Linux Distros Unpatched Vulnerability : CVE-2026-115504

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CFITSIO through 4.7.0 contains an out-of-bounds write vulnerability in ffgcls2 in getcols.c that trusts attacker-controlled heap descriptor lengths for...

Amazon Corretto Java 17.x < 17.0.21.0.10 Multiple Vulnerabilities

The version of Amazon Corretto installed on the remote host is 17 prior to 17.0.21.0.10. It is, therefore, affected by multiple vulnerabilities as referenced in the corretto-17-2026-Oct-20 advisory. - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition...

Linux Distros Unpatched Vulnerability : CVE-2026-98972

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - cgroup/cpuset: Don't access cpusetcgrpsubsys.root in isinv2mode After seeing the patch 1 to guard isinv2mode with RCU, it makes me realize that isinv2mode may b...

RockyLinux 8 : flute, libbase, libfonts, libformula, liblayout, libloader, libreoffice, librepository, libserializer, pentaho-libxml, pentaho-reporting-flow-engine, and sac (RLSA-2026:88164)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:88164 advisory. libreoffice: heap buffer overflow in PDF import stream handling CVE-2026-63274 libreoffice: stack buffer overflow in CFF to Type 1 font conversion...

Linux Distros Unpatched Vulnerability : CVE-2026-91477

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle JavaFX product of Oracle Java SE component: JavaFX. Supported versions that are affected are Oracle JavaFX: 25.0.4 and 27. Difficult...

AlmaLinux 9.6 [TuxCare] Security Update: ruby / ruby-default-gems / ruby-devel / ruby-doc / ruby-libs / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1792801476)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792801476 advisory. - An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before...

Debian dsa-6579 : roundcube - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6579 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6579-1 [email protected] https://www.debian.org/securit...

Fedora 45 : ca-certificates (2026-e57d2527d5)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-e57d2527d5 advisory. Update ca-certificates to ca-certificates-2026.2.92v9.0.319-2.fc45 Remove emSign Root CS CA - G3 Additional code signing certificate that sign 2 of the...

Curl 8.21.0 < 8.23.0 Multiple Connection Reuse Vulnerabilities

The version of curl installed on the remote host is 8.21.0 prior to 8.23.0. It is, therefore, affected by multiple connection reuse vulnerabilities: - libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schannel...

RHEL 8 : ca-certificates (RHSA-2026:88550)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:88550 advisory. The ca-certificates package contains a set of Certificate Authority CA certificates chosen by the Mozilla Foundation for use with the Internet Publi...

Linux Distros Unpatched Vulnerability : CVE-2026-99067

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - btrfs: scrub: fix localroot reference leak in scrubprintwarninginode When pathsfrominode fails, scrubprintwarninginode jumps to err without dropping the referen...

Fedora 44 : golang-x-mobile (2026-596bcd713b)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-596bcd713b advisory. Upgrade with minor security fixes Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

Rocky Linux 8.6 [CIQ] Security Update: bpftool / kernel / kernel-abi-stablelists / kernel-core / etc (ciqsa-2026_1679)

The Rocky Linux 8.6 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261679 advisory. This advisory aggregates security fixes for the kernel SRPM in CIQ FIPS 8.6 Compliant. It addresses 1 CVE: CVE-2026-53264. Tenable has extracted the preceding...

Linux Distros Unpatched Vulnerability : CVE-2026-112059

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libLAS through 1.8.1 contains a heap out-of-bounds write vulnerability in the point record reader caused by truncating the schema byte size to 16 bits when sizi...

Linux Distros Unpatched Vulnerability : CVE-2026-114620

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, Authlib's RFC 9101 JWTAuthenticationRequest passes the unauthenticate...

Linux Distros Unpatched Vulnerability : CVE-2026-106445

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Handlebars provides the power necessary to let users build semantic templates. From 3.0.0 until 4.7.10, Handlebars lookupProperty returns...

Linux Distros Unpatched Vulnerability : CVE-2026-98936

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: ath11k: reset ar-numstations on hardware start When multiple hw restart occurs, we end up in a situation where we cannot accept new stations / mesh peers...

