Linux Distros Unpatched Vulnerability : CVE-2026-114603

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.1, the opentelemetry-api function TraceState.fromheader in...

Linux Distros Unpatched Vulnerability : CVE-2026-115585

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an incomplete remediation for repeated malformed cross-reference entries in...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: php (UTSA-2026-143717)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-143717 advisory. The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowedclients matches on a /96 prefix inste...

Amazon Linux 2 : php (ALAS-2026-4015)

The version of php installed on the remote host is prior to 5.4.16-46. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-4015 advisory. cleanupxmlnode in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a...

Rocky Linux 10.2 [CIQ] Security Update: firefox / firefox-debuginfo / firefox-debugsource Multiple Vulnerabilities (crlsa-2026_76764)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202676764 advisory. firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics component CVE-2026-92035 firefox: thunderbird: Use-after-free...

Rocky Linux 8 [CIQ] Security Update: bpftool / bpftool-debuginfo / kernel / kernel-abi-stablelists / etc Multiple Vulnerabilities (crlsa-2026_87375)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202687375 advisory. kernel: ipv4: raw: reject IPHDRINCL packets with ihl msiperm after freeing it on init failure CVE-2026-89777 Tenable has extracted the preceding descripti...

Linux Distros Unpatched Vulnerability : CVE-2026-115774

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.mail.imap4.IMAP4Server reaches...

Amazon Linux 2 : mod_security (ALAS-2026-4010)

The version of modsecurity installed on the remote host is prior to 2.9.15-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-4010 advisory. GHSA-5pww-8rfg-9crf: RFC 2231 filename parameter bypasses multipart filename rules CVE-2026-104269 Tenable has extracted the...

openSUSE 16 Security Update : ca-certificates-mozilla (openSUSE-SU-2026:22154-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:22154-1 advisory. This update for ca-certificates-mozilla fixes the following issue: Updated to 2.92 state bsc1286261 Removed: - emSign ECC Root CA - C3 - emSign ECC Root...

Amazon Linux 2 : tigervnc (ALAS-2026-4013)

The version of tigervnc installed on the remote host is prior to 1.8.0-24. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4013 advisory. CheckSetDoodad in xkb/xkb.c frees doodad-text.text on error but doesnot NULL the pointer. When the error path continues,...

FreeBSD : ca_root_nss -- trusted root certificate from compromised CA eMudhra (b755b277-cf12-11f1-bae2-3497f65b111b)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the b755b277-cf12-11f1-bae2-3497f65b111b advisory. eMudhra generated several of its TLS intermediate CA certificates with trivially small private keys,...

Amazon Linux 2 : cifs-utils (ALAS-2026-4032)

The version of cifs-utils installed on the remote host is prior to 6.2-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-4032 advisory. A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation. When a privileged...

Fedora 43 : gegl04 (2026-b5ff201bad)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-b5ff201bad advisory. This update fixes an overflow in parsing RGBE/HDR image files. Tenable has extracted the preceding description block directly from the Fedora security...

MiracleLinux 8 : ca-certificates-2026.2.92_v9.0.319-81.3.el8_10 (AXSA:2026-2141:03)

The remote MiracleLinux 8 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-2141:03 advisory. ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns CVE-2026-114406 Tenable has extracted the preceding description block...

Amazon Linux 2 : python3-tornado (ALAS-2026-4033)

The version of python3-tornado installed on the remote host is prior to 5.0.2-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-4033 advisory. Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows...

Fedora 44 : chromium (2026-ccc7071380)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-ccc7071380 advisory. Update to 156.0.8078.47, include 353 security fixes: CVE-2026-112992 - CVE-2026-113344 Tenable has extracted the preceding description block directl...

Linux Distros Unpatched Vulnerability : CVE-2026-115889

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit- packs SSA value indices in a way that can silently...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: php (UTSA-2026-143721)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-143721 advisory. phartarnumber parses the octal size field of a TAR header into a uint32t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF...

