Linux Distros Unpatched Vulnerability : CVE-2026-106446

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.compile and Handlebars.precompile accept...

RHEL 9 : php:8.2 (RHSA-2026:88835)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:88835 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: OOM bailout during request parsi...

Linux Distros Unpatched Vulnerability : CVE-2026-114610

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fpdf2 is a PDF creation library for Python. From 2.5.0 until 2.8.8, fpdf2's SVGObject.buildxref passes nested SVG references to GraphicsContext.additem, whose...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 : OpenVPN vulnerability (USN-8953-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 host has a package installed that is affected by a vulnerability as referenced in the USN-8953-1 advisory. It was discovered that OpenVPN incorrectly handled certificate subject fields. A remote authenticated user could possibly use this...

Debian dla-4851 : aide - security update

The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dla-4851 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4851-1 [email protected] https://www.debian.org/lts/security/...

Linux Distros Unpatched Vulnerability : CVE-2026-98933

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: hub: use shorter 120ms post resume hold for SS root hubs Holding a USB3 hub PM runtime reference for 200ms at hub resume triggers an AMD platform issue...

Linux Distros Unpatched Vulnerability : CVE-2026-101750

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Clone Plugin. Supported versions that are affected are MySQL Server:...

Linux Distros Unpatched Vulnerability : CVE-2026-90797

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any remote client to cause a denial of service via...

Linux Distros Unpatched Vulnerability : CVE-2026-101623

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are MySQL Server:...

Linux Distros Unpatched Vulnerability : CVE-2025-55653

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GPAC MP4Box v2.4 was discovered to contain a floating point exception in the gfparselfrac function utils/error.c. Processing a crafted MP4 file containing a...

Rocky Linux 8.10 [CIQ] Security Update: bpftool / kernel / kernel-abi-stablelists / kernel-core / etc (ciqsa-2026_1664)

The Rocky Linux 8.10 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261664 advisory. This advisory aggregates security fixes for the kernel SRPM in CIQ FIPS 8.10 Compliant. It addresses 1 CVE: CVE-2024-56661. Tenable has extracted the preceding...

SUSE SLES15: apache2-mod_php7 / php7 / php7-bcmath / php7-bz2 / php7-calendar / etc (SUSE-SU-2026:4853-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4853-1 advisory. - CVE-2025-1218: php: php: Denial of Service via out-of-bounds read in mysqlnd wire protocol parser bsc1282981. - CVE-2025-14181:...

Curl 7.69.1 < 8.23.0 SSH Known Hosts Validation Error

The version of curl installed on the remote host is 7.69.1 prior to 8.23.0. It is, therefore, affected by a host key validation vulnerability: - When libcurl uses libssh2 with a hashed knownhosts file, an unrelated initial entry can cause host key validation to report a key mismatch as a missing...

Linux Distros Unpatched Vulnerability : CVE-2026-114457

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in modqos. An unauthenticated remote attacker could cause a Denial of Service DoS by sending a specially crafted JSON request when JSON body...

Linux Distros Unpatched Vulnerability : CVE-2026-101802

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Parser. Supported versions that are affected are MySQL Server:...

Linux Distros Unpatched Vulnerability : CVE-2026-115382

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a denial-of-service vulnerability in its wasi:http implementation that allows guests to panic th...

Linux Distros Unpatched Vulnerability : CVE-2026-98916

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: nl80211: check link is beaconing for color change When trying to do a color change, validate that the link is beaconing first, to avoid calling the driver...

FreeBSD : mailpit -- Unbounded CPU and memory consumption in thumbnail endpoint via cyclic EXIF IFD chain (df4083bc-cea6-11f1-94b3-10ffe07f9334)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the df4083bc-cea6-11f1-94b3-10ffe07f9334 advisory. Mailpit author reports: The thumbnail endpoint GET /api/v1/message/ID/part/PartID/thumb parses EXIF...

Rocky Linux 9.6 [CIQ] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc Multiple Vulnerabilities (ciqsa-2026_1716)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261716 advisory. This advisory aggregates security fixes for the php SRPM in CIQ LTS 9.6. It addresses 2 CVEs: CVE-2026-109619, CVE-2026-109618. Tenable has extracted the...

SUSE SLES16 Security Update : amazon-ecs-init (SUSE-SU-2026:24265-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:24265-1 advisory. - CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS servers...

Linux Distros Unpatched Vulnerability : CVE-2026-101789

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are MySQL Server:...

Linux Distros Unpatched Vulnerability : CVE-2026-114136

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Django REST framework is a toolkit for building Web APIs. From 3.6.4 until 3.18.2, JSONParser.parse in restframework/parsers.py uses the client-supplied...

Linux Distros Unpatched Vulnerability : CVE-2026-101772

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Client programs. Supported versions that are affected are MySQL Server:...

Linux Distros Unpatched Vulnerability : CVE-2026-106585

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data...

