Amazon Linux 2023 : mariadb114, mariadb114-backup, mariadb114-client-utils (ALAS2023-2026-3309)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3309 advisory. A flaw was found in MariaDB. An authenticated user with permission to use the CONNECT storage engine can exploit an incorrect boundary check when handling DOS table types to write beyond the...

SUSE SLED15: gimp / gimp-devel / gimp-lang / gimp-plugin-aa / libgimp-2_0-0 / etc (SUSE-SU-2026:4895-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4895-1 advisory. - CVE-2026-82328: undersized palette memory allocations in the ICO loader can cause heap out-of-bounds reads...

Amazon Linux 2023 : python3.14, python3.14-devel, python3.14-freethreading (ALAS2023-2026-3232)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3232 advisory. When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion...

Amazon Linux 2023 : pcre2, pcre2-devel, pcre2-static (ALAS2023-2026-3269)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3269 advisory. A flaw was found in pcre2. When an application processes attacker-controlled regular expressions using certain Just-In-Time JIT compiler interfaces, an out-of-bounds write with arbitrary data...

Amazon Linux 2023 : mariadb123, mariadb123-backup, mariadb123-client-utils (ALAS2023-2026-3286)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3286 advisory. MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account...

MiracleLinux 9 : httpd-2.4.62-13.el9_8.9 (AXSA:2026-2145:11)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2145:11 advisory. httpd: httpd: HTTP response smuggling via crafted Transfer-Encoding response in modproxyuwsgi CVE-2026-63718 httpd: httpd: Denial of Service via...

Rocky Linux 9 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crlsa-2026_87805)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202687805 advisory. kernel: netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets CVE-2025-22063 kernel: calipso: Don't call calipso functions for AFINET sk...

Amazon Linux 2023 : bind, bind-chroot, bind-devel (ALAS2023-2026-3312)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3312 advisory. Inbound-message resource exhaustion CWE-400 leading to denial of service. No configuration precondition; version applicability is the deciding factor. Affected versions: 9.11.0-9.18.50,...

Amazon Linux 2023 : python3-tornado (ALAS2023-2026-3292)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3292 advisory. Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response...

Amazon Linux 2023 : nodejs24, nodejs24-devel, nodejs24-full-i18n (ALAS2023-2026-3330)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3330 advisory. A vulnerability in Node.js HTTP Agent handling allows a keep-alive socket to process a response that was written before the corresponding request was sent. This may cause incorrect response...

Amazon Linux 2023 : xorg-x11-server-Xwayland, xorg-x11-server-Xwayland-devel (ALAS2023-2026-3261)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3261 advisory. CheckSetDoodad in xkb/xkb.c frees doodad-text.text on error but doesnot NULL the pointer. When the error path continues, XkbClearDoodad iscalled during cleanup and frees the same pointer again...

Amazon Linux 2023 : captree, libcap, libcap-devel (ALAS2023-2026-3255)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3255 advisory. When Trailer headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map,...

Rocky Linux 9.6 [TuxCare] Security Update: openssh / openssh-askpass / openssh-clients / openssh-keycat / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1792935277)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792935277 advisory. - In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication...

Amazon Linux 2 : ecs-init (ALASECS-2026-149)

The version of ecs-init installed on the remote host is prior to 1.108.1-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2ECS-2026-149 advisory. When Trailer headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer m...

Amazon Linux 2 : docker (ALASECS-2026-150)

The version of docker installed on the remote host is prior to 25.0.18-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2026-150 advisory. Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority...

Amazon Linux 2 : runc (ALASECS-2026-151)

The version of runc installed on the remote host is prior to 1.4.3-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2026-151 advisory. Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority CA,...

Amazon Linux 2023 : buildah (ALAS2023-2026-3256)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3256 advisory. When Trailer headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map,...

Amazon Linux 2023 : soci-snapshotter (ALAS2023-2026-3270)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3270 advisory. When Trailer headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map,...

Amazon Linux 2023 : git-lfs (ALAS2023-2026-3322)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3322 advisory. Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority CA, the Go's crypto/x509 package is updated to not trust certificates...

Amazon Linux 2023 : docker (ALAS2023-2026-3324)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3324 advisory. Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority CA, the Go's crypto/x509 package is updated to not trust certificates...

Amazon Linux 2023 : skopeo, skopeo-tests (ALAS2023-2026-3254)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3254 advisory. When Trailer headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map,...

Amazon Linux 2023 : containerd, containerd-stress (ALAS2023-2026-3273)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3273 advisory. containerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a crafted OCI index graph can force very high CPU/memory usage during PullImage befor...

Rocky Linux 9.2 [CIQ] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc Multiple Vulnerabilities (ciqsa-2026_1718)

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261718 advisory. This advisory aggregates security fixes for the php SRPM in CIQ LTS 9.2. It addresses 2 CVEs: CVE-2026-109619, CVE-2026-109618. Tenable has extracted the...

AlmaLinux 8 : flute, libbase, libfonts, libformula, liblayout, libloader, libreoffice, librepository, libserializer, pentaho-libxml, pentaho-reporting-flow-engine, and sac (ALSA-2026:88164)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:88164 advisory. libreoffice: heap buffer overflow in PDF import stream handling CVE-2026-63274 libreoffice: stack buffer overflow in CFF to Type 1 font conversion...

Amazon Linux 2023 : python3.13-tornado (ALAS2023-2026-3293)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3293 advisory. Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response...

Amazon Linux 2023 : mariadb1011, mariadb1011-backup, mariadb1011-client-utils (ALAS2023-2026-3289)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3289 advisory. MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account...

Amazon Linux 2023 : nodejs24, nodejs24-devel, nodejs24-full-i18n (ALAS2023-2026-3297)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3297 advisory. The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in...

