Debian dsa-6581 : libunbound-dev - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6581 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6581-1 [email protected] https://www.debian.org/securit...

AlmaLinux 9.2 [TuxCare] Security Update: grafana Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1792757203)

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792757203 advisory. - Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives. A crafted plugin archive...

Linux Distros Unpatched Vulnerability : CVE-2026-98943

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HID: steam: Clean up locking This cleans up several issues with locking behavior, including RCU accesses not being guarded behind a lock. CVE-2026-98943 Note th...

Rocky Linux 8 [CIQ] Security Update: apcu-panel / libzip / libzip-debuginfo / libzip-debugsource / etc Multiple Vulnerabilities (crlsa-2026_87073)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202687073 advisory. php: php: Denial of Service via unbounded recursion in SOAP parser CVE-2026-91765 php: OOM bailout during request parsing leads to memory corruption and R...

Linux Distros Unpatched Vulnerability : CVE-2026-114609

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fpdf2 is a PDF creation library for Python. Prior to 2.8.8, fpdf2's shared image loader automatically dereferences attacker-controlled HTTPS URLs and raw local...

Linux Distros Unpatched Vulnerability : CVE-2026-98992

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - namespace: don't copy an unmounted mount tree maycopytree accepts a mount whose root is an nsfs or pidfs file before it checks whether that mount is mounted. Th...

RockyLinux 9 : php:8.3 (RLSA-2026:87079)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:87079 advisory. php: php: Denial of Service via unbounded recursion in SOAP parser CVE-2026-91765 php: OOM bailout during request parsing leads to memory corruption and...

Linux Distros Unpatched Vulnerability : CVE-2026-99081

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bnxten: fix DMA mapping length for padded small packets Stefan Fleischmann reported Intel IOMMU DMA Read faults on BCM57412 NetXtreme-E NICs when transmitting...

SUSE SLED15 / SLES15 Security Update : python-hpack (SUSE-SU-2026:4832-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4832-1 advisory. This update for python-hpack fixes the following issue: - CVE-2026-59980: unbounded variable integer decoding can cause...

Linux Distros Unpatched Vulnerability : CVE-2025-60482

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A heap use-after-free in the gfodfac4cfgcleanlist function /odf/descriptors.c of GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master allows attackers to cause...

Linux Distros Unpatched Vulnerability : CVE-2026-101733

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: JSON. Supported versions that are affected are MySQL Server:...

Linux Distros Unpatched Vulnerability : CVE-2026-98906

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: lan966x: restore RX state on reload failure lan966xfdmareload backs up rx-pagepool and rx-fdma before reallocating the RX resources for the new MTU. If the...

Linux Distros Unpatched Vulnerability : CVE-2026-98955

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - flowdissector: avoid u16 truncation of skb-len when computing thoff skbflowdissect computes keycontrol-thoff using: keycontrol-thoff = mintu16, nhoff, skb ?...

Linux Distros Unpatched Vulnerability : CVE-2026-98917

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - parisc: Increase kernel stack size to 32kb For 64-bit Linux kernels, increase the default kernel stack size THREADSIZEORDER to 32 kB, in order to avoid kernel...

SUSE SLED15 / SLES15 Security Update : mutt (SUSE-SU-2026:4857-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4857-1 advisory. This update for mutt fixes the following issue: - CVE-2026-107570: heap out-of-bounds write in convertfilefromto via a...

Linux Distros Unpatched Vulnerability : CVE-2026-99074

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipv4: stop PMTU walk when nexthop group shrinks Commit 7d3f3b4367f3 net: ipv4: Cache pmtu for all packet paths if multipath enabled made iprtupdatepmtu update...

Linux Distros Unpatched Vulnerability : CVE-2026-98977

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - namespace: handle mount locking for automounts correctly If mounts are propagated across user namespaces, attachrecursivemnt locks every copy of the source moun...

Linux Distros Unpatched Vulnerability : CVE-2026-98914

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amdgpu: cap ATOM command table nesting depth Cap nesting at 32 levels with executedepth and return -ELOOP when exceeded. CVE-2026-98914 Note that Nessus...

MiracleLinux 9 : postgresql:18 (AXSA:2026-2113:01)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-2113:01 advisory. pgvector: pgvector: Arbitrary code execution via out-of-bounds write during IVFFlat index build CVE-2026-103484 Tenable has extracted the preceding descripti...

Linux Distros Unpatched Vulnerability : CVE-2026-113786

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pypdf is a free and open-source pure-python PDF library. Prior to 6.21.1, an attacker can craft a PDF containing image data labeled with the /DCTDecode filter...

Linux Distros Unpatched Vulnerability : CVE-2026-99061

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: brcmfmac: fix P2P device removal race in brcmfdetach When the driver is removed while the user space process that created the P2P device e.g. wpasupplican...

Linux Distros Unpatched Vulnerability : CVE-2026-89419

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nodes/ident - in other words, not using the...

Linux Distros Unpatched Vulnerability : CVE-2026-101794

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: XML. Supported versions that are affected are MySQL Server:...

AlmaLinux 9.2 [TuxCare] Security Update: gstreamer1-plugins-good / gstreamer1-plugins-good-gtk / etc (ALMALINUX9.2:CLSA-2026:1792769449)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792769449 advisory. - An issue was discovered in GStreamer gst-plugins-good before 1.28.2. When parsing MP4 audio tracks, the isomp4 plugin's qtdemuxaudiocaps...