Amazon Linux Unpatched Vulnerability : CVE-2026-109619

The remote Amazon Linux host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be...

Curl 7.62.0 < 8.23.0 Effective URL Password Leak

The version of curl installed on the remote host is 7.62.0 prior to 8.23.0. It is, therefore, affected by an information disclosure vulnerability: - libcurl could accidentally return a URL for curleasygetinfo's CURLINFOEFFECTIVEURL option containing credentials, even though neither the URL provid...

Linux Distros Unpatched Vulnerability : CVE-2026-101728

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Pluggable Auth. Supported versions that are affected are MySQL Serve...

AlmaLinux 8 : ALSA-2026:A013php:8.0 (ALSA-2026:A013)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:A013 advisory. php: OOM bailout during request parsing leads to memory corruption and RCE CVE-2026-109618 php: fatal error handling retains stale request state leading t...

Linux Distros Unpatched Vulnerability : CVE-2026-98880

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ntfs3: handle setblocksize failures ntfs3 uses bufferheads, which don't handle block size PAGESIZE well. Without this, mounting we will hit the BUGONoffset =...

MiracleLinux 8 : openssl-1.1.1k-18.el8_6 (AXSA:2026-2118:19)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2118:19 advisory. - openssl: heap buffer overflow in CMS key unwrapping CVE-2026-63072 - openssl: compat-openssl: DTLS Retransmits Handshake Messages From a Stale...

Linux Distros Unpatched Vulnerability : CVE-2026-113681

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 contains an integer overflow in cineon::Codec::Read that undersizes the...

Linux Distros Unpatched Vulnerability : CVE-2026-93519

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A buffer overflow when handling pointer barriers in the XFIXES extension in X.Org X server before 21.1.25 and XWayland before 24.1.14 could be used by...

Linux Distros Unpatched Vulnerability : CVE-2026-93515

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A use-after-free in presentclearwindownotifies in the X.org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by malicious X clients to crash o...

Linux Distros Unpatched Vulnerability : CVE-2026-99082

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: x86: Use active memslots for the per-vCPU MMIO cache KVM tags the per-vCPU MMIO cache with a memslot generation so that a memslot update invalidates cached...

Linux Distros Unpatched Vulnerability : CVE-2026-98356

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: check createsinglethreadworkqueue in DCB setup bnxtreinitdcbwq ignores a failed...

MiracleLinux 9 : openssh-9.9p1-13.el9_8.ML.1 (AXSA:2026-2122:14)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2122:14 advisory. openssh: OpenSSH: SFTP security bypass due to command-line argument parsing flaw CVE-2026-59997 openssh: OpenSSH: Undocumented...

Linux Distros Unpatched Vulnerability : CVE-2026-114110

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal path...

MiracleLinux 9 : hostapd-2.11-3.el9_8 (AXSA:2026-2121:01)

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-2121:01 advisory. hostapd: hostapd: Denial of Service via malformed Wi-Fi 7 Multi-Link Operation association request CVE-2026-58374 Tenable has extracted the preceding...

SUSE SLED15 / SLES15 Security Update : xwayland (SUSE-SU-2026:4835-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4835-1 advisory. - CVE-2026-88812: XKB SetGeometry TextDoodad Double Free bsc1281213. - CVE-2026-93515: X.Org Server Present...

AlmaLinux 9.6 [TuxCare] Security Update: xorg-x11-server-Xwayland / xorg-x11-server-Xwayland-devel Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1792791669)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792791669 advisory. - xorg-x11-server: xwayland: xorg-x11-server: Arbitrary code execution via double-free in XKB geometry handling CVE-2026-88812 -...

Linux Distros Unpatched Vulnerability : CVE-2026-93522

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A heap buffer overflow caused by mismatched size usage in CopyArea CPU-to-FBO path in X.Org X Server before 21.1.15 and XWayland before 24.1.14 could be used by...

RHEL 8 : php:7.4 (RHSA-2026:88532)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:88532 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: OOM bailout during request parsi...

