Amazon Linux 2023 : java-1.8.0-amazon-corretto, java-1.8.0-amazon-corretto-devel (ALAS2023-2026-3315)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3315 advisory. Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was distributed to clients via RemoteSettings the same day. This update contains the updat...

Amazon Linux 2023 : python3.12, python3.12-devel, python3.12-idle (ALAS2023-2026-3230)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3230 advisory. When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion...

Linux Distros Unpatched Vulnerability : CVE-2026-106017

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper certificate validation in the OpenVPN 3 Core library version 3.4 through 3.11.7 allows attackers to circumvent extended key usage restrictions...

Amazon Linux 2023 : java-11-amazon-corretto, java-11-amazon-corretto-devel, java-11-amazon-corretto-headless (ALAS2023-2026-3317)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3317 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Libraries. Supported versions that are affected are Oracle...

openSUSE 16 Security Update : libmodplug (openSUSE-SU-2026:22165-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22165-1 advisory. Changes in libmodplug: - CVE-2026-108577: This issue affects the function abcaddgchord of the file src/loadabc.cpp of the component ABC Music...

MiracleLinux 9 : cockpit-machines-348.1-1.el9_8 (AXSA:2026-2146:02)

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-2146:02 advisory. cockpit-machines: cockpit-machines: Sensitive data exposure via command-line arguments CVE-2026-92768 cockpit-machines: cockpit-machines: Sensitive...

Amazon Linux 2023 : firefox (ALAS2023-2026-3329)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3329 advisory. Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL...

Amazon Linux 2023 : buildah (ALAS2023-2026-3326)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3326 advisory. Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority CA, the Go's crypto/x509 package is updated to not trust certificates issued by th...

Amazon Linux 2023 : golang, golang-bin, golang-misc (ALAS2023-2026-3225)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3225 advisory. When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server reject...

Rocky Linux 10.2 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crlsa-2026_88477)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202688477 advisory. kernel: calipso: Don't call calipso functions for AFINET sk. CVE-2025-38147 kernel: ipv4: raw: reject IPHDRINCL packets with ihl 5 CVE-2026-64114 kerne...

Amazon Linux 2023 : brotli, brotli-devel, libbrotli (ALAS2023-2026-3334)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3334 advisory. A vulnerability in the Node.js Brotli decoder can result in an out-of-bounds memory write when processing crafted Brotli input. Successful exploitation may lead to memory corruption and remote code...

SUSE SLES12: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:4892-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4892-1 advisory. The SUSE Linux Enterprise 12 SP5 kernel was updated to fix various security issues: The following security issues were fixed: -...

Amazon Linux 2023 : python3-unbound, unbound, unbound-anchor (ALAS2023-2026-3313)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3313 advisory. In NLnet Labs Unbound up to and including version 1.26.1, an observable cache-level side-channel can be exposed with 'unwanted-reply-threshold 0' configurations not a default configuration. If...

Amazon Linux 2023 : heif-pixbuf-loader, libheif, libheif-devel (ALAS2023-2026-3314)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3314 advisory. Fix GHSA-w7mc-p8jc-p853: heap OOB read / info disclosure OpYCbCr420toRRGGBBaa Fix GHSA-9rj8-5mp5-26c9: Out-of-bounds read in RGBYCbCr identity-matrix colour conversion with mismatched...

openSUSE 16: MozillaFirefox / MozillaFirefox-branding-upstream / etc (openSUSE-SU-2026:22159-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:22159-1 advisory. Update to Firefox Extended Support Release 153.5.1 ESR MFSA 2026-112, bsc1286385: - CVE-2026-113470: Cryptographic issue in the Security Block-lists,...