Rocky Linux 8.6 [CIQ] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc Multiple Vulnerabilities (ciqsa-2026_1668)

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261668 advisory. This advisory aggregates security fixes for the php SRPM in CIQ LTS 8.6. It addresses 2 CVEs: CVE-2026-109619, CVE-2026-109618. Tenable has extracted the...

RHEL 10 : kernel (RHSA-2026:88477)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:88477 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: calipso: Don't call calipso...

Linux Distros Unpatched Vulnerability : CVE-2026-113795

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pypdf is a free and open-source pure-python PDF library. Prior to 6.20.0, accessing a crafted PDF stream with a large number of filters or multiple filters that...

Rocky Linux 9.6 [TuxCare] Security Update: flatpak-builder (ALMALINUX9.6:CLSA-2026:1792771054)

The Rocky Linux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792771054 advisory. - A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use- git-am: true. An attacker who...

Linux Distros Unpatched Vulnerability : CVE-2026-106555

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts. CVE-2026-106555 Note that...

Linux Distros Unpatched Vulnerability : CVE-2026-113719

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInstall.uninstallpreviousversion accepts existing seed-package...

Linux Distros Unpatched Vulnerability : CVE-2026-114605

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.name.fromwireparser follows attacker- controlled DNS compression pointer chains without a hop limit. ...

Linux Distros Unpatched Vulnerability : CVE-2026-99053

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tipc: hold a reference to nodes found by link name tipcnodefindbyname returns a node after dropping its RCU read lock without taking a reference. The LINKSET,...

Linux Distros Unpatched Vulnerability : CVE-2025-60496

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A Floating-Point Exception FPE in the reframersendpacket function /filters/reframer.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of...

Linux Distros Unpatched Vulnerability : CVE-2025-60492

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A stack overflow in the gfbifsdecnode function /bifs/fielddecode.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via...

Linux Distros Unpatched Vulnerability : CVE-2026-106589

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In sshd in OpenSSH through 10.6, in certain environments such as QNX 6 and SCO OpenServer 5, sshd-session can unexpectedly have root privileges. This is related...

Linux Distros Unpatched Vulnerability : CVE-2026-99028

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop In the dmaengine path the driver pre- submits RX buffers and holds in-flight TX buffers who...

Linux Distros Unpatched Vulnerability : CVE-2026-101614

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: InnoDB. Supported versions that are affected are MySQL Server: 8.4.0-8.4.12,...

Linux Distros Unpatched Vulnerability : CVE-2026-111183

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on...

RHEL 10 : .NET 8.0 (RHSA-2026:88474)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:88474 advisory. .NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It...

Linux Distros Unpatched Vulnerability : CVE-2026-112053

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Schroedinger libschroedinger through 1.0.11 contains an out-of-bounds read vulnerability that allows attackers to read past a static quantiser table by supplyin...

Oracle Linux 10 : postgresql16-pgvector (ELSA-2026-88359)

The remote Oracle Linux 10 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-88359 advisory. - CVE-2026-103484 postgresql16-pgvector: pgvector: Arbitrary code execution via out-of-bounds write during IVFFlat index build execution via out-of-bounds wri...

Curl 7.10.8 < 8.23.0 HTTP Proxy Credential Leak

The version of curl installed on the remote host is 7.10.8 prior to 8.23.0. It is, therefore, affected by an information disclosure vulnerability: - An HTTP proxy can trick libcurl into sending the origin's credentials Basic password, or a Negotiate/Kerberos ticket to the proxy itself, by answeri...

Linux Distros Unpatched Vulnerability : CVE-2026-87322

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.20. Easily exploitable...

Linux Distros Unpatched Vulnerability : CVE-2026-113716

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the builtin creator calls ensuredir for executable, library, and packa...

RHEL 10 : thunderbird (RHSA-2026:85240)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:85240 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Use-after-free in the Graphics:...

Linux Distros Unpatched Vulnerability : CVE-2026-99077

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipv4: udp: Create exceptions before socket matching Currently, when ICMP Fragmentation Needed and Redirect Message packets are locally delivered and quote a UDP...

Linux Distros Unpatched Vulnerability : CVE-2026-113793

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pypdf is a free and open-source pure-python PDF library. Prior to 6.20.1, removing an object from a crafted cyclic PDF tree, such as an outline item, can enter ...

RHEL 9 : php (RHSA-2026:88720)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:88720 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: OOM bailout during request parsi...

Linux Distros Unpatched Vulnerability : CVE-2026-98951

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - riscv: ptrace: Zero-initialize regset buffers before copyin userregsetcopyin only copies count bytes, so a PTRACESETREGSET request with a short iovlen leaves th...

Linux Distros Unpatched Vulnerability : CVE-2026-99058

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - workqueue: Fix NULL currentpwq deref in chained work check currentwqworker only tells us that %current is a kworker. It does not guarantee that the worker is...