils-info (ALAS2023-2026-3291)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3291 advisory. A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a Common Internet File System CIFS share using a user-...

Amazon Linux 2023 : golang, golang-bin, golang-misc (ALAS2023-2026-3327)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3327 advisory. Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority CA, the Go's crypto/x509 package is updated to not trust certificates issued by th...

Fedora 43 : dotnet8.0 (2026-aca7a82c77)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-aca7a82c77 advisory. Update to .NET SDK 8.0.132 and Runtime 8.0.32 Fixes: CVE-2026-105016,CVE-2026-58280,CVE-2026-66822,CVE-2026-69651,CVE-2026-70007,CVE-2026-70035,CVE-...

MiracleLinux 9 : expat-2.5.0-6.el9_8.7 (AXSA:2026-2148:14)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2148:14 advisory. expat: expat: Denial of Service via integer overflow in expatrealloc CVE-2026-102633 expat: expat: Information disclosure via heap buffer over-read ...

SUSE SLES15 Security Update : aws-iam-authenticator (SUSE-SU-2026:4891-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4891-1 advisory. - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input bsc1272130. - CVE-2026-78669:...

Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-3251)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3251 advisory. In the Linux kernel, the following vulnerability has been resolved: bpf: Fix UAF in sock clone early bailouts CVE-2026-68399 In the Linux kernel, the following vulnerability has been resolved:...

Fedora 44 : jfrog-cli (2026-22413fc041)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-22413fc041 advisory. Update to 2.127.0. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested...

Amazon Linux 2023 : aspell, aspell-devel (ALAS2023-2026-3275)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3275 advisory. A flaw was found in Aspell. An attacker could achieve arbitrary code execution or cause a Denial of Service DoS by convincing a user to process a specially crafted dictionary file. This issue...

SUSE SLED15 / SLES15 Security Update : emacs (SUSE-SU-2026:4893-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4893-1 advisory. - CVE-2026-79992: zero-click local command execution via TRAMP bsc1275927. - CVE-2026-108976: flawed username...

AlmaLinux 9.6 [TuxCare] Security Update: openssh / openssh-askpass / openssh-clients / openssh-keycat / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1792935277)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792935277 advisory. - In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt...

Amazon Linux 2023 : mariadb118, mariadb118-backup, mariadb118-client-utils (ALAS2023-2026-3310)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3310 advisory. A flaw was found in MariaDB. An authenticated user with permission to use the CONNECT storage engine can exploit an incorrect boundary check when handling DOS table types to write beyond the...

Amazon Linux 2023 : xorg-x11-server-Xwayland, xorg-x11-server-Xwayland-devel (ALAS2023-2026-3261)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3261 advisory. CheckSetDoodad in xkb/xkb.c frees doodad-text.text on error but doesnot NULL the pointer. When the error path continues, XkbClearDoodad iscalled during cleanup and frees the same pointer again...

Amazon Linux 2023 : valkey, valkey-devel (ALAS2023-2026-3265)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3265 advisory. hiredis commit 29ea279 post-v1.5.0 contains an uncontrolled memory allocation vulnerability in its RESP aggregate parser. CVE-2026-88382 A flaw was found in Redis community. The cluster bus...

CentOS Linux 8.5 [TuxCare] Security Update: openssh / openssh-askpass / openssh-cavs / openssh-clients / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1792933979)

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1792933979 advisory. - In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt...

openSUSE 16 Security Update : haproxy (openSUSE-SU-2026:22162-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:22162-1 advisory. This update for haproxy fixes the following issue: - h1-htx: report an error on a too long chunk-size line bsc1285046. Changes for haproxy: - Otel Updat...

AlmaLinux 9.6 [TuxCare] Security Update: ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1792140497)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792140497 advisory. - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 6.9.13-56 and 7.1.2-31, a...

Amazon Linux 2023 : mod_security, mod_security-mlogc (ALAS2023-2026-3247)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3247 advisory. GHSA-5pww-8rfg-9crf: RFC 2231 filename parameter bypasses multipart filename rules CVE-2026-104269 Tenable has extracted the preceding description block directly from the tested product security...