Linux Distros Unpatched Vulnerability : CVE-2026-115572

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF that repeatedly references the same nonexistent indirect...

Linux Distros Unpatched Vulnerability : CVE-2026-115863

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in getdomains in gdhcp/client.c. It copies a fixed NSMAXDNAME 1025...

CentOS Linux 7.9 [CIQ] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-devel / etc Multiple Vulnerabilities (ciqsa-2026_1717)

The CentOS Linux 7.9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261717 advisory. This advisory aggregates security fixes for the php SRPM in CIQ CentOS Bridge 7.9. It addresses 2 CVEs: CVE-2026-109619, CVE-2026-109618. Tenable has...

AlmaLinux 9.6 [TuxCare] Security Update: tigervnc / tigervnc-icons / tigervnc-license / tigervnc-selinux / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1792819460)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792819460 advisory. - xorg-x11-server: xorg-x11-server: arbitrary code execution via GLX RenderLarge heap-based buffer overflow CVE-2026-93517 -...

FreeBSD : Gitlab -- vulnerabilities (7db37b57-ced8-11f1-ac90-2cf05da270f3)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 7db37b57-ced8-11f1-ac90-2cf05da270f3 advisory. Gitlab reports: Integer Overflow issue in Regular Expression Compiler impacts GitLab CE/EE...

Amazon Linux 2 : perl (ALAS-2026-4026)

The version of perl installed on the remote host is prior to 5.16.3-299. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4026 advisory. Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: php (UTSA-2026-143719)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-143719 advisory. cleanupxmlnode in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of...

Linux Distros Unpatched Vulnerability : CVE-2026-115557

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Python has added a denylist for known compromised certificates to the ssl module to ensure user safety even without certificate revocation configured. Known...

Fedora 43 : dotnet9.0 (2026-22271e9271)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-22271e9271 advisory. Update to .NET SDK 9.0.122 and Runtime 9.0.21 Fixes: CVE-2026-105016,CVE-2026-58280,CVE-2026-66822,CVE-2026-69651,CVE-2026-70007,CVE-2026-70035,CVE-...

Rocky Linux 9 [CIQ] Security Update: expat / expat-debuginfo / expat-debugsource / expat-devel Multiple Vulnerabilities (crlsa-2026_88247)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202688247 advisory. expat: expat: Denial of Service via integer overflow in expatrealloc CVE-2026-102633 expat: expat: Information disclosure via heap buffer over-read in...

Amazon Linux 2 : cyrus-sasl (ALAS-2026-4029)

The version of cyrus-sasl installed on the remote host is prior to 2.1.26-24. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-4029 advisory. A heap-based buffer overflow flaw was found in Cyrus SASL. The addtochallenge function in the DIGEST- MD5 plugin computes the...

Amazon Linux 2 : ca-certificates (ALAS-2026-4037)

The version of ca-certificates installed on the remote host is prior to 2025.2.76-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-4037 advisory. Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was distributed t...

RockyLinux 10 : kernel (RLSA-2026:88477)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:88477 advisory. kernel: calipso: Don't call calipso functions for AFINET sk. CVE-2025-38147 kernel: ipv4: raw: reject IPHDRINCL packets with ihl 5 CVE-2026-64114 kerne...

Amazon Linux 2 : java-11-amazon-corretto (ALAS-2026-4039)

The version of java-11-amazon-corretto installed on the remote host is prior to 11.0.33.0.9-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4039 advisory. Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October whic...

Rocky Linux 10.2 [CIQ] Security Update: pgvector / pgvector-debuginfo / postgresql16-pgvector-debugsource (crlsa-2026_88359)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202688359 advisory. pgvector: pgvector: Arbitrary code execution via out-of-bounds write during IVFFlat index build CVE-2026-103484 Tenable has extracted the preceding description...

Fedora 43 : GitPython (2026-06f2df2b0c)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-06f2df2b0c advisory. Update to 3.2.1; security fix for GHSA-83vg-56qc-22m7 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note...

