SUSE SLES15 Security Update : podman (SUSE-SU-2026:4854-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4854-1 advisory. This update for podman rebuilds it against the current go security release. Tenable has extracted the preceding description block directly...

AlmaLinux 9.6 [TuxCare] Security Update: brotli / brotli-devel / libbrotli / python3-brotli (ALMALINUX9.6:CLSA-2026:1792755607)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792755607 advisory. - A buffer overflow vulnerability in the Brotli decoder c/dec/decode.c in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows ...

Linux Distros Unpatched Vulnerability : CVE-2026-101614

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: InnoDB. Supported versions that are affected are MySQL Server: 8.4.0-8.4.12,...

Linux Distros Unpatched Vulnerability : CVE-2026-106585

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data...

RHEL 10 : .NET 8.0 (RHSA-2026:88474)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:88474 advisory. .NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It...

RockyLinux 10 : expat (RLSA-2026:88248)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:88248 advisory. expat: expat: Denial of Service via integer overflow in expatrealloc CVE-2026-102633 expat: expat: Information disclosure via heap buffer over-read in...

MiracleLinux 8 : python3-3.6.8-79.el8_10.ML.1 (AXSA:2026-2123:11)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2123:11 advisory. python: python: Arbitrary file deletion via race condition during temporary directory cleanup CVE-2026-12345 python: python: Certificate verificatio...

Oracle Linux 7 : ca-certificates (ELSA-2026-500496)

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-500496 advisory. 2025.2.80v9.0.304-71.0.2 - eMudhra: add 'emSign ECC Root CA - G3' and 'Comodo AAA Services root' to blocklist 2025.2.80v9.0.304-71.0.1 - Resolve...

RockyLinux 9 : firefox (RLSA-2026:76761)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:76761 advisory. firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics component CVE-2026-92035 firefox: thunderbird: Use-after-free ...

AlmaLinux 9.2 [TuxCare] Security Update: thunderbird Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1792779937)

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792779937 advisory. - Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbi...

RHEL 10 : thunderbird (RHSA-2026:85240)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:85240 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Use-after-free in the Graphics:...

RHEL 9 : thunderbird (RHSA-2026:85242)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:85242 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Use-after-free in the Graphics: Canvas...

Linux Distros Unpatched Vulnerability : CVE-2026-99021

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - regulator: of: fill in supply names in ofregulatorbulkgetall ofregulatorbulkgetall returns an array it allocated itself, and fills in only the consumer of each...

Linux Distros Unpatched Vulnerability : CVE-2026-99049

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gpio: xilinx: fix runtime PM leak on request error path pmruntimegetsync leaves the usage counter incremented even when it fails, and xgpiorequest returns the...

Linux Distros Unpatched Vulnerability : CVE-2026-115354

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mistune before 3.3.0 contains a path traversal vulnerability in the opt-in Include directive that allows attackers to read local files by supplying relative or...

Linux Distros Unpatched Vulnerability : CVE-2026-90799

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Unsafe binary deserialisation in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to cause a denial of service via memory...

Linux Distros Unpatched Vulnerability : CVE-2026-101607

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are MySQL Server:...

Linux Distros Unpatched Vulnerability : CVE-2026-98929

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - macsec: initialize SecY before registering the netdevice Creating a MACsec device with MAC offload over an LRO-capable lower device triggers a warning in...

Linux Distros Unpatched Vulnerability : CVE-2026-113725

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.7, the bash activate script escapes the environment name for only one of...

Linux Distros Unpatched Vulnerability : CVE-2026-113789

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF that causes large memory usage or long runtimes when an...

Linux Distros Unpatched Vulnerability : CVE-2026-93520

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A heap buffer overflow caused by mismatching size calculations between XkbAllocNames and ChangeKeycodeRange in X.org X server before 2.1.25 and XWayland before...

SUSE SLES16 Security Update : aliyun-cli (SUSE-SU-2026:24261-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:24261-1 advisory. This update for aliyun-cli fixes the following issue: - CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDic...

Linux Distros Unpatched Vulnerability : CVE-2026-101773

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Group Replication Plugin. Supported versions that are affected are...

Linux Distros Unpatched Vulnerability : CVE-2026-101760

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: InnoDB. Supported versions that are affected are MySQL Server: 8.4.0-8.4.12,...

MiracleLinux 8 : php:8.2 (AXSA:2026-2129:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2129:01 advisory. php: OOM bailout during request parsing leads to memory corruption and RCE CVE-2026-109618 php: fatal error handling retains stale request state...

Linux Distros Unpatched Vulnerability : CVE-2026-98957

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: mt76: mt7915: disable rx napi when removing device Unloading the mt7915e module with a MT7916 triggers multiples WARN in netifnapidellocked and in...

Linux Distros Unpatched Vulnerability : CVE-2026-101616

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: JSON. Supported versions that are affected are MySQL Server:...

