Amazon Linux 2 : 389-ds-base (ALAS-2026-4003)

The version of 389-ds-base installed on the remote host is prior to 1.3.10.2-17. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4003 advisory. A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by...

Linux Distros Unpatched Vulnerability : CVE-2026-115877

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.web.http.HTTPChannel.headerReceived rejects ...

Amazon Linux 2 : ant (ALAS-2026-4020)

The version of ant installed on the remote host is prior to 1.9.16-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-4020 advisory. The ftp and scp tasks of Apache Ant can download files from a remote server. A malicious server can provide relative paths that allow ...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: php (UTSA-2026-143723)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-143723 advisory. PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after bei...

Amazon Linux 2 : gfs2-utils (ALAS-2026-4004)

The version of gfs2-utils installed on the remote host is prior to 3.1.10-6. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4004 advisory. A stack overflow vulnerability was found in gfs2-utils. The hash table traversal code in metawalk.c uses alloca with a...

Debian dla-4856 : xdg-dbus-proxy - security update

The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dla-4856 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4856-1 [email protected] https://www.debian.org/lts/security/...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: openssh (UTSA-2026-143709)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-143709 advisory. sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service resource consumption from excessive authentication attempts because MaxAuthTries was...

Amazon Linux 2 : libreswan (ALAS-2026-4021)

The version of libreswan installed on the remote host is prior to 3.25-4.8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-4021 advisory. A null pointer dereference flaw was found in Libreswan's PKCS7 certificate payload handling. When processing a crafted IKEv2...

Linux Distros Unpatched Vulnerability : CVE-2026-83813

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.names.dns.DNSDatagramProtocol accepts a UDP...

Amazon Linux 2 : ipa (ALAS-2026-4008)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4008 advisory. A flaw was found in FreeIPA. A low-privilege authenticated user can exploit this vulnerability by submitting an oversized One-Time Password OTP key value. This oversized key is then decoded and r...

Fedora 43 : php-pecl-mongodb2 (2026-1ed9f02b1e)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-1ed9f02b1e advisory. Version 2.1.12 Release Highlights - PHPC-276: Prevent stack exhaustion when decoding deeply nested BSON - PHPC-276: Enforce the decode nesting limit...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: openssh (UTSA-2026-143710)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-143710 advisory. In sshd in OpenSSH before 10.5, the restrict keyword in authorizedkeys was supposed to be applicable to tunnel forwarding but was not. Tenable has extracted the...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: php (UTSA-2026-143724)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-143724 advisory. PHP uses longjmp for out-of-memory OOM errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario...

Rocky Linux 9 [CIQ] Security Update: firefox / firefox-debuginfo / firefox-debugsource / firefox-x11 Multiple Vulnerabilities (crlsa-2026_76761)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202676761 advisory. firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics component CVE-2026-92035 firefox: thunderbird: Use-after-free in...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: php (UTSA-2026-143715)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-143715 advisory. When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the...

Rocky Linux 8 [CIQ] Security Update: openssh / openssh-askpass / openssh-askpass-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_88211)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202688211 advisory. openssh: OpenSSH: SFTP security bypass due to command-line argument parsing flaw CVE-2026-59997 openssh: OpenSSH: Undocumented GSSAPIStrictAcceptorCheck...

Amazon Linux 2 : mariadb (ALAS-2026-4028)

The version of mariadb installed on the remote host is prior to 5.5.68-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4028 advisory. MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3....

Amazon Linux 2 : lrzsz (ALAS-2026-4031)

The version of lrzsz installed on the remote host is prior to 0.12.20-36. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-4031 advisory. lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote sende...

Linux Distros Unpatched Vulnerability : CVE-2026-49442

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cacti is an open source performance and fault management framework. Prior to version 1.2.31, a User Enumeration vulnerability allows an attacker to identify val...

