RockyLinux 10 : libssh (RLSA-2026:55855)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:55855 advisory. libssh: libssh: information disclosure via short GSSAPI Curve25519 public key CVE-2026-59842 libssh: libssh: denial of service via zero advertised...

Oracle Linux 10 : libssh (ELSA-2026-55855)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-55855 advisory. 0.12.0-3 - Backport CVE fixes from 0.12.2 Resolves: RHEL-213004 Resolves: RHEL-213029 Resolves: RHEL-213032 Resolves: RHEL-213039 Resolves: RHEL-2130...

Linux Distros Unpatched Vulnerability : CVE-2026-72140

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - i2c: mlxbf: Fix use-after-free in mlxbfi2cinitresource If devmplatformgetandioremapresource returns an error, mlxbfi2cinitresource frees tmpres before reading...

Linux Distros Unpatched Vulnerability : CVE-2026-74363

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs commit 4f375ade6aa9 bpf: Avoid RCU context warning when unpinning htab with internal structs moved...

Linux Distros Unpatched Vulnerability : CVE-2026-72105

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - dm-log: fix a bitsetsize overflow on 32bit machines Commit c20e36b7631d dm log: fix out-of-bounds write due to regioncount overflow made sure that regioncount...

Linux Distros Unpatched Vulnerability : CVE-2026-72241

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - leds: uleds: Fix potential buffer overread The name string supplied by userspace is not guaranteed to be null-terminated, so using strchr on it might result in ...

RHEL 8 : nghttp2 (RHSA-2026:55804)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:55804 advisory. libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 HTTP/2 protocol in C. Security Fixes: nghttp2: nghttp2: HTTP...

RockyLinux 9 : haproxy (RLSA-2026:55772)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:55772 advisory. haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions CVE-2026-55204 haproxy: HAProxy: Response smuggling due to integer overflow in...

Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-2057)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2057 advisory. In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Clear Present bit before tearing down context entry CVE-2026-45944 In the Linux kernel, the following...

Debian dla-4745 : ata-modules-6.12.100+deb12-armmp-di - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4745 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4745-1 [email protected]...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2026-129 (ALASKERNEL-5.10-2026-129)

The version of kernel installed on the remote host is prior to 5.10.262-262.1063. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2026-129 advisory. In the Linux kernel, the following vulnerability has been resolved: net: Drop the lock in...

Mozilla Firefox ESR < 140.14

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 140.14. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-76 advisory. - Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 154, Firefox...

Mozilla Firefox ESR < 153.1

The version of Firefox ESR installed on the remote Windows host is prior to 153.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-77 advisory. - Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14,...

Linux Distros Unpatched Vulnerability : CVE-2026-15803

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Eclipse RDF4J, several XML parser entry points do not fully restrict XML External Entity XXE processing when parsing untrusted XML-based RDF data or query...

TencentOS Server 4: gstreamer1-plugins-bad-free (TSSA-2026:0849)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0849 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

FreeBSD : Gitlab -- Vulnerabilities (3a65fb7e-9ac2-11f1-bdc8-2cf05da270f3)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 3a65fb7e-9ac2-11f1-bdc8-2cf05da270f3 advisory. Gitlab reports: Code Injection issue via GraphQL directive impacts GitLab CE/EE Cross-Site...

Oracle Linux 9 : gstreamer1-plugins-bad-free / and / gstreamer1-plugins-ugly-free (ELSA-2026-55865)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-55865 advisory. - Fix ADPCM decoder negotiation and input size check CVE-2026-19387 Resolves: RHEL-235496 gstreamer1-plugins-ugly-free Tenable has extracted the...

Linux Distros Unpatched Vulnerability : CVE-2026-74333

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ASoC: amd: acp-sdw-legacy: Bound DAI link iteration createsdwdailinks walks socdais until it finds an entry with initialised cleared, but socdais is allocated...

Linux Distros Unpatched Vulnerability : CVE-2026-73646

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18,...

Linux Distros Unpatched Vulnerability : CVE-2026-74280

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - crypto: marvell/octeontx - fix DMA cleanup using wrong loop index The sgcleanup path used listi instead of listj when unmapping DMA buffers, leaking successfull...

Linux Distros Unpatched Vulnerability : CVE-2026-62886

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Integer overflow or wraparound in .NET allows an unauthorized attacker to elevate privileges locally. CVE-2026-62886 Note that Nessus relies on the presence of...

RHEL 8 : sg3_utils (RHSA-2026:56130)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:56130 advisory. The sg3utils packages provide command-line utilities for devices that use the Small Computer System Interface SCSI command sets. Security Fixes:...

AlmaLinux 9 : glib2 (ALSA-2026:55440)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:55440 advisory. glib: buffer over-read in glib/gvariant-serialiser.c via gvstupleisnormal CVE-2026-58010 glib: out-of-bounds read in glib/gdatetime.c:gdatetimegetymd via...

Amazon Linux 2 : rust, --advisory ALAS2-2026-3865 (ALAS-2026-3865)

The version of rust installed on the remote host is prior to 1.97.0-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3865 advisory. RustCrypto CMOV provides conditional move CPU intrinsics which are guaranteed on major platforms to execute in constant-time...

IBM HTTP Server 8.5.x / 9.x Web Server Plug-in RCE (7274072)

The version of IBM HTTP Server running on the remote host is affected by multiple vulnerabilities as referenced in the 7274072 advisory. - IBM Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty 8.5, 9.0 IBM WebSphere Application Server and WebSphere Application Server...

GLSA-202608-15 : PostgreSQL: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202608-15 PostgreSQL: Multiple Vulnerabilities Multiple vulnerabilities have been discovered in PostgreSQL. Please review the CVE identifiers referenced below for details. Tenable has extracted the preceding description block...

