Linux Distros Unpatched Vulnerability : CVE-2026-115327

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxmlenvnetconfrpc in src/parserxml.c when parsing NETCONF rpc action envelopes...

Rocky Linux 8.6 [CIQ] Security Update: bpftool / kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ciqsa-2026_1673)

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261673 advisory. This advisory aggregates security fixes for the kernel SRPM in CIQ FIPS 8.6 Compliant. It addresses 5 CVEs: CVE-2026-74469, CVE-2026-68121, CVE-2026-8084...

Linux Distros Unpatched Vulnerability : CVE-2026-105239

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Neutralization of Null Byte or NUL Character vulnerability in the EventLogAppender of Apache log4net. A NUL character in logged content ended the Windo...

Rocky Linux 9.6 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ciqsa-2026_1666)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261666 advisory. This advisory aggregates security fixes for the kernel SRPM in CIQ FIPS 9.6 Compliant. It addresses 17 CVEs: CVE-2026-74705, CVE-2026-99999,...

CentOS Linux 8 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1792759740)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1792759740 advisory. - In the Linux kernel, the following vulnerability has been resolved: mrp: introduce active flags to prevent UAF when applicant...

Rocky Linux 8.10 [CIQ] Security Update: bpftool / kernel / kernel-abi-stablelists / kernel-core / etc (ciqsa-2026_1690)

The Rocky Linux 8.10 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261690 advisory. This advisory aggregates security fixes for the kernel SRPM in CIQ Core 8.10. It addresses 1 CVE: CVE-2026-46333. Tenable has extracted the preceding description...

Rocky Linux 9.6 [TuxCare] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1792762308)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792762308 advisory. - In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Synchronous access b/w reset and tm thread for...

CentOS Linux 8.5 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1792750763)

"The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1792750763 advisory. - In the Linux kernel, the following vulnerability has been resolved: RDMA: Fix use-after-free in rxequeuecleanup On error handling...

Rocky Linux 8.6 [CIQ] Security Update: bpftool / kernel / kernel-abi-stablelists / kernel-core / etc (ciqsa-2026_1677)

The Rocky Linux 8.6 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261677 advisory. This advisory aggregates security fixes for the kernel SRPM in CIQ FIPS 8.6 Compliant. It addresses 1 CVE: CVE-2026-46300. Tenable has extracted the preceding...

Linux Distros Unpatched Vulnerability : CVE-2026-101726

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: C API. Supported versions that are affected are MySQL Server: 8.4.0-8.4.12,...

RockyLinux 9 : expat (RLSA-2026:88247)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:88247 advisory. expat: expat: Denial of Service via integer overflow in expatrealloc CVE-2026-102633 expat: expat: Information disclosure via heap buffer over-read in...

Linux Distros Unpatched Vulnerability : CVE-2026-112054

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Schroedinger libschroedinger through 1.0.11 contains a divide by zero vulnerability that allows attackers to crash applications by supplying a zero...

Microsoft PowerToys < 0.101.2632.0 Elevation of Privilege (October 2026)

The version of Microsoft PowerToys installed on the remote host is affected by an elevation of privilege vulnerability as referenced in the October 2026 Microsoft Security Update advisory. - External control of system or configuration setting in Microsoft PowerToys allows an authorized attacker t...

Linux Distros Unpatched Vulnerability : CVE-2026-106454

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Twisted is an event-based framework for internet applications, supporting Python 3.6+. In 25.5.0 and earlier, wildcardToRegexp in twisted/mail/imap4.py translat...

Linux Distros Unpatched Vulnerability : CVE-2026-105244

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache log4net. Every character outside visible ASCII and space was removed...

Linux Distros Unpatched Vulnerability : CVE-2026-114458

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in modqos. An unauthenticated remote attacker can cause a Denial of Service DoS by maintaining numerous concurrent low-rate connections to a...

MiracleLinux 9 : postgresql:16 (AXSA:2026-2114:01)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-2114:01 advisory. pgvector: pgvector: Arbitrary code execution via out-of-bounds write during IVFFlat index build CVE-2026-103484 Tenable has extracted the preceding descripti...

Linux Distros Unpatched Vulnerability : CVE-2026-98990

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - namespace: check a submount for references right before unmounting it shrinksubmounts and markmountsforexpiry first collect all the mounts they are allowed to...

Linux Distros Unpatched Vulnerability : CVE-2026-114619

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDImplicitGrant.validateauthorizationrequest checks the...

Linux Distros Unpatched Vulnerability : CVE-2026-115351

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mistune from 3.2.1 before 3.3.0 contains a CSS injection vulnerability that allows attackers controlling markdown input to inject arbitrary style declarations v...

Linux Distros Unpatched Vulnerability : CVE-2026-98924

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fs: avoid repeated scans in evictinodes We observed hung tasks when users attempted to unmount a filesystem after its disk had been removed while still in use...

Linux Distros Unpatched Vulnerability : CVE-2025-60493

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A segmentation violation in the checkmediaprofile function /mp4box/mp4box.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS...

Linux Distros Unpatched Vulnerability : CVE-2026-98904

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mailbox: imx: Use devmpmruntimeenable sashiko complained about early usage of the device while probe isn't completed. This can be mitigated by delaying the...

