Amazon Linux 2 : runfinch-finch (ALASDOCKER-2026-151)

The version of runfinch-finch installed on the remote host is prior to 1.19.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2026-151 advisory. When Trailer headers are sent by a client, the HTTP server internally uses the header values to populate the...

Rocky Linux 10.2 [CIQ] Security Update: podman / podman-debuginfo / podman-debugsource / podman-docker / etc Multiple Vulnerabilities (crlsa-2026_88336)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202688336 advisory. net/http: golang: golang: Denial of Service via crafted HTTP Range headers CVE-2026-78667 net/http: net/http/internal/http2: golang.org/x/net/http2:...

Curl 8.9.0 < 8.23.0 Interface Connection Reuse Issue

The version of curl installed on the remote host is 8.9.0 prior to 8.23.0. It is, therefore, affected by a connection reuse vulnerability: - When CURLOPTINTERFACE or the command line tool's --interface option is set with one of the documented prefixes if!, host!, ifhost!, that binding is not part...

RHEL 9 : php (RHSA-2026:88725)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:88725 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: OOM bailout during request parsi...

SUSE SLED15 / SLES15 Security Update : ca-certificates-mozilla (SUSE-SU-2026:4847-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4847-1 advisory. This update for ca-certificates-mozilla fixes the following issue: Updated to 2.92 state bsc1286261 CVE-2026-114406...

Linux Distros Unpatched Vulnerability : CVE-2026-99084

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: readdir: take no inode lock on an immutable directory iteratedir takes the directory's irwse...

Linux Distros Unpatched Vulnerability : CVE-2026-113356

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText that passes draft file contents to unserialize without...

Linux Distros Unpatched Vulnerability : CVE-2026-101617

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: InnoDB. Supported versions that are affected are MySQL Server: 8.4.0-8.4.12,...

Linux Distros Unpatched Vulnerability : CVE-2026-113720

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the app-data copy seeder uses shutil.copy to copy cached package files...

Linux Distros Unpatched Vulnerability : CVE-2026-115319

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fzf 0.36.0 through 0.74.5 contains an inefficient algorithmic complexity vulnerability in maskActionContents that allows local attackers to exhaust the --listen...

Linux Distros Unpatched Vulnerability : CVE-2026-113791

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF containing a content stream with many small operations,...

Linux Distros Unpatched Vulnerability : CVE-2026-99045

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ibmveth: hfree logical LAN on open-fail after register ibmvethopen registers the logical LAN, then allocates the RX buffer pools. A pool failure jumps to...

Oracle WebCenter Portal (October 2026 CPU)

The 12.2.1.4.0 and 14.1.2.0.0 versions of WebCenter Portal installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2026 CPU advisory. - Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware component: Runtime Tools. Supported...

Linux Distros Unpatched Vulnerability : CVE-2026-101724

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: InnoDB. Supported versions that are affected are MySQL Server: 8.4.0-8.4.12,...

Linux Distros Unpatched Vulnerability : CVE-2026-115387

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 contains a denial of service vulnerability in wasmtime-wasi that allows guest WASI...

RHEL 10 : ca-certificates (RHSA-2026:88560)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:88560 advisory. The ca-certificates package contains a set of Certificate Authority CA certificates chosen by the Mozilla Foundation for use with the Internet Publ...

Linux Distros Unpatched Vulnerability : CVE-2026-98935

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rtc: dev: zero-initialize struct rtcwkalrm to prevent information leak The struct rtcwkalrm has padding holes after the 'pending' member. When returned to...

Linux Distros Unpatched Vulnerability : CVE-2026-115393

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Wasmtime before 24.0.12, 25.0.0 before 36.0.13, 37.0.0 before 46.0.2, and 47.0.0 before 47.0.3 contains a type confusion vulnerability because several Store API...

Linux Distros Unpatched Vulnerability : CVE-2026-101679

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Client programs. Supported versions that are affected are MySQL Server:...

SUSE SLED15: WebKitGTK-4.0-lang / WebKitGTK-4.1-lang / WebKitGTK-6.0-lang / etc (SUSE-SU-2026:4858-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4858-1 advisory. Security issues fixed: WebKitGTK and WPE WebKit Security Advisory WSA-2026-0006 bsc1284619: - CVE-2024-1283:...

Linux Distros Unpatched Vulnerability : CVE-2026-101804

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Connectors product of Oracle MySQL component: Connector/ODBC. The supported version that is affected is 26.7.1. Difficult to exploit...

Fedora 46 : zvbi (2026-35bfa5085a)

The remote Fedora 46 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-35bfa5085a advisory. Automatic update for zvbi-0.2.46-1.fc46. Changelog Thu Oct 22 2026 Xavier Bachelot - 0.2.46-1 - Update to 0.2.46 RHBZ2559223 - Fixes CVE-2026-11065...

Linux Distros Unpatched Vulnerability : CVE-2026-99080

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fs: Free any excess xarray nodes in clearinode For many years we've had a hard to hit leak of xarray nodes. Hugh documented it well in commit 786b31121a2c...

Oracle Linux 9 : ca-certificates (ELSA-2026-88459)

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-88459 advisory. 2026.2.92v9.0.319-90.3 - Fix malformed patch header in remove-emsign-root-cs-ca-g3.patch 2026.2.92v9.0.319-90.2 - Removing: emSign Root CS CA - G3 from Microso...