Rocky Linux 10.2 [CIQ] Security Update: expat / expat-debuginfo / expat-debugsource / expat-devel Multiple Vulnerabilities (crlsa-2026_88248)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202688248 advisory. expat: expat: Denial of Service via integer overflow in expatrealloc CVE-2026-102633 expat: expat: Information disclosure via heap buffer over-read in...

Amazon Linux 2 : cni-plugins (ALAS-2026-4017)

The version of cni-plugins installed on the remote host is prior to 1.7.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4017 advisory. When Trailer headers are sent by a client, the HTTP server internally uses the header values to populate the...

Debian dsa-6583 : heif-gdk-pixbuf - security update

The remote Debian 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6583 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6583-1 [email protected] https://www.debian.org/security/ Aron X...

Amazon Linux 2 : amazon-ecr-credential-helper (ALASDOCKER-2026-149)

The version of amazon-ecr-credential-helper installed on the remote host is prior to 0.12.0-5. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2026-149 advisory. When Trailer headers are sent by a client, the HTTP server internally uses the header values to...

Amazon Linux 2 : oci-add-hooks (ALASDOCKER-2026-150)

The version of oci-add-hooks installed on the remote host is prior to 0-0.12.20200504git325a340. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2026-150 advisory. When Trailer headers are sent by a client, the HTTP server internally uses the header values ...

Amazon Linux 2 : oci-add-hooks (ALASNITRO-ENCLAVES-2026-127)

The version of oci-add-hooks installed on the remote host is prior to 0-0.12.20200504git325a340. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2026-127 advisory. When Trailer headers are sent by a client, the HTTP server internally uses the header...

Amazon Linux 2 : docker (ALASDOCKER-2026-152)

The version of docker installed on the remote host is prior to 25.0.18-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2026-152 advisory. The tar extraction routines in moby/go-archive Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer...

Amazon Linux 2 : cri-tools (ALAS-2026-4042)

The version of cri-tools installed on the remote host is prior to 1.32.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4042 advisory. Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority...

Amazon Linux 2 : amazon-ecr-credential-helper (ALASNITRO-ENCLAVES-2026-126)

The version of amazon-ecr-credential-helper installed on the remote host is prior to 0.12.0-5. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2026-126 advisory. When Trailer headers are sent by a client, the HTTP server internally uses the header...

openSUSE 16 Security Update : go1.26 (openSUSE-SU-2026:22152-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22152-1 advisory. Update to go 1.26.10 bsc1255111: - CVE-2026-78663: net/http: double flow control refund on HTTP/2 server streams bsc1284770. - CVE-2026-78669:...

Rocky Linux 10.2 [CIQ] Security Update: grafana-pcp / grafana-pcp-debuginfo / grafana-pcp-debugsource Multiple Vulnerabilities (crlsa-2026_88316)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202688316 advisory. crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references CVE-2026-97031 net/http: net/http/internal/http2:...

Amazon Linux 2 : golang (ALAS-2026-4043)

The version of golang installed on the remote host is prior to 1.26.10-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-4043 advisory. Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority CA, the Go'...

Amazon Linux 2 : soci-snapshotter (ALASDOCKER-2026-148)

The version of soci-snapshotter installed on the remote host is prior to 0.16.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2026-148 advisory. When Trailer headers are sent by a client, the HTTP server internally uses the header values to populate th...

Linux Distros Unpatched Vulnerability : CVE-2026-115775

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, the twisted.words.xish.domish ExpatElementStream...

Amazon Linux 2 : qemu (ALAS-2026-4009)

The version of qemu installed on the remote host is prior to 3.1.0-8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4009 advisory. NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/1f24066fc88d33455ee54a20f29994d9e69997ba v11.1.0-rc3NOTE: Fixed...

Rocky Linux 9.6 [TuxCare] Security Update: tigervnc / tigervnc-icons / tigervnc-license / tigervnc-selinux / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1792819460)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792819460 advisory. - xorg-x11-server: xorg-x11-server: arbitrary code execution via GLX RenderLarge heap-based buffer overflow CVE-2026-93517 -...