Linux Distros Unpatched Vulnerability : CVE-2026-99006

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/i915/gem: Prevent overstepping exec array boundary It is possible for ebrelocateparseslow to call kvfree on entries outside the original exec array during...

Linux Distros Unpatched Vulnerability : CVE-2026-101619

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: InnoDB. Supported versions that are affected are MySQL Server: 8.4.0-8.4.12,...

Linux Distros Unpatched Vulnerability : CVE-2025-60490

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A heap use-after-free in the gffilterpidsendeventdownstream function /filtercore/filterpid.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denia...

Linux Distros Unpatched Vulnerability : CVE-2026-101795

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Components Services. Supported versions that are affected are MySQL...

Node.js Module TanStack Start 1.143.12 < 1.168.56 / 1.168.57 / 1.168.60 / 1.169.39 XSS (CVE-2026-102989)

The versions of the TanStack Start Node.js modules installed on the remote host are 1.143.12 or later, prior to their respective patched versions. They are, therefore, affected by a cross-site scripting vulnerability: - The server-function transport passes request payload fields into internal...

Linux Distros Unpatched Vulnerability : CVE-2026-98969

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/sched: emtext: reject unterminated algo before autoload This is a follow-up to commit 9c572a83037a net/sched: fix potential stack infoleak in emtextdump,...

SUSE SLES15 Security Update : kernel (Live Patch 56 for SUSE Linux Enterprise 15 SP4) (SUSE-SU-2026:4856-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4856-1 advisory. This update for the SUSE Linux Enterprise Kernel 5.14.21-150400.24.225 fixes various security issues: The following security issues were fixed:...

Fedora 44 : maradns (2026-eb61896ed1)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-eb61896ed1 advisory. update to 3.5.0039 MaraDNS 3.5.0039 has been released. In addition to revamping how the cryptographic secure pseudo random number generator is seeded to be...

Linux Distros Unpatched Vulnerability : CVE-2026-101785

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: JSON. Supported versions that are affected are MySQL Server:...

Curl 8.11.0 < 8.23.0 HSTS Policy Loss

The version of curl installed on the remote host is 8.11.0 prior to 8.23.0. It is, therefore, affected by a policy handling vulnerability: - Importing a includeSubDomains parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the...

Linux Distros Unpatched Vulnerability : CVE-2026-101599

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.20. Difficult to explo...

Linux Distros Unpatched Vulnerability : CVE-2025-60469

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A NULL pointer dereference in the gfac4presentationchmode function /mediatools/avparsers.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial ...

Linux Distros Unpatched Vulnerability : CVE-2026-113713

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - virtualenv is a tool for creating isolated virtual python environments. From 21.14.8 until 21.14.10, the app-data seeder can leave an environment linked to...

RHEL 8 : php:7.4 (RHSA-2026:88565)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:88565 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: OOM bailout during request parsi...

AlmaLinux 9.6 [TuxCare] Security Update: nodejs / nodejs-devel / nodejs-docs / nodejs-full-i18n / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1792760716)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792760716 advisory. - A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has...

Rocky Linux 9.6 [TuxCare] Security Update: nodejs / nodejs-devel / nodejs-docs / nodejs-full-i18n / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1792760716)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792760716 advisory. - A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client h...

Rocky Linux 8.6 [CIQ] Security Update: bpftool / kernel / kernel-abi-stablelists / kernel-core / etc (ciqsa-2026_1674)

The Rocky Linux 8.6 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261674 advisory. This advisory aggregates security fixes for the kernel SRPM in CIQ FIPS 8.6 Compliant. It addresses 1 CVE: CVE-2026-43284. Tenable has extracted the preceding...

CentOS Linux 8.4 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1792749577)

"The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1792749577 advisory. - In the Linux kernel, the following vulnerability has been resolved: cifs: fix session state check in reconnect to avoid...

AlmaLinux 8 : ca-certificates (ALSA-2026:88550)

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:88550 advisory. ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns CVE-2026-114406 Tenable has extracted the preceding description block...

Linux Distros Unpatched Vulnerability : CVE-2026-98932

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - EDAC/altera: Fix use-after-free in error paths In both altredaca10deviceadd and altrportbsetup, the error path freed the dci structure before releasing the devr...

AlmaLinux 9.6 [TuxCare] Security Update: librabbitmq / librabbitmq-devel / librabbitmq-tools (ALMALINUX9.6:CLSA-2026:1792765036)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792765036 advisory. - rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to 0.16.0, a malicious AMQP server can send an undersized...

RHEL 10 : kernel (RHSA-2026:88687)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:88687 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: Linux kernel: Denial of...

Debian dla-4855 : brotli - security update

The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dla-4855 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4855-1 [email protected] https://www.debian.org/lts/security/...