Linux Distros Unpatched Vulnerability : CVE-2026-97631

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - EDK2 contains a vulnerability in BIOS where a user may cause Out-of-bounds Write, Classic Buffer Overflow, and Incorrect Calculation of Buffer Size by remote...

Rocky Linux 8.6 [CIQ] Security Update: bpftool / kernel / kernel-abi-stablelists / kernel-core / etc (ciqsa-2026_1680)

The Rocky Linux 8.6 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261680 advisory. This advisory aggregates security fixes for the kernel SRPM in CIQ FIPS 8.6 Compliant. It addresses 1 CVE: CVE-2026-99999. Tenable has extracted the preceding...

Curl 7.56.0 < 8.23.0 MIME Stack Overflow

The version of curl installed on the remote host is 7.56.0 prior to 8.23.0. It is, therefore, affected by a stack overflow vulnerability: - A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An excessive...

SUSE SLES16: coreutils / coreutils-doc / coreutils-lang / coreutils-single / etc (SUSE-SU-2026:24268-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:24268-1 advisory. This update for coreutils fixes the following issue: - CVE-2026-56391: uniq: denial of service and information disclosure via out-of-bounds...

Linux Distros Unpatched Vulnerability : CVE-2026-101622

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: InnoDB. Supported versions that are affected are MySQL Server: 8.4.0-8.4.12,...

Linux Distros Unpatched Vulnerability : CVE-2026-113400

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uninitialized memory in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1. CVE-2026-113400 Note that...

FreeBSD : Keycloak -- multiple vulnerabilities (5101359e-ce3c-11f1-bf7a-3c7c3fba4204)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 5101359e-ce3c-11f1-bf7a-3c7c3fba4204 advisory. The Keycloak Team reports: Tenable has extracted the preceding description block directly from...

AlmaLinux 9.2 [TuxCare] Security Update: thunderbird Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1792779937)

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792779937 advisory. - Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbi...

Rocky Linux 8.6 [CIQ] Security Update: bpftool / kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ciqsa-2026_1670)

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261670 advisory. This advisory aggregates security fixes for the kernel SRPM in CIQ FIPS 8.6 Compliant. It addresses 3 CVEs: CVE-2026-23386, CVE-2025-38735, CVE-2025-7115...

Cisco Secure Client Secure Firewall Posture Module Privilege Escalation (cisco-sa-sec-client-priv-esc-muF8eZdm)

According to its self-reported version, Cisco Secure Client is affected by a vulnerability. - A vulnerability in the interprocess communication IPC channel of the Secure Firewall Posture module in Cisco Secure Client could allow an authenticated, local attacker to elevate privileges on an affecte...

Linux Distros Unpatched Vulnerability : CVE-2026-114655

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libmongocrypt builds requests to external key management services AWS, Azure and GCP by inserting values from key vault documents, KMS provider configuration an...

AlmaLinux 9.2 [TuxCare] Security Update: nodejs / nodejs-devel / nodejs-docs / nodejs-full-i18n / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1792746902)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792746902 advisory. - This vulnerability affects Node.js 26.x, 24.x, and 22.x. Thank you, to hasanfleyah for reporting this vulnerability and thank you...

Linux Distros Unpatched Vulnerability : CVE-2026-114617

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDMixin.parseidtoken reads the noncesupported decision from the...

SUSE SLES16 Security Update : guava (SUSE-SU-2026:24263-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:24263-1 advisory. This update for guava fixes the following issue: - CVE-2026-102554: Allocation of resources without limits or throttling CWE-770 during Jav...

RockyLinux 9 : firefox (RLSA-2026:76761)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:76761 advisory. firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics component CVE-2026-92035 firefox: thunderbird: Use-after-free ...

Linux Distros Unpatched Vulnerability : CVE-2026-101608

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are MySQL Server:...

RHEL 9 : thunderbird (RHSA-2026:85242)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:85242 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Use-after-free in the Graphics: Canvas...

Linux Distros Unpatched Vulnerability : CVE-2026-99015

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: hcisock: Serialize dead-device detachment Rebinding an HCI socket after its controller is unregistered can race monitor control replay and crash the...

Linux Distros Unpatched Vulnerability : CVE-2026-101727

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Replication. Supported versions that are affected are MySQL Server:...

Linux Distros Unpatched Vulnerability : CVE-2026-106071

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard --allow-fs-read or --allow-fs-write rule. When...

Linux Distros Unpatched Vulnerability : CVE-2026-115506

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs protection in accountingDiffTolerated in xmlparse.c detects entity...

Linux Distros Unpatched Vulnerability : CVE-2026-99040

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KEYS: Fix addkey race with keyring restriction keycreateorupdate snapshots keyring-restrictlink before taking the destination keyring's semaphore. keyringrestri...

MiracleLinux 9 : python3.12-urllib3-1.26.19-3.el9_8.2 (AXSA:2026-2125:05)

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-2125:05 advisory. urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser CVE-2026-97689 urllib3: urllib3: Traffic interception via HTTPS...

Linux Distros Unpatched Vulnerability : CVE-2026-101677

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Connectors product of Oracle MySQL component: Connector/J. The supported version that is affected is 26.7.0. Easily exploitable...

Linux Distros Unpatched Vulnerability : CVE-2026-98950

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - flowdissector: avoid u16 truncation of hlen in bpfflowdissect bpfflowdissect sanitizes the offsets returned by the BPF program with clamptu16, ..., hlen. If hle...

Linux Distros Unpatched Vulnerability : CVE-2025-60475

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A buffer overflow in the gfac4parserbs function /mediatools/avparsers.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via...