SUSE SLES15: java-1_8_0-openjdk / java-1_8_0-openjdk-demo / etc (SUSE-SU-2026:3623-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3623-1 advisory. Security issues fixed: - CVE-2026-41254: lcms2: Information disclosure or denial of service via integer overflow in CubeSize...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102140)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102140 advisory. In the Linux kernel, the following vulnerability has been resolved: vsock: Ignore signal/timeout on connect if already established During connect, acting on a...

Linux Distros Unpatched Vulnerability : CVE-2026-72471

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fs/ntfs3: prevent potential lcn remains uninitialized The target VCN being sought was not found within runs0, causing runlookup to return false. This causes...

GLSA-202608-14 : X.Org X server, XWayland: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202608-14 X.Org X server, XWayland: Multiple Vulnerabilities Multiple vulnerabilities have been discovered in X.Org X server, XWayland. Please review the CVE identifiers referenced below for details. Tenable has extracted the...

Linux Distros Unpatched Vulnerability : CVE-2026-74260

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfilter: nfdupnetdev: add nfdevxmitrecursion helpers and use them Update nftdup and nftfwd to use the nfdevxmitrecursion helpers. This patch also disables BH...

Oracle Linux 10 : nodejs22 (ELSA-2026-55541)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-55541 advisory. - Fix for CVE-2026-69152 - Fix for CVE-2026-69192 & CVE-2026-54272 : ip-address - Fix CVE-2026-13149 npm/brace-expansion - Fix for CVE-2026-59873 and...

Linux Distros Unpatched Vulnerability : CVE-2026-63649

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Windows interactive service in OpenVPN 2.4.0 through 2.6.21 and 2.7alpha1 through 2.7.5 allows local authenticated users to bypass the trusted configuration...

Amazon Linux 2023 : python3-idna (ALAS2023-2026-2052)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2052 advisory. Internationalized Domain Names in Applications IDNA for Python provides support for Internationalized Domain Names in Applications IDNA and Unicode IDNA Compatibility Processing. In versions prior to...

Linux Distros Unpatched Vulnerability : CVE-2026-72013

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - riscv: Prevent NULL pointer dereference in machinekexecprepare A NULL pointer dereference issue is noticed in riscv's machinekexecprepare, where...

Linux Distros Unpatched Vulnerability : CVE-2026-72196

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fs/ntfs3: bound copylcns dp-pagelcns index in analysis pass In logreplay's analysis pass, after finddp returns a valid DIRPAGEENTRY for the targetattr, targetv...

Linux Distros Unpatched Vulnerability : CVE-2026-72431

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - alloctag: fix use-after-free in /proc/allocinfo after module unload allocinfostart only reinitializes the codetag iterator at position 0. For subsequent reads...

Linux Distros Unpatched Vulnerability : CVE-2026-74422

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/rockchip: inno-hdmi: Switch to drmmkzalloc Driver makes use of drmmencoderinit to initialize the encoder and automatically handle the cleanup by registering...

Linux Distros Unpatched Vulnerability : CVE-2026-72209

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: ntfs: validate attribute values on lookup ntfsattrfind and ntfsexternalattrfind check that...

Amazon Linux 2023 : firefox (ALAS2023-2026-2069)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2069 advisory. Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13. CVE-2026-16349 Incorrect boundary condition...

Linux Distros Unpatched Vulnerability : CVE-2026-68519

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, GlancesActions.run in glances/actions.py ignores --disable-config-exec for...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-101971)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101971 advisory. In the Linux kernel, the following vulnerability has been resolved: inet: RAW sockets using IPPROTORAW MUST drop incoming ICMP Yizhou Zhao reported that simply havi...

Photon OS 5.0: Linux PHSA-2026-5.0-92-0837

An update of the linux package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-92-0837. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Linux Distros Unpatched Vulnerability : CVE-2026-74277

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iommu/dma-iommu: Fix wrong scatterlist length assignment in P2PDMA path In iommudmamapsg, when handling PCI P2PDMA cases, the DMA length of the current...

Linux Distros Unpatched Vulnerability : CVE-2026-74323

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: mt76: mt7996: Fix possible token leak in mt7996txprepareskb If linkconf or linksta lookup fails in mt7996txprepareskb routine, mt7996 driver leaks an...

VMware ESX 8.0 / 9.0 / 9.1 Out-of-Bounds Read (VMSA-2026-0006)

The version of VMware ESX installed on the remote host is 8.0 prior to build 25205845 8.0 Update 3i, or 9.0 prior to build 25595025 9.0.2.0100, or 9.1 prior to build 25370933 9.1.0.0. It is, therefore, affected by a vulnerability as referenced in the VMSA-2026-0006.1 advisory: - VMware ESX,...

Linux Distros Unpatched Vulnerability : CVE-2026-72422

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ksmbd: fix use-after-free of conn-preauthinfo in concurrent SMB2 NEGOTIATE conn-preauthinfo is shared connection state struct preauthintegrityinfo, kmalloc-96...

Linux Distros Unpatched Vulnerability : CVE-2026-72184

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: ntfs: fix hole runlist memory leak in insert range error path ntfsnonresidentattrinsertrange...

Linux Distros Unpatched Vulnerability : CVE-2026-72352

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HID: bpf: Fix hidbpfgetdata range check hidbpfgetdata returns a pointer into the HID-BPF context data when the caller-provided offset and size fit inside...

Linux Distros Unpatched Vulnerability : CVE-2026-72186

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: ntfs: make system files immutable to prevent corruption When a system file such as $Bitmap i...