Amazon Linux 2 : containerd (ALASDOCKER-2026-153)

The version of containerd installed on the remote host is prior to 2.3.7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2026-153 advisory. containerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a craft...

openSUSE 16 Security Update : go1.27 (openSUSE-SU-2026:22153-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:22153-1 advisory. Update to go 1.27.3 bsc1272545: - CVE-2026-111943: crypto/x509: mitigation for security concerns with a specific Certificate Authority bsc1286317,...

Rocky Linux 8 [CIQ] Security Update: grafana / grafana-debuginfo / grafana-debugsource / grafana-selinux Multiple Vulnerabilities (crlsa-2026_88188)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202688188 advisory. net/http: golang: golang: Denial of Service via crafted HTTP Range headers CVE-2026-78667 crypto/tls: golang: crypto/tls: Denial of Service via multiple E...

Rocky Linux 8 [CIQ] Security Update: grafana-pcp / grafana-pcp-debuginfo / grafana-pcp-debugsource Multiple Vulnerabilities (crlsa-2026_88189)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202688189 advisory. crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references CVE-2026-97031 net/http: net/http/internal/http2:...

Rocky Linux 10.2 [CIQ] Security Update: buildah / buildah-debuginfo / buildah-debugsource / buildah-tests / etc Multiple Vulnerabilities (crlsa-2026_88262)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202688262 advisory. podman: Arbitrary file write when importing OCI archive CVE-2025-11395 net/http: golang: golang: Denial of Service via crafted HTTP Range headers...

Amazon Linux 2 : nerdctl (ALAS-2026-4018)

The version of nerdctl installed on the remote host is prior to 2.3.5-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4018 advisory. Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the...

Amazon Linux 2 : docker (ALASNITRO-ENCLAVES-2026-124)

The version of docker installed on the remote host is prior to 25.0.18-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2026-124 advisory. The tar extraction routines in moby/go-archive Unpack, UnpackLayer, Untar/UntarUncompressed, and the...

Rocky Linux 9 [CIQ] Security Update: grafana-pcp / grafana-pcp-debuginfo / grafana-pcp-debugsource Multiple Vulnerabilities (crlsa-2026_88354)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202688354 advisory. crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references CVE-2026-97031 net/http: net/http/internal/http2:...

Amazon Linux 2 : runc (ALASNITRO-ENCLAVES-2026-128)

The version of runc installed on the remote host is prior to 1.4.3-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2026-128 advisory. Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate...

MiracleLinux 8 : grafana-9.2.10-35.el8_10 (AXSA:2026-2136:30)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-2136:30 advisory. grafana: PLUGIN ARCHIVE EXTRACTION ESCAPES THE PLUGIN DIRECTORY, ALLOWING CODE EXECUTION CVE-2026-15815 Tenable has extracted the preceding description block...

Amazon Linux 2 : docker (ALASDOCKER-2026-155)

The version of docker installed on the remote host is prior to 25.0.18-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2026-155 advisory. Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authori...

openSUSE 16: cpupower / cpupower-bash-completion / cpupower-bench / etc (openSUSE-SU-2026:22155-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:22155-1 advisory. This update for cpupower fixes the following issue: - CVE-2026-80663: tools/power/x86/intel-speed-select: Harden daemon pidfile open bsc1278335. Changes...

Amazon Linux 2 : xorg-x11-server (ALAS-2026-4014)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4014 advisory. CheckSetDoodad in xkb/xkb.c frees doodad-text.text on error but doesnot NULL the pointer. When the error path continues, XkbClearDoodad iscalled during cleanup and frees the same pointer again,...

Fedora 43 : perl-Cpanel-JSON-XS (2026-4447e52d23)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-4447e52d23 advisory. Current upstream release, with multiple security fixes, updates for performance and correctness. Tenable has extracted the preceding description blo...