CentOS Linux 8.4 [TuxCare] Security Update: openssh / openssh-askpass / openssh-cavs / openssh-clients / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1792933338)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1792933338 advisory. - In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt...

Amazon Linux 2023 : java-27-amazon-corretto, java-27-amazon-corretto-devel, java-27-amazon-corretto-headless (ALAS2023-2026-3316)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3316 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Libraries. Supported versions that are affected are Oracle...

Amazon Linux 2023 : nginx, nginx-all-modules, nginx-core (ALAS2023-2026-3263)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3263 advisory. A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the...

Amazon Linux 2023 : cyrus-sasl, cyrus-sasl-devel, cyrus-sasl-gs2 (ALAS2023-2026-3290)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3290 advisory. A heap-based buffer overflow flaw was found in Cyrus SASL. The addtochallenge function in the DIGEST- MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5...

Amazon Linux 2023 : libsoup3, libsoup3-devel (ALAS2023-2026-3240)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3240 advisory. A flaw was found in SoupServer libsoup. When an HTTP/1.x client sends a request with Expect: 100-continue and a request body, and SoupServer returns an early final non-1xx response before the...

Fedora 45 : firefox (2026-0848d84b80)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-0848d84b80 advisory. - Updated to latest upstream 158.0.1 ---- - Updated to latest upstream 157.0.1 Tenable has extracted the preceding description block directly from t...

SUSE SLED15: cpupower / cpupower-bash-completion / cpupower-devel / etc (SUSE-SU-2026:4890-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4890-1 advisory. This update for cpupower fixes the following issue: - CVE-2026-80663: tools/power/x86/intel-speed-select: Harden daemon...

Amazon Linux 2023 : python3, python3-devel, python3-idle (ALAS2023-2026-3278)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3278 advisory. ssl.SSLContext.wrapbio didn't require the serverhostname argumentto not be None if ssl.SSLContext.checkhostname was set. Due to amissing parameter check in SSLObject, if the serverhostname argumentisn'...

Amazon Linux 2023 : python3.13, python3.13-devel, python3.13-freethreading (ALAS2023-2026-3229)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3229 advisory. When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion...

Amazon Linux 2023 : xorg-x11-server-common, xorg-x11-server-devel, xorg-x11-server-source (ALAS2023-2026-3260)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3260 advisory. CheckSetDoodad in xkb/xkb.c frees doodad-text.text on error but doesnot NULL the pointer. When the error path continues, XkbClearDoodad iscalled during cleanup and frees the same pointer again...

Amazon Linux 2023 : ghostscript, ghostscript-gtk, ghostscript-tools-dvipdf (ALAS2023-2026-3294)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3294 advisory. A flaw was found in Ghostscript. When Ghostscript renders a crafted PostScript or EPS document, it can bypass the -dSAFER sandbox and execute arbitrary shell commands in the context of the...

Amazon Linux 2023 : qemu, qemu-common, qemu-guest-agent (ALAS2023-2026-3241)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3241 advisory. hw/usb/hcd-xhci: Set reentrancy guard in timer functions CVE-2026-17588 NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/1f24066fc88d33455ee54a20f29994d9e69997ba v11.1.0-rc3NOTE:...

Amazon Linux 2023 : firefox (ALAS2023-2026-3281)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3281 advisory. Information disclosure in the Networking: JAR component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. CVE-2026-100766 Sandbox...

SUSE SLES12 Security Update : cifs-utils (SUSE-SU-2026:4897-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4897-1 advisory. This update for cifs-utils fixes the following issue: - CVE-2026-104715: mount options injection via CIFS credentials-file parsing bsc128493...

Amazon Linux 2023 : java-1.8.0-amazon-corretto, java-1.8.0-amazon-corretto-devel (ALAS2023-2026-3315)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3315 advisory. Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was distributed to clients via RemoteSettings the same day. This update contains the updat...

Amazon Linux 2023 : python3.12, python3.12-devel, python3.12-idle (ALAS2023-2026-3230)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3230 advisory. When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion...

Linux Distros Unpatched Vulnerability : CVE-2026-106017

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper certificate validation in the OpenVPN 3 Core library version 3.4 through 3.11.7 allows attackers to circumvent extended key usage restrictions...

Amazon Linux 2023 : java-11-amazon-corretto, java-11-amazon-corretto-devel, java-11-amazon-corretto-headless (ALAS2023-2026-3317)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3317 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Libraries. Supported versions that are affected are Oracle...

openSUSE 16 Security Update : libmodplug (openSUSE-SU-2026:22165-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22165-1 advisory. Changes in libmodplug: - CVE-2026-108577: This issue affects the function abcaddgchord of the file src/loadabc.cpp of the component ABC Music...

MiracleLinux 9 : cockpit-machines-348.1-1.el9_8 (AXSA:2026-2146:02)

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-2146:02 advisory. cockpit-machines: cockpit-machines: Sensitive data exposure via command-line arguments CVE-2026-92768 cockpit-machines: cockpit-machines: Sensitive...

Amazon Linux 2023 : firefox (ALAS2023-2026-3329)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3329 advisory. Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL...

MiracleLinux 9 : kernel-5.14.0-687.59.1.el9_8 (AXSA:2026-2149:105)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2149:105 advisory. kernel: openvswitch: defer tunnel netdevput to RCU release CVE-2026-31678 kernel: xfrm: espintcp: do not reuse an in-progress partial send...

openSUSE 16: docker / docker-bash-completion / docker-buildx / etc (openSUSE-SU-2026:22158-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22158-1 advisory. Security issues fixed: - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGSMAXFRAMESIZE bsc126578...