TencentOS Server 4: libsoup3 (TSSA-2026:0839)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0839 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

Linux Distros Unpatched Vulnerability : CVE-2026-74285

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: net: Stop leased rxq before uninstalling its memory provider netifrxqcleanupunlease tears...

RHEL 8 : attr (RHSA-2026:56133)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:56133 advisory. The attr packages provide extended attributes, which can be used to store system objects like capabilities of executables and access control lists, ...

Linux Distros Unpatched Vulnerability : CVE-2026-74364

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Reject exclusive maps as inner maps in map-in-map An exclusive map created with exclproghash is bound to a single program by hash: checkmapprogcompatibilit...

Linux Distros Unpatched Vulnerability : CVE-2026-74998

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS Cascading Style Sheets proxy were not validated, which may result in informati...

Linux Distros Unpatched Vulnerability : CVE-2026-72090

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - accel/amdxdna: Use caller client for debug BO sync amdxdnadrmsyncboioctl looks up args-handle in the ioctl caller's drmfile. For SYNCDIRECTFROMDEVICE, it then...

Linux Distros Unpatched Vulnerability : CVE-2026-72332

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - accel/amdxdna: Prevent PM resume deadlock in hwctxsyncdebugbo amdxdnahwctxsyncdebugbo invokes the hardware hwctxsyncdebugbo callback while holding xdna-devlock...

Linux Distros Unpatched Vulnerability : CVE-2026-72215

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - MIPS: DEC: Ensure 32-bit stack location for o32 promprintf In 64-bit configurations calling any firmware entry points from a kernel thread other than the initia...

Amazon Linux 2023 : containerd, containerd-stress (ALAS2023-2026-2063)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2063 advisory. A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes. CVE-2026-56852 Tenable has extracted the preceding description block directly from the tested product security...

Linux Distros Unpatched Vulnerability : CVE-2026-72370

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iomap: release pages on atomic dio size mismatch If bioiovitergetpages or the bounce helper succeeds but builds a short bio, the REQATOMIC size check rejects it...

Linux Distros Unpatched Vulnerability : CVE-2026-74274

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - cxl/region: Fill first free targets slot during auto-discovery Any invalid endpoint decoder pointer in the target array of an active region is not allowed by cx...

Linux Distros Unpatched Vulnerability : CVE-2026-74370

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - liveupdate: fix TOCTOU race in luosessionretrieve Extend the scope of the rwsemread lock in luosessionretrieve to overlap with the acquisition of the session...

Linux Distros Unpatched Vulnerability : CVE-2026-72358

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: drm/xe/pt: prevent invalid cursor access for purged BOs During a page table walk for binding...

Photon OS 5.0: Postgresql16 PHSA-2026-5.0-92-0959

An update of the postgresql16 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-92-0959. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102119)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102119 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: arptables: fix IEEE1394 ARP payload parsing Weiming Shi says: arppacketmatch...

Linux Distros Unpatched Vulnerability : CVE-2026-72486

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mailbox: mtk-adsp: fix UAF during device teardown When the SOF audio driver fails to initialize e.g. firmware boot timeout, its devres unwind frees the sndsofde...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102125)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102125 advisory. In the Linux kernel, the following vulnerability has been resolved: dm-verity: disable recursive forward error correction There are two problems with the recursive...

Amazon Linux 2 : containerd, --advisory ALAS2NITRO-ENCLAVES-2026-117 (ALASNITRO-ENCLAVES-2026-117)

The version of containerd installed on the remote host is prior to 2.1.9-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2NITRO-ENCLAVES-2026-117 advisory. A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes. CVE-2026-56852 Tenable h...

Linux Distros Unpatched Vulnerability : CVE-2026-72391

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: phy: sfp: free miibus in sfpi2cmdiobusdestroy sfpi2cmdiobuscreate allocates the I2C MDIO bus with mdioi2calloc, a plain non-devm allocation, and registers...

Linux Distros Unpatched Vulnerability : CVE-2026-74367

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: ath12k: fix inconsistent arvif state in vdevcreate error paths ath12kmacvdevcreate has three error path issues that leave arvif in an inconsistent state: ...

Linux Distros Unpatched Vulnerability : CVE-2026-72275

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fbdev: broadsheetfb: fix potential memory leak in broadsheetfbprobe The memory allocated for pagerefs in fbdeferredioinit is not freed on the error path. Fix it...

Linux Distros Unpatched Vulnerability : CVE-2026-72270

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fbdev: s3fb: fix potential memory leak in s3pciprobe In s3pciprobe, the memory allocated for modelist using fbvideomodetomodelist is not freed in subsequent err...

MiracleLinux 9 : [security - high] nodejs:22 (AXSA:2026-1561:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1561:01 advisory. brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity CVE-2026-13149 tar: Node-tar: Denial of Service via malformed...

Linux Distros Unpatched Vulnerability : CVE-2026-72033

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - orangefs: keep the readdir entry size 64-bit in fillfrompart fillfrompart computes the size of a directory entry in sizet but stores it in a u32. An entry lengt...

MiracleLinux 8 : perl:5.32 (AXSA:2026-1565:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1565:01 advisory. perl-Archive-Tar: perl-Archive-Tar: Denial of Service via crafted tar header with large entry size CVE-2026-9538 Tenable has extracted the preceding...

Linux Distros Unpatched Vulnerability : CVE-2026-62871

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally. CVE-2026-62871 Note that Nessus relies on the presence of the package as...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-101975)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101975 advisory. In the Linux kernel, the following vulnerability has been resolved: sctp: Prevent TOCTOU out-of-bounds write For the following path not holding the sock lock,...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102000)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102000 advisory. In the Linux kernel, the following vulnerability has been resolved: kprobes: avoid crash when rmmod/insmod after ftrace killed After we hit ftrace is killed by some...

Linux Distros Unpatched Vulnerability : CVE-2026-72047

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit ca8210testintdriverwrite and ca8210testintuserread exchange a kmalloc'd buffer pointer through a...

AlmaLinux 10 : gstreamer1-plugins-bad-free (ALSA-2026:55433)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:55433 advisory. gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec IMA/DVI ADPCM decoder CVE-2026-19387 Tenable has extracted the preceding...

Linux Distros Unpatched Vulnerability : CVE-2026-72244

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gpu/buddy: bail out of tryharder when alignment cannot be honoured The tryharder contiguous fallback could return a range whose start offset did not match the...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102003)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102003 advisory. In the Linux kernel, the following vulnerability has been resolved: xfrm: always flush state and policy upon NETDEVUNREGISTER event syzbot is reporting that struct...

Microsoft Edge (Chromium) < 151.0.4129.86 Multiple Vulnerabilities

The version of Microsoft Edge installed on the remote Windows host is prior to 151.0.4129.86. It is, therefore, affected by multiple vulnerabilities as referenced in the August 14, 2026 advisory. - Use after free in Blink in Google Chrome prior to 151.0.7922.137 allowed a remote attacker to execu...

Mozilla Firefox ESR < 153.1

The version of Firefox ESR installed on the remote Windows host is prior to 153.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-77 advisory. - Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14,...

Mozilla Firefox ESR < 140.14

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 140.14. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-76 advisory. - Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 154, Firefox...

AlmaLinux 10 : bind (ALSA-2026:55437)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:55437 advisory. bind9: bind: Potential wildcard CNAME RPZ policy bypass CVE-2026-11331 bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field...

MiracleLinux 9 : kernel-5.14.0-687.22.1.el9_8 (AXSA:2026-1543:61)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1543:61 advisory. kernel: fs/smb/client: fix out-of-bounds read in cifssanitizeprepath CVE-2026-43112 kernel: net: mana: Fix double destroyworkqueue on service rescan...

RHEL 9 : kpatch-patch-5_14_0-284_117_1, kpatch-patch-5_14_0-284_134_1, kpatch-patch-5_14_0-284_148_1, kpatch-patch-5_14_0-284_158_1, and kpatch-patch-5_14_0-284_172_1 (RHSA-2026:55837)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:55837 advisory. This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the code of a running kernel. This patc...

Linux Distros Unpatched Vulnerability : CVE-2026-74279

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - crypto: cavium/cpt - fix DMA cleanup using wrong loop index The sgcleanup error path used listi instead of listj when unmapping DMA buffers, leaking successfull...

RHEL 9 : kpatch-patch-5_14_0-427_100_1, kpatch-patch-5_14_0-427_113_1, kpatch-patch-5_14_0-427_126_1, kpatch-patch-5_14_0-427_68_2, and kpatch-patch-5_14_0-427_84_1 (RHSA-2026:56224)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:56224 advisory. This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the code of a running kernel. This patc...

Linux Distros Unpatched Vulnerability : CVE-2026-72316

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - dm era: fix NULL pointer dereference in metadataopen metadataopen returns NULL when kzallocobj fails, but the caller eractr only checks ISERRmd. Since ISERRNULL...

Linux Distros Unpatched Vulnerability : CVE-2026-72052

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: ip6gre: require CAPNETADMIN in the device netns for changelink ip6grechangelink and ip6erspanchangelink operate on at most two netns, devnetdev and the...

Linux Distros Unpatched Vulnerability : CVE-2026-74348

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ocfs2/dlm: require a ref for lockingstate debugfs open debuglockresopen copies inode-iprivate into struct debuglockres and debuglockresrelease later drops that...

Linux Distros Unpatched Vulnerability : CVE-2026-72481

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iio: magnetometer: ak8975: fix potential kernel stack memory leak Currently in the AK8975 driver there are four instances where potential uninitialized kernel...

Linux Distros Unpatched Vulnerability : CVE-2026-72224

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nvdimm/btt: Free arenas on bttinit error paths The arenas allocated by discoverarenas or createarenas are not freed on some error paths in bttinit. This leaks...

Linux Distros Unpatched Vulnerability : CVE-2026-72067

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - cpu: hotplug: Preserve per instance callback errors cpuhpinvokecallback unwinds earlier callbacks for the same hotplug state when one instance fails. The rollba...

Linux Distros Unpatched Vulnerability : CVE-2026-72083

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE corescsi3emulateproregisterandmove maps the PERSISTENT RESERVE OUT parameter list with...

Linux Distros Unpatched Vulnerability : CVE-2026-72135

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tpm: Make the TPM character devices non-seekable The TPM character devices expose a sequential command/response interface, but their open handlers leave...

Linux Distros Unpatched Vulnerability : CVE-2026-72235

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - batman-adv: retrieve ethhdr after potential skb realloc on RX pskbmaypull in batadvinterfacerx could reallocate the buffer behind the skb. Variables which were...

Linux Distros Unpatched Vulnerability : CVE-2026-74390

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RDMA/irdma: Fix out-of-bounds write in irdmacopyuserpgaddrs The irdmacopyuserpgaddrs function loops through all of the umem DMA blocks to populate the PBLEs and...