Rocky Linux 8.6 [CIQ] Security Update: bpftool / kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ciqsa-2026_1672)

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261672 advisory. This advisory aggregates security fixes for the kernel SRPM in CIQ FIPS 8.6 Compliant. It addresses 6 CVEs: CVE-2026-52912, CVE-2026-74597, CVE-2026-4616...

Rocky Linux 8.6 [CIQ] Security Update: bpftool / kernel / kernel-abi-stablelists / kernel-core / etc (ciqsa-2026_1669)

The Rocky Linux 8.6 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261669 advisory. This advisory aggregates security fixes for the kernel SRPM in CIQ FIPS 8.6 Compliant. It addresses 1 CVE: CVE-2025-10263. Tenable has extracted the preceding...

Oracle Linux 10 : grafana-pcp (ELSA-2026-88316)

The remote Oracle Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-88316 advisory. 5.3.0-8.2 - Rebuilt against updated golang - Resolves RHEL-287474, RHEL-279348, RHEL-278699 Tenable has extracted the preceding description block...

AlmaLinux 9 : grafana-pcp (ALSA-2026:88354)

The remote AlmaLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:88354 advisory. crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references CVE-2026-97031 net/http: net/http/internal/http2:...

AlmaLinux 9.2 [TuxCare] Security Update: go-toolset / golang / golang-bin / golang-docs / golang-misc / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1792758155)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792758155 advisory. - When parsing a Range header containing a large number of small ranges, FileServerFS, ServeContent, and ServeFileFS can consume an...

Golang < 1.26.10 / 1.27.x < 1.27.3 Improper Certificate Validation

The version of Golang running on the remote host is prior to 1.26.10, or 1.27.x prior to 1.27.3. It is, therefore, affected by an improper certificate validation vulnerability in the crypto/x509 package. On most platforms, Go uses the given system root certificates. However, in some narrower case...

Oracle Linux 8 : go-toolset:ol8 (ELSA-2026-86203)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-86203 advisory. delve 1.26.1-1.0.1 - Disable DWARF compression which has issues Alex Burmashev 1.26.1-1 - Update to Delve 1.26.1 - Related: RHEL-183712 1.25.2-1 -...

MiracleLinux 8 : php:7.3 (AXSA:2026-2131:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2131:01 advisory. php: OOM bailout during request parsing leads to memory corruption and RCE CVE-2026-109618 php: fatal error handling retains stale request state...

openSUSE 16: cyrus-sasl / cyrus-sasl-bdb / cyrus-sasl-bdb-crammd5 / etc (openSUSE-SU-2026:22146-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:22146-1 advisory. Security issue fixed: - CVE-2026-107161: Heap buffer overflow in cyrus-sasl addtochallenge allows malicious server to crash or compromise DIGEST-MD5...

RockyLinux 10 : buildah (RLSA-2026:88262)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:88262 advisory. podman: Arbitrary file write when importing OCI archive CVE-2025-11395 net/http: golang: golang: Denial of Service via crafted HTTP Range headers...

RHEL 7 : php (RHSA-2026:88693)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:88693 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: fatal error handling retains stale reques...

AlmaLinux 10 : grafana-pcp (ALSA-2026:88316)

The remote AlmaLinux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:88316 advisory. crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references CVE-2026-97031 net/http: net/http/internal/http2:...

Fedora 43 : vlc (2026-5c70f0bfac)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-5c70f0bfac advisory. VLC 3.0.24: https://code.videolan.org/videolan/vlc/-/tags/3.0.24 Switch GUI to Qt6 not for EPEL9 Re-enable AS-DCP plugin Disable RDP plugin Disable...

Rocky Linux 9.6 [TuxCare] Security Update: postgresql / postgresql-contrib / postgresql-docs / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1792796702)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792796702 advisory. - Missing authorization in PostgreSQL CREATE STATISTICS command allows a table owner to achieve denial of service against other...

AlmaLinux 9.2 [TuxCare] Security Update: bpftool / kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1792751700)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792751700 advisory. - In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix signed integer overflow in l2tpip6sendmsg When len =...