AlmaLinux 8 : php:8.2 (ALSA-2026:87073)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:87073 advisory. php: php: Denial of Service via unbounded recursion in SOAP parser CVE-2026-91765 php: OOM bailout during request parsing leads to memory corruption and...

Linux Distros Unpatched Vulnerability : CVE-2026-106547

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A heap-based buffer overflow in H5VMarrayfill in src/H5VM.c in HDF5 before 2.2.0 lets a remote attacker cause an application crash and possibly execute arbitrar...

Linux Distros Unpatched Vulnerability : CVE-2026-98937

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - perf/core: Check kernel access when kernel callchains are requested perfeventopen currently gates perfallowkernel only on !attr.excludekernel. However, users ca...

Oracle Linux 10 : postgresql18-pgvector (ELSA-2026-88360)

The remote Oracle Linux 10 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-88360 advisory. - CVE-2026-103484 postgresql18-pgvector: pgvector: Arbitrary code execution via out-of-bounds write during IVFFlat index build execution via out-of-bounds wri...

Linux Distros Unpatched Vulnerability : CVE-2026-87303

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.16. Easily exploitable...

Linux Distros Unpatched Vulnerability : CVE-2026-115348

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser's parselinktext function that allows unauthenticated...

Linux Distros Unpatched Vulnerability : CVE-2026-98942

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - schedext: Build the cid tables privately and publish them with RCU The cid tables are visible to the cid kfuncs while being modified: the first enable publishes...

Curl 7.86.0 < 8.23.0 WebSocket GnuTLS Information Leak

The version of curl installed on the remote host is 7.86.0 prior to 8.23.0. It is, therefore, affected by an information disclosure vulnerability: - When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. This is due to an out of bounds read...

Linux Distros Unpatched Vulnerability : CVE-2026-19029

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A heap-based buffer over-read in H5Zfilterscaleoffset in src/H5Zscaleoffset.c in HDF5 through 2.2.0 lets an attacker cause a denial of service application crash...

Linux Distros Unpatched Vulnerability : CVE-2026-113792

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pypdf is a free and open-source pure-python PDF library. Prior to 6.20.1, calling PdfWriter.findoutlineitem on a crafted PDF with a cyclic outline hierarchy can...

Linux Distros Unpatched Vulnerability : CVE-2026-93516

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A use-after-free caused by lack of lifecycle management when adding / removing XInput master devices in X.org X Server before 21.1.25 and XWayland before 24.1.1...

Linux Distros Unpatched Vulnerability : CVE-2026-98993

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - namespace: don't inherit MNTUMOUNT in clonemnt MNTUMOUNT gets raised on a mount that umounttree or umountone has taken out of its namespace. It's never cleared...

Linux Distros Unpatched Vulnerability : CVE-2026-101801

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are MySQL Server:...

Linux Distros Unpatched Vulnerability : CVE-2026-111181

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request can crash an...

Linux Distros Unpatched Vulnerability : CVE-2026-101598

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.20. Easily exploitable...

SUSE SLED15 / SLES15 Security Update : tiff (SUSE-SU-2026:4845-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4845-1 advisory. This update for tiff fixes the following issue: - CVE-2026-18495: libtiff: heap-buffer overflow via numeric truncation ...

RockyLinux 10 : ca-certificates (RLSA-2026:88455)

The remote RockyLinux 10 host has a package installed that is affected by a vulnerability as referenced in the RLSA-2026:88455 advisory. ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns CVE-2026-114406 Tenable has extracted the preceding description block...

Linux Distros Unpatched Vulnerability : CVE-2026-115505

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libsmb2 before 6.3 contains integer overflow vulnerabilities in the DCE/RPC NDR decoder in lib/dcerpc.c that allow heap out-of-bounds reads and writes. A...

MiracleLinux 9 : php:8.3 (AXSA:2026-2128:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2128:01 advisory. php: OOM bailout during request parsing leads to memory corruption and RCE CVE-2026-109618 php: fatal error handling retains stale request state...

Linux Distros Unpatched Vulnerability : CVE-2026-101761

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Security: Encryption. Supported versions that are affected are MySQL...

Oracle Linux 7 : unbound (ELSA-2026-72199)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-72199 advisory. - Fix CVE-2026-81642 DNSKEY digest buffer overflow and add regression test Orabug: 40081199 Tenable has extracted the preceding description block directly from...

Linux Distros Unpatched Vulnerability : CVE-2026-101732

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are MySQL Server:...

RHEL 8 : ca-certificates (RHSA-2026:88662)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:88662 advisory. The ca-certificates package contains a set of Certificate Authority CA certificates chosen by the Mozilla Foundation for use with the Internet Publi...

Linux Distros Unpatched Vulnerability : CVE-2026-111758

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - markdown-it is a Markdown parser. From versions 14.1.0 to before 14.3.3, and 15.0.0 to before 15.0.3, a link reference definition whose label or title is never...

Linux Distros Unpatched Vulnerability : CVE-2026-115383

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains an improper validation vulnerability that accepts components whose core modules import WebAssemb...

Linux Distros Unpatched Vulnerability : CVE-2026-101725

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: C API. Supported versions that are affected are MySQL Server: 8.4.0-8.4.12,...