Linux Distros Unpatched Vulnerability : CVE-2026-93536

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A use after free caused by missing lifecycle management of gesture sprites in GestureBuildSprite in X.Org X Server before 21.1.25 and XWayland before 24.1.14...

SUSE SLES15: apache2-mod_php8 / php8 / php8-bcmath / php8-bz2 / php8-calendar / etc (SUSE-SU-2026:4852-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4852-1 advisory. This update for php8 fixes the following issue: - CVE-2026-109618,CVE-2026-109619: memory corruption leading to RCE bsc1286027...

RockyLinux 8 : ca-certificates (RLSA-2026:88550)

The remote RockyLinux 8 host has a package installed that is affected by a vulnerability as referenced in the RLSA-2026:88550 advisory. ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns CVE-2026-114406 Tenable has extracted the preceding description block...

Linux Distros Unpatched Vulnerability : CVE-2026-113714

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, downloadwheel writes package-index downloads directly into the reusabl...

Linux Distros Unpatched Vulnerability : CVE-2026-101806

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Connectors product of Oracle MySQL component: Connector/ODBC. The supported version that is affected is 26.7.1. Difficult to exploit...

Linux Distros Unpatched Vulnerability : CVE-2026-98901

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ksmbd: fix lease break and ack state handling Do not skip valid lease states containing WRITECACHING when breaking level-II/read leases for writes and truncates...

Linux Distros Unpatched Vulnerability : CVE-2025-60497

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A segmentation violation in the GetESD function /isomedia/track.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via...

Linux Distros Unpatched Vulnerability : CVE-2026-101751

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Group Replication GCS. Supported versions that are affected are MySQ...

Linux Distros Unpatched Vulnerability : CVE-2026-101796

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Replication. Supported versions that are affected are MySQL Server:...

Linux Distros Unpatched Vulnerability : CVE-2026-101798

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are MySQL Server:...

Linux Distros Unpatched Vulnerability : CVE-2026-115347

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parselinktext that allows remote attackers to cause denial of service throu...

Linux Distros Unpatched Vulnerability : CVE-2026-99083

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ksmbd: fix heap out-of-bounds write in krb5authenticate In krb5authenticate, outlen is calculated to determine available headroom in responsebuf for the incomin...

Linux Distros Unpatched Vulnerability : CVE-2026-93524

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A buffer overread in CheckKeySyms in X.Org X Server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to leak small amounts of...

SUSE SLES12: apache2-mod_php74 / php74 / php74-bcmath / php74-bz2 / etc (SUSE-SU-2026:4870-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4870-1 advisory. Fixed two security issues: - CVE-2026-109618: memory corruption leading to RCE - CVE-2026-109619: memory corruption leading to RCE...

Linux Distros Unpatched Vulnerability : CVE-2026-107168

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in m17n-lib. By providing crafted input containing an invalid UTF-8 character sequence, an attacker can cause the text parsing function to ente...

Linux Distros Unpatched Vulnerability : CVE-2026-114615

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Authlib is a Python library which builds OAuth and OpenID Connect servers. From 1.3.1 until 1.9.0, OctKey.importkey checks asymmetric-key markers only at byte...

Linux Distros Unpatched Vulnerability : CVE-2026-99024

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - optee: register TEE devices only once fully initialized opteeprobe called teedeviceregister on both the client and the supplicant device before the rest of stru...

Linux Distros Unpatched Vulnerability : CVE-2026-99070

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipv6: do not warn on route notification size race fib6infohwflagsset sizes the skb with rt6nlmsgsize and later fills it with rt6fillnode. With nexthop...

Linux Distros Unpatched Vulnerability : CVE-2026-98934

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipv6: sr: use skbgethashnet in seg6makeflowlabel Since commit d58e468b1112 flowdissector: implements flow dissector BPF hook skbflowdissect needs a net pointer,...

AlmaLinux 9 : ca-certificates (ALSA-2026:88459)

The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:88459 advisory. ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns CVE-2026-114406 Tenable has extracted the preceding description block...

Rocky Linux 8.10 [CIQ] Security Update: bpftool / kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ciqsa-2026_1688)

The Rocky Linux 8.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261688 advisory. This advisory aggregates security fixes for the kernel SRPM in CIQ Core 8.10. It addresses 2 CVEs: CVE-2026-53359, CVE-2026-46113. Tenable has extracted...

Linux Distros Unpatched Vulnerability : CVE-2026-113715

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the stdlib venv creator reads generated pyvenv.cfg with str.splitlines...

Linux Distros Unpatched Vulnerability : CVE-2026-99043

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ice: fix metadatadst refcount handling on representor teardown iceeswitchreleaserepr uses metadatadstfree to release the representor's metadatadst...

Linux Distros Unpatched Vulnerability : CVE-2026-106446

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.compile and Handlebars.precompile accept...

RHEL 9 : php:8.2 (RHSA-2026:88835)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:88835 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: OOM bailout during request parsi...

Linux Distros Unpatched Vulnerability : CVE-2026-114610

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fpdf2 is a PDF creation library for Python. From 2.5.0 until 2.8.8, fpdf2's SVGObject.buildxref passes nested SVG references to GraphicsContext.additem, whose...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 : OpenVPN vulnerability (USN-8953-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 host has a package installed that is affected by a vulnerability as referenced in the USN-8953-1 advisory. It was discovered that OpenVPN incorrectly handled certificate subject fields. A remote authenticated user could possibly use this...