MiracleLinux 9 : kernel-5.14.0-687.59.1.el9_8 (AXSA:2026-2149:105)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2149:105 advisory. kernel: openvswitch: defer tunnel netdevput to RCU release CVE-2026-31678 kernel: xfrm: espintcp: do not reuse an in-progress partial send...

openSUSE 16: docker / docker-bash-completion / docker-buildx / etc (openSUSE-SU-2026:22158-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22158-1 advisory. Security issues fixed: - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGSMAXFRAMESIZE bsc126578...

openSUSE 16: erlang-rabbitmq-client / rabbitmq-server / etc (openSUSE-SU-2026:22163-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:22163-1 advisory. This update for rabbitmq-server fixes the following issue: - CVE-2026-57215: direct-reply-to binding persistence can lead to unauthorized reply-channel...

Linux Distros Unpatched Vulnerability : CVE-2026-115754

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site scripting vulnerability that allows attackers to break out of HTML script elements by ending...

Fedora 44 : perl-Text-CSV_XS (2026-035fae971f)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-035fae971f advisory. Current upstream release, with several security fixes. Tenable has extracted the preceding description block directly from the Fedora security...

Rocky Linux 8 [CIQ] Security Update: autocorr-af / autocorr-bg / autocorr-ca / autocorr-cs / autocorr-da / etc Multiple Vulnerabilities (crlsa-2026_88164)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202688164 advisory. libreoffice: heap buffer overflow in PDF import stream handling CVE-2026-63274 libreoffice: stack buffer overflow in CFF to Type 1 font conversion...

SUSE SLES15 Security Update : kernel (Live Patch 20 for SUSE Linux Enterprise 15 SP7) (SUSE-SU-2026:4889-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4889-1 advisory. This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.53.78 fixes various security issues: The following security issues were fixed: -...

MiracleLinux 9 : ca-certificates-2026.2.92_v9.0.319-90.3.el9_8 (AXSA:2026-2140:02)

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-2140:02 advisory. ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns CVE-2026-114406 Tenable has extracted the preceding description block...

Amazon Linux 2 : python-tornado (ALAS-2026-4011)

The version of python-tornado installed on the remote host is prior to 4.2.1-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-4011 advisory. Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remo...

Rocky Linux 10.2 [CIQ] Security Update: iperf3 / iperf3-debuginfo / iperf3-debugsource (crlsa-2026_88207)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202688207 advisory. iperf3: iperf3: Denial of Service via UDP receive worker infinite loop CVE-2026-102253 Tenable has extracted the preceding description block directly from the C...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: php (UTSA-2026-143720)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-143720 advisory. The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracke...

Amazon Linux 2 : kernel (ALAS-2026-4036)

The version of kernel installed on the remote host is prior to 4.14.355-287.755. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-4036 advisory. In the Linux kernel, the following vulnerability has been resolved: nitroenclaves: fix use-after-free on SLOTALLOC failure...

Fedora 43 : thunderbird (2026-cce5679e8f)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-cce5679e8f advisory. Update to latest upstream version. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessu...

Amazon Linux 2 : runc (ALASNITRO-ENCLAVES-2026-128)

The version of runc installed on the remote host is prior to 1.4.3-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2026-128 advisory. Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate...

Amazon Linux 2 : firefox (ALASFIREFOX-2026-068)

The version of firefox installed on the remote host is prior to 153.5.1-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2FIREFOX-2026-068 advisory. Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was distributed to...

Rocky Linux 10.2 [CIQ] Security Update: buildah / buildah-debuginfo / buildah-debugsource / buildah-tests / etc Multiple Vulnerabilities (crlsa-2026_88262)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202688262 advisory. podman: Arbitrary file write when importing OCI archive CVE-2025-11395 net/http: golang: golang: Denial of Service via crafted HTTP Range headers...

Rocky Linux 9 [CIQ] Security Update: qemu-guest-agent / qemu-guest-agent-debuginfo / qemu-img / etc (crlsa-2026_88421)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202688421 advisory. qemu-kvm: qemu-guest-agent: Local privilege escalation via symlink attack in guest-ssh-add-authorized- keys CVE-2026-12080 Bug Fixes and Enhancements: qemu-img can...