Amazon Linux 2023 : containerd, containerd-stress (ALAS2023-2026-3273)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3273 advisory. containerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a crafted OCI index graph can force very high CPU/memory usage during PullImage befor...

Fedora 44 : perl-Badger / perl-CLI-Simple / perl-CSS-Inliner / etc (2026-0b9eb888a8)

The remote Fedora 44 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-0b9eb888a8 advisory. Update to rt 5.0.10 Fixes CVE-2025-61873 CVE-2026-41075 CVE-2026-41076 CVE-2026-6841 CVE-2026-44231 CVE-2026-44229 CVE-2026-44230 Tenable has...

Amazon Linux 2023 : nodejs22, nodejs22-devel, nodejs22-full-i18n (ALAS2023-2026-3277)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3277 advisory. The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in...

Amazon Linux 2023 : docker (ALAS2023-2026-3324)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3324 advisory. Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority CA, the Go's crypto/x509 package is updated to not trust certificates...

Fedora 44 : dotnet8.0 (2026-6cdafc7e45)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-6cdafc7e45 advisory. Update to .NET SDK 8.0.132 and Runtime 8.0.32 Fixes: CVE-2026-105016,CVE-2026-58280,CVE-2026-66822,CVE-2026-69651,CVE-2026-70007,CVE-2026-70035,CVE-...

Amazon Linux 2 : runc (ALASECS-2026-151)

The version of runc installed on the remote host is prior to 1.4.3-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2026-151 advisory. Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority CA,...

Amazon Linux 2023 : java-17-amazon-corretto, java-17-amazon-corretto-devel, java-17-amazon-corretto-headless (ALAS2023-2026-3318)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3318 advisory. Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was distributed to clients via RemoteSettings the same day. This update contains the updat...

Amazon Linux 2023 : perl, perl-Attribute-Handlers, perl-AutoLoader (ALAS2023-2026-3279)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3279 advisory. Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in Sregmatch. The regex engine's superlinear cache...

Amazon Linux 2023 : amazon-efs-utils (ALAS2023-2026-3333)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3333 advisory. Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering the AWS SDK for Rust and custom service implementations...

Amazon Linux 2023 : captree, libcap, libcap-devel (ALAS2023-2026-3255)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3255 advisory. When Trailer headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map,...

Fedora 43 : perl-Badger / perl-CLI-Simple / perl-CSS-Inliner / etc (2026-04f78841ec)

The remote Fedora 43 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-04f78841ec advisory. Update to rt 5.0.10 Fixes CVE-2025-61873 CVE-2026-41075 CVE-2026-41076 CVE-2026-6841 CVE-2026-44231 CVE-2026-44229 CVE-2026-44230 Tenable has...

MiracleLinux 9 : openexr-3.1.1-3.el9_8.5 (AXSA:2026-2147:08)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2147:08 advisory. openexr: OpenEXR: Memory corruption and Denial of Service via crafted EXR file processing CVE-2026-34544 openexr: OpenEXR: Denial of Service or...

Amazon Linux 2023 : java-25-amazon-corretto, java-25-amazon-corretto-devel, java-25-amazon-corretto-headless (ALAS2023-2026-3320)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3320 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Libraries. Supported versions that are affected are Oracle...

Amazon Linux 2023 : skopeo, skopeo-tests (ALAS2023-2026-3254)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3254 advisory. When Trailer headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map,...

Rocky Linux 9.2 [CIQ] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc Multiple Vulnerabilities (ciqsa-2026_1718)

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261718 advisory. This advisory aggregates security fixes for the php SRPM in CIQ LTS 9.2. It addresses 2 CVEs: CVE-2026-109619, CVE-2026-109618. Tenable has extracted the...

Amazon Linux 2023 : ant, ant-antlr, ant-apache-bcel (ALAS2023-2026-3239)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3239 advisory. The ftp and scp tasks of Apache Ant can download files from a remote server. A malicious server can provide relative paths that allow it to write outside of the dedicated target directory for the...

FreeBSD : traefik -- ForwardAuth vulnerability (67ba2e09-cff9-11f1-a264-5404a68ad561)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 67ba2e09-cff9-11f1-a264-5404a68ad561 advisory. The traefik project releases a new version addressing ForwardAuth vulnerabilities: Tenable has extracte...