Debian dsa-6450 : libsrt-doc - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6450 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6450-1 [email protected] https://www.debian.org/securit...

AlmaLinux 9 : gstreamer1-plugins-bad-free and gstreamer1-plugins-ugly-free (ALSA-2026:55865)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:55865 advisory. gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec IMA/DVI ADPCM decoder CVE-2026-19387 gstreamer:...

Linux Distros Unpatched Vulnerability : CVE-2026-72104

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - dm-pcache: reject option groups without values The pcache target parses optional arguments as name/value pairs. A table that advertises one optional argument an...

Linux Distros Unpatched Vulnerability : CVE-2026-72498

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RDMA/bnxtre: Avoid displaying the kernel pointer While dumping the info on MR using the rdma tool, we dump the mrhwq which is a kernel pointer. There is no need...

Linux Distros Unpatched Vulnerability : CVE-2026-72353

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid stale runlist element dereference in fallocate ntfsattrfallocate allocates holes...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-101986)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101986 advisory. In the Linux kernel, the following vulnerability has been resolved: viawdt: fix critical boot hang due to unnamed resource allocation The VIA watchdog driver uses...

RockyLinux 10 : .NET 10.0 (RLSA-2026:55858)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:55858 advisory. .NET: .NET Core: .NET Security Feature Bypass Vulnerability CVE-2026-62899 .NET: .NET Information Disclosure Vulnerability CVE-2026-62900 .NET: .NET...

Linux Distros Unpatched Vulnerability : CVE-2026-72171

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mtd: slram: remove failed entries from the device list registerdevice links a new slrammtdlist entry before allocating all of the state needed by the entry. If ...

Linux Distros Unpatched Vulnerability : CVE-2026-72340

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: microchip: vcap: fix races on the shared Super VCAP block The VCAP instances on a chip are not independent, yet they are locked independently. On sparx5 an...

RockyLinux 9 : gstreamer1-plugins-bad-free and gstreamer1-plugins-ugly-free (RLSA-2026:55865)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:55865 advisory. gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec IMA/DVI ADPCM decoder CVE-2026-19387 gstreamer:...

Linux Distros Unpatched Vulnerability : CVE-2026-72445

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: usb-audio: qcom: clear opened when stream enable fails On enable, subs-opened is set before the serviceinterval is validated; an invalid interval jumps to...

Linux Distros Unpatched Vulnerability : CVE-2026-72258

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ASoC: mediatek: mt8183: Release reserved memory on cleanup The MT8183 AFE probe can assign reserved memory with ofreservedmemdeviceinit, but the assignment is...

Linux Distros Unpatched Vulnerability : CVE-2026-72446

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: usb-audio: qcom: reject stream disable with no active interface handleuaudiostreamreq resolves an interface index with infoidxfromifnum, which returns...

Linux Distros Unpatched Vulnerability : CVE-2026-74343

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: kernfs: fix xattr race condition with multiple superblocks Multiple superblocks with differe...

GitLab 18.2 < 18.11.11 / 19.0 < 19.0.8 / 19.1 < 19.1.6 / 19.2 < 19.2.4 (CVE-2026-19650)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could have...

Linux Distros Unpatched Vulnerability : CVE-2026-19999

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A security vulnerability has been detected in Open Asset Import Library Assimp Assimp 17c12da. The affected element is the function...

RHEL 8 : haproxy (RHSA-2026:55859)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:55859 advisory. The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications. Security Fixes: haproxy: HAProx...

RHEL 9 : redhat-ds:12 (RHSA-2026:56050)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:56050 advisory. Red Hat Directory Server is an LDAPv3-compliant directory server. The suite of packages includes the Lightweight Directory Access Protocol...

Linux Distros Unpatched Vulnerability : CVE-2026-74412

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: rtw88: fix wrong pcigetdrvdata type in AER handlers rtw88 stores an ieee80211hw pointer via pcisetdrvdata at probe time, but ioerrordetected and ioresume...

Linux Distros Unpatched Vulnerability : CVE-2026-72257

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ASoC: qcom: q6apm: fix NULL pointer dereference in graphcallback When q6apmfreefragments is called it frees rxdata.buf/txdata.buf and sets them to NULL under...

Linux Distros Unpatched Vulnerability : CVE-2026-72134

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - spi: imx: reconfigure for PIO when DMA cannot be started When spiimxcandma selects DMA, the ECSPI is configured for DMA: spiimxsetupxfer sets CTRL.SMC and clear...

RockyLinux 9 : postgresql (RLSA-2026:52395)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:52395 advisory. postgresql: PostgreSQL: Denial of Service via uncontrolled recursion in SSL/GSS negotiation CVE-2026-6479 Tenable has extracted the preceding description block...

Linux Distros Unpatched Vulnerability : CVE-2026-72417

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfilter: flowtable: Validate iph-ihl in nfflowip4tunnelproto Add sanity check for iph-ihl field in nfflowip4tunnelproto before using it to compute the header...

Linux Distros Unpatched Vulnerability : CVE-2026-72387

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/panthor: Fix potential invalid pointer deref in groupprocesstileroom If heaps is an ERRPTR, panthorheappoolput will deref an invalid pointer. Make sure we s...

Linux Distros Unpatched Vulnerability : CVE-2026-72058

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: ixp4xxhss: fix duplicate HDLC netdev allocation ixp4xxhssprobe allocates two HDLC netdevs. The first one is stored in ndev, initialized, and registered wit...

