Linux Distros Unpatched Vulnerability : CVE-2026-99033

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/packet: guard the ll header push in packetrcvspkt packetrcvspkt restores the link layer header with skbpushskb, skb-data - skbmacheaderskb %NASLMINLEVEL...

Rocky Linux 8.10 [CIQ] Security Update: bpftool / kernel / kernel-abi-stablelists / kernel-core / etc (ciqsa-2026_1692)

The Rocky Linux 8.10 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261692 advisory. This advisory aggregates security fixes for the kernel SRPM in CIQ Core 8.10. It addresses 1 CVE: CVE-2026-99999. Tenable has extracted the preceding description...

Linux Distros Unpatched Vulnerability : CVE-2026-55888

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileChooser.SaveFiles method to gain...

Linux Distros Unpatched Vulnerability : CVE-2026-115484

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the iscsiuio component of open-iscsi. The DHCPv4 option parser incorrectly calculates the length of the options data, causing it to read...

Linux Distros Unpatched Vulnerability : CVE-2026-99038

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - memstick: rtsxusbms: complete requests after eject instead of dropping them memstickcheck can pass its host-removing check just before rtsxusbmsdrvremove sets...

Linux Distros Unpatched Vulnerability : CVE-2026-17033

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL. T...

AlmaLinux 8 : ALSA-2026:A011php:7.2 (ALSA-2026:A011)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:A011 advisory. php: OOM bailout during request parsing leads to memory corruption and RCE CVE-2026-109618 php: fatal error handling retains stale request state leading t...

Linux Distros Unpatched Vulnerability : CVE-2026-113726

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - virtualenv is a tool for creating isolated virtual python environments. Prior to 21.13.0, the bash activate script that zsh also sources leaves the environment...

MiracleLinux 9 : qt5-qtbase-5.15.9-11.el9_8.2 (AXSA:2026-2119:03)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2119:03 advisory. qtbase: qt5-qtbase: qt6-qtbase: qtbase: Denial of Service via uncontrolled recursion in XML serialization CVE-2026-11573 qt5-qtbase: qt6-qtbase: Qt:...

Linux Distros Unpatched Vulnerability : CVE-2026-115380

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains a denial of service vulnerability in the wasmtime-wasi WASI preview 0 polloneof...

Rocky Linux 8.6 [CIQ] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc Multiple Vulnerabilities (ciqsa-2026_1667)

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261667 advisory. This advisory aggregates security fixes for the php SRPM in CIQ LTS 8.6. It addresses 2 CVEs: CVE-2026-109619, CVE-2026-109618. Tenable has extracted the...

RockyLinux 10 : postgresql18-pgvector (RLSA-2026:88360)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:88360 advisory. pgvector: pgvector: Arbitrary code execution via out-of-bounds write during IVFFlat index build CVE-2026-103484 Tenable has extracted the preceding description...

Rocky Linux 8.6 [CIQ] Security Update: bpftool / kernel / kernel-abi-stablelists / kernel-core / etc (ciqsa-2026_1662)

The Rocky Linux 8.6 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261662 advisory. This advisory aggregates security fixes for the kernel SRPM in CIQ FIPS 8.6 Compliant. It addresses 1 CVE: CVE-2024-56661. Tenable has extracted the preceding...

Linux Distros Unpatched Vulnerability : CVE-2026-106553

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt. CVE-2026-106553 Note that...

Linux Distros Unpatched Vulnerability : CVE-2026-99019

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scsi: ch: Do not keep references to data transfer element devices chreadconfig looks up the scsidevice of every data transfer element whose SCSI id the changer...

RockyLinux 8 : kernel (RLSA-2026:87375)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:87375 advisory. kernel: ipv4: raw: reject IPHDRINCL packets with ihl msiperm after freeing it on init failure CVE-2026-89777 Tenable has extracted the preceding...

Linux Distros Unpatched Vulnerability : CVE-2026-99057

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xen/netfront: don't leak the skb when xennetfillfrags fails When a response chain has more slots than fit in the skb's frags, xennetfillfrags returns an error a...

Linux Distros Unpatched Vulnerability : CVE-2026-98882

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - media: chips-media: wave5: Add range checks for decoutputinfo If the driver's decoutputinfo contains invalid data the driver can write in invalid memory. Add a...

Linux Distros Unpatched Vulnerability : CVE-2026-55889

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileTransfer.RetrieveFiles method to...

Linux Distros Unpatched Vulnerability : CVE-2026-87311

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.16. Difficult to explo...

Linux Distros Unpatched Vulnerability : CVE-2026-101730

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are MySQL Server:...

RHEL 8 : php:7.4 (RHSA-2026:88533)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:88533 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: OOM bailout during request parsi...

Fedora 44 : ntpsec (2026-0c9e216697)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-0c9e216697 advisory. Update to the latest upstream release, which has security fixes for CVE-2026-102483 CVE-2026-102484 CVE-2026-102485 CVE-2026-102486. Tenable has...

FreeBSD : cjose -- Heap-based Buffer Overflow (35b3a492-b05a-11f1-9369-b42e991fc52e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 35b3a492-b05a-11f1-9369-b42e991fc52e advisory. https://github.com/OpenIDC/cjose/security/advisories/GHSA-75r7-f5cv-g3wj reports: OpenIDC/cjose is a C...

Linux Distros Unpatched Vulnerability : CVE-2026-10758

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Esri LERC is an open-source image or raster format which supports rapid encoding and decoding for any pixel type. A Heap based Out-of-Bounds Write via Integer...