Rocky Linux 8 [CIQ] Security Update: kernel-rt / kernel-rt-core / kernel-rt-debug / kernel-rt-debug-core / etc Multiple Vulnerabilities (crlsa-2026_87374)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202687374 advisory. kernel: ipv4: raw: reject IPHDRINCL packets with ihl msiperm after freeing it on init failure CVE-2026-89777 Tenable has extracted the preceding descripti...

Fedora 43 : pgbouncer (2026-343329cfec)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-343329cfec advisory. Update to 1.26.1. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...

Rocky Linux 8 [CIQ] Security Update: grafana / grafana-debuginfo / grafana-debugsource / grafana-selinux Multiple Vulnerabilities (crlsa-2026_88188)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202688188 advisory. net/http: golang: golang: Denial of Service via crafted HTTP Range headers CVE-2026-78667 crypto/tls: golang: crypto/tls: Denial of Service via multiple E...

Rocky Linux 8 [CIQ] Security Update: grafana-pcp / grafana-pcp-debuginfo / grafana-pcp-debugsource Multiple Vulnerabilities (crlsa-2026_88189)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202688189 advisory. crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references CVE-2026-97031 net/http: net/http/internal/http2:...

Rocky Linux 9 [CIQ] Security Update: grafana-pcp / grafana-pcp-debuginfo / grafana-pcp-debugsource Multiple Vulnerabilities (crlsa-2026_88354)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202688354 advisory. crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references CVE-2026-97031 net/http: net/http/internal/http2:...

Rocky Linux 8 [CIQ] Security Update: ca-certificates (crlsa-2026_88550)

The Rocky Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-202688550 advisory. ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns CVE-2026-114406 Tenable has extracted the preceding description block...

RockyLinux 9 : kernel (RLSA-2026:87805)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:87805 advisory. kernel: netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets CVE-2025-22063 kernel: calipso: Don't call calipso functions for AFINET s...

SUSE SLES15 Security Update : kernel (Live Patch 30 for SUSE Linux Enterprise 15 SP6) (SUSE-SU-2026:4888-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4888-1 advisory. This update for the SUSE Linux Enterprise Kernel 6.4.0-150600.23.130 fixes various security issues: The following security issues were fixed: -...

Amazon Linux 2 : perl-YAML (ALAS-2026-4035)

The version of perl-YAML installed on the remote host is prior to 0.84-5. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4035 advisory. YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes. A...

Amazon Linux 2 : python3 (ALAS-2026-4025)

The version of python3 installed on the remote host is prior to 3.7.16-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-4025 advisory. ssl.SSLContext.wrapbio didn't require the serverhostname argumentto not be None if ssl.SSLContext.checkhostname was set. Due to...

Linux Distros Unpatched Vulnerability : CVE-2026-115778

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.conch.telnet.Telnet.dataReceived appends eve...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: php (UTSA-2026-143718)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-143718 advisory. phpopensslmatcheswildcardname in ext/openssl/xpssl.c underflows the length argument passed to memchr when a TLS server certificate presents a wildcard name whose...

Amazon Linux 2 : qemu (ALAS-2026-4027)

The version of qemu installed on the remote host is prior to 3.1.0-8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4027 advisory. hw/display/qxl: validate primary surface stride against width CVE-2026-16271 hw/usb/hcd-xhci: Set reentrancy guard in timer...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: php (UTSA-2026-143716)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-143716 advisory. When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the...

Fedora 44 : gegl04 (2026-34e59263ad)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-34e59263ad advisory. This update fixes an overflow in parsing RGBE/HDR image files. Tenable has extracted the preceding description block directly from the Fedora security...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: php (UTSA-2026-143713)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-143713 advisory. The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MyS...

Linux Distros Unpatched Vulnerability : CVE-2026-95620

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A use-after-free vulnerability in the Qt QNetworkAccessManager HTTP/2 client support of the Qt Network module allows a malicious or compromised HTTP/2 server to...

openSUSE 16 Security Update : go1.27 (openSUSE-SU-2026:22153-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:22153-1 advisory. Update to go 1.27.3 bsc1272545: - CVE-2026-111943: crypto/x509: mitigation for security concerns with a specific Certificate Authority bsc1286317,...