Fedora 44 : php-pecl-mongodb2 (2026-4a5aaed9f5)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-4a5aaed9f5 advisory. Version 2.1.12 Release Highlights - PHPC-276: Prevent stack exhaustion when decoding deeply nested BSON - PHPC-276: Enforce the decode nesting limit...

Linux Distros Unpatched Vulnerability : CVE-2026-114629

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters...

Rocky Linux 8 [CIQ] Security Update: firefox / firefox-debuginfo / firefox-debugsource Multiple Vulnerabilities (crlsa-2026_76850)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202676850 advisory. firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics component CVE-2026-92035 firefox: thunderbird: Use-after-free in...

Amazon Linux 2 : tomcat-native (ALAS-2026-4016)

The version of tomcat-native installed on the remote host is prior to 1.2.38-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-4016 advisory. Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to...

Amazon Linux 2 : tomcat (ALAS-2026-4019)

The version of tomcat installed on the remote host is prior to 7.0.76-10. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4019 advisory. Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints for any WebSocket...

CentOS Linux 8 [TuxCare] Security Update: brotli / brotli-devel / python3-brotli (CENTOS-STREAM8:CLSA-2026:1792827522)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1792827522 advisory. - A buffer overflow vulnerability in the Brotli decoder c/dec/decode.c in Google Brotli versions 1.0.3 through 1.2.0 on all platforms...

Linux Distros Unpatched Vulnerability : CVE-2026-115893

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm brtable instruction wi...

Amazon Linux 2 : kernel (ALASKERNEL-5.4-2026-134)

The version of kernel installed on the remote host is prior to 5.4.302-229.500. It is, therefore, affected by a vulnerability as referenced in the ALAS2KERNEL-5.4-2026-134 advisory. In the Linux kernel, the following vulnerability has been resolved: nitroenclaves: fix use-after-free on SLOTALLOC...

Fedora 43 : dotnet10.0 (2026-c7c459ff4d)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-c7c459ff4d advisory. Update to .NET SDK 10.0.113 and Runtime 10.0.13 Fixes:...

Fedora 43 : ImageMagick (2026-f3c3ff509f)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-f3c3ff509f advisory. Automatic update for ImageMagick-7.1.2.34-1.fc43. Changelog for ImageMagick Thu Oct 15 2026 Luya Tshimbalanga - 1:7.1.2.34-1 - Update to version...

Linux Distros Unpatched Vulnerability : CVE-2026-115775

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, the twisted.words.xish.domish ExpatElementStream...

Fedora 44 : perl-Cpanel-JSON-XS (2026-3ab4727120)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-3ab4727120 advisory. Current upstream release, with multiple security fixes, updates for performance and correctness. Tenable has extracted the preceding description blo...

Amazon Linux 2 : bind (ALAS-2026-4038)

The version of bind installed on the remote host is prior to 9.11.4-26.P2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4038 advisory. Inbound-message resource exhaustion CWE-400 leading to denial of service. No configuration precondition; version...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: openssh (UTSA-2026-143712)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-143712 advisory. sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay. Tenable has extracted the preceding description block directly from the Unity Lin...

MiracleLinux 8 : fetchmail-6.4.24-1.el8_10.1 (AXSA:2026-2138:01)

The remote MiracleLinux 8 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-2138:01 advisory. fetchmail: fetchmail: stack-based buffer overflow in NTLM authentication fetchmail-SA-2026-01 CVE-2026-94184 Tenable has extracted the preceding description...

FreeBSD : vifm -- Unverified Ownership (158544f8-cf02-11f1-b0f1-d0f4051da3a3)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 158544f8-cf02-11f1-b0f1-d0f4051da3a3 advisory. https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/SkX7Pmiofg reports: Vifm 0.8.1-beta through 0.14.4 reuses a...

Linux Distros Unpatched Vulnerability : CVE-2026-115936

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - libio-compress-brotli-perl - None Ubuntu Linux - Unknown description CVE-2026-115936 Note that Nessus relies on the presence of the package as...