Linux Distros Unpatched Vulnerability : CVE-2026-91484

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in Oracle Java SE component: Java plugin. Supported versions that are affected are Oracle Java SE: 8u503 and 8u503-perf. Difficult to exploit...

Curl 7.20.0 < 8.23.0 Local File Overwrite

The version of curl installed on the remote host is 7.20.0 prior to 8.23.0. It is, therefore, affected by a file overwrite vulnerability: - When invoked with --remote-header-name -J, curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response...

Linux Distros Unpatched Vulnerability : CVE-2026-114459

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in modqos. When inspecting HTTP response bodies, improper boundary checking can cause the module to read memory outside allocated buffer...

Fedora 44 : ca-certificates (2026-0609e13c0d)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-0609e13c0d advisory. Update ca-certificates to ca-certificates-2026.2.92v9.0.319-2.fc44 Remove emSign Root CS CA - G3 Additional code signing certificate that sign 2 of the...

Linux Distros Unpatched Vulnerability : CVE-2026-101770

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Client programs. Supported versions that are affected are MySQL Server:...

Linux Distros Unpatched Vulnerability : CVE-2026-106584

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can be a slightly more...

Curl 8.12.0 < 8.23.0 HTTP/2 Upload Use-After-Free

The version of curl installed on the remote host is 8.12.0 prior to 8.23.0. It is, therefore, affected by a use-after-free vulnerability: - During an upload, curl mishandles HTTP/2 RSTSTREAM received from the server with reason HTTP11REQUIRED or REFUSEDSTREAM leading to a use after free of a stru...

Curl 8.7.0 < 8.23.0 Cookie Jar Parsing Issue

The version of curl installed on the remote host is 8.7.0 prior to 8.23.0. It is, therefore, affected by a cookie jar vulnerability: - When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make curl write a record that exceeds its line-length parsing limit...

Linux Distros Unpatched Vulnerability : CVE-2026-93521

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A buffer overflow in RandR ChangeProviderProperty requests in X.Org X Server before 2.1.25 and XWayland before 24.4.14 could be used by authenticated X clients ...

Linux Distros Unpatched Vulnerability : CVE-2026-98958

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: mt76: account non-AQL frames per peer rather than per link The driver increments wcid-nonaqlpackets when a frame goes to the hardware queue. The completio...

Linux Distros Unpatched Vulnerability : CVE-2025-60487

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A segmentation violation in the gfisomgetesd function /isomedia/isomread.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS v...

Linux Distros Unpatched Vulnerability : CVE-2026-99022

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - regulator: ltc3676: don't read the write-only HRST and CLIRQ registers HRST 0x1e and CLIRQ 0x1f are write-only command strobes. Writing HRST triggers a hard res...

Linux Distros Unpatched Vulnerability : CVE-2026-113732

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.2, FishActivator inherits ViaTemplateActivator.quote, which uses POSIX...

Debian dla-4853 : chromium - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4853 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4853-1 [email protected]...

Rocky Linux 8.10 [CIQ] Security Update: bpftool / kernel / kernel-abi-stablelists / kernel-core / etc (ciqsa-2026_1691)

The Rocky Linux 8.10 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261691 advisory. This advisory aggregates security fixes for the kernel SRPM in CIQ Core 8.10. It addresses 1 CVE: CVE-2026-53264. Tenable has extracted the preceding description...

Linux Distros Unpatched Vulnerability : CVE-2026-115389

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 does not adequately account for host allocations when lifting guest values through the...

Linux Distros Unpatched Vulnerability : CVE-2026-114145

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitPython is a python library used to interact with Git repositories. Prior to 3.2.1, createsubmodule in git/objects/submodule/base.py accepts an...

MiracleLinux 9 : php:8.1 (AXSA:2026-2127:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2127:01 advisory. php: OOM bailout during request parsing leads to memory corruption and RCE CVE-2026-109618 php: fatal error handling retains stale request state...

Linux Distros Unpatched Vulnerability : CVE-2026-99008

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: RFCOMM: Fix NULL ttydev dereference in rfcommdevshutdown syzbot hit a NULL pointer dereference in rfcommdevshutdown when an RFCOMM tty is closed...

Linux Distros Unpatched Vulnerability : CVE-2026-98989

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - namespace: check a recursive bind mount for mount namespace loops doloopback refuses to bind mount the file of a mount namespace that is as old as the caller's ...

CentOS Linux 7 [TuxCare] Security Update: gstreamer1-plugins-base / gstreamer1-plugins-base-devel / etc (CENTOS7:CLSA-2026:1790603589)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1790603589 advisory. - GStreamer OGG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execu...

Linux Distros Unpatched Vulnerability : CVE-2026-98975

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xfs: stop exchanging reflink flags when exchanging mappings When an exchange covers both files from offset 0 to idisksize, xmicanexchangereflinkflags assumes...

Linux Distros Unpatched Vulnerability : CVE-2026-105243

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Insufficient Logging vulnerability in the EventLogAppender of Apache log4net. Long messages were truncated to a fixed size that exceeds what the Windows Event L...

Linux Distros Unpatched Vulnerability : CVE-2026-93523

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A heap buffer overflow caused by a XIPassiveUngrabDevice request with an out-of-range modifier value in X.Org X Server before 21.1.15 and XWayland before 24.1.1...

MiracleLinux 8 : php:7.4 (AXSA:2026-2134:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2134:01 advisory. php: php: Out-of-bounds read via empty HTTP redirect Location header CVE-2026-93682 php: PHP: Archive entry injection via integer overflow in TAR...