Linux Distros Unpatched Vulnerability : CVE-2026-72022

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - llc: fix SAP refcount leak in llcuiautobind llcuiautobind opens a SAP after choosing a dynamic LSAP. llcsapopen returns a reference owned by the caller, and...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-101995)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101995 advisory. In the Linux kernel, the following vulnerability has been resolved: ipmi:si: Return state to normal if message allocation fails There were places where nothing would...

Linux Distros Unpatched Vulnerability : CVE-2026-72479

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iio: accel: mma8452: handle I2C read errors in mma8452read Currently, If i2csmbusreadi2cblockdata fails but mma8452setruntimepmstate succeeds, mma8452read retur...

Linux Distros Unpatched Vulnerability : CVE-2026-75010

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the modoboa driver of the password plugin could leak a Modoboa API authentication token to a...

Linux Distros Unpatched Vulnerability : CVE-2026-74301

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: btmtk: fix URB leak in allocmtkintrurb error path When btmtkisopktpad fails, the previously allocated URB is not freed, leaking the urb structure. Ad...

Amazon Linux 2 : containerd, --advisory ALAS2DOCKER-2026-139 (ALASDOCKER-2026-139)

The version of containerd installed on the remote host is prior to 2.1.9-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2DOCKER-2026-139 advisory. A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes. CVE-2026-56852 Tenable has...

Linux Distros Unpatched Vulnerability : CVE-2026-72274

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fbdev: hecubafb: fix potential memory leak in hecubafbprobe The memory allocated for pagerefs in fbdeferredioinit is not freed on the error path. Fix it by...

Linux Distros Unpatched Vulnerability : CVE-2026-72109

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: sparx5: unregister blocking notifier on init failure sparx5registernotifierblocks registers the switchdev blocking notifier before allocating the ordered...

Linux Distros Unpatched Vulnerability : CVE-2026-72327

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/v3d: Reject invalid indirect BO handle in indirect CSD setup v3dgetcpuindirectcsdparams looks up the indirect buffer object from a userspace-supplied handle...

Amazon Linux 2023 : iscsi-initiator-utils, iscsi-initiator-utils-devel, iscsi-initiator-utils-iscsiuio (ALAS2023-2026-2066)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2066 advisory. An Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in open- iscsi allows remote MITM attackers to create root-owned files outside the database and...

Oracle Linux 10 : haproxy (ELSA-2026-55679)

The remote Oracle Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-55679 advisory. - Fix uint16t overflow in FCGI demux record length CVE-2026-55203 Resolves: RHEL-211068 Tenable has extracted the preceding description block directl...

Linux Distros Unpatched Vulnerability : CVE-2026-72097

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - dm-verity: fix a possible NULL pointer dereference Fix a possible NULL pointer dereference dmverityloadpinisbdevtrusted if the device has no table. CVE-2026-720...

Linux Distros Unpatched Vulnerability : CVE-2026-74325

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: mt76: use kfreercu for offchannel link in mt76putvifphylink mt76putvifphylink frees the offchannel mlink with plain kfree after rcuassignpointerNULL...

AlmaLinux 10 : curl (ALSA-2026:55432)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:55432 advisory. curl: Information disclosure due to uncleared proxy authentication state CVE-2026-8927 Tenable has extracted the preceding description block directly from the...

MiracleLinux 8 : nodejs:24 (AXSA:2026-1566:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1566:01 advisory. sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data CVE-2026-11822 sqlite: SQLite: Arbitrary code execution and crash vi...

GLSA-202608-16 : nginx: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202608-16 nginx: Multiple Vulnerabilities Multiple vulnerabilities have been discovered in nginx. Please review the CVE identifiers referenced below for details. Tenable has extracted the preceding description block directly from...

Amazon Linux 2 : gimp, --advisory ALAS2GIMP-2026-018 (ALASGIMP-2026-018)

The version of gimp installed on the remote host is prior to 2.8.22-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2GIMP-2026-018 advisory. A flaw was found in the file-sgi plugin in GIMP. When processing an RLE-compressed SGI image, the plugin allocates memory for a ro...

Linux Distros Unpatched Vulnerability : CVE-2026-74262

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - kcm: use WRITEONCE when changing lower socket callbacks kcmattach replaces a live lower TCP socket's skdataready and skwritespace callbacks with KCM handlers, a...

Linux Distros Unpatched Vulnerability : CVE-2026-72156

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fpga: microchip-spi: fix zero headersize OOB read in mpfopsparseheader mpfopsparseheader reads headersize from the bitstream at MPFHEADERSIZEOFFSET 24. When...

Linux Distros Unpatched Vulnerability : CVE-2026-74360

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Reject exclusive maps for bpfmapelem iterators Exclusive maps aka exclproghash are meant to be reachable only from the single program whose hash matches...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102117)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102117 advisory. In the Linux kernel, the following vulnerability has been resolved: libceph: Prevent potential null-ptr-deref in cephhandleauthreply If a message of type...

Linux Distros Unpatched Vulnerability : CVE-2026-72214

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - power: supply: cpcap-battery: Fix missing nvmemdeviceput causing reference leak In cpcapbatterydetectbatterytype, the reference to an nvmem device obtained via...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-101963)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101963 advisory. In the Linux kernel, the following vulnerability has been resolved: ocfs2: split transactions in dio completion to avoid credit exhaustion During ocfs2 dio operation...

Linux Distros Unpatched Vulnerability : CVE-2026-75003

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, an unclosed url in a FuncIRI attribute of an SVG image could evade the remote image blocking, which m...

Fedora 43 : coturn (2026-13e2cf6827)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-13e2cf6827 advisory. Coturn 4.17.2 What's Changed Fix outgoing UDP TTL pinned to 1 on client-facing sockets Coturn 4.17.1 Gate merges on the more tests suites build: Dro...