EulerOS 2.0 SP12 : shim (EulerOS-SA-2026-2629)

According to the versions of the shim packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Issue summary: When a delta CRL that contains a Delta CRL Indicator extension is processed a NULL pointer dereference might happen if the required C...

EulerOS 2.0 SP12 : python-urllib3 (EulerOS-SA-2026-2624)

According to the versions of the python-urllib3 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via...

OpenSSH < 10.4 Multiple Vulnerabilities

The version of OpenSSH installed on the remote host is prior to 10.4. It is, therefore, affected by multiple vulnerabilities, including: - ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. This outcome occurs only on the client side...

MiracleLinux 9 : kernel-5.14.0-687.10.1.el9_8 (AXSA:2026-1231:47)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1231:47 advisory. kernel: net/sched: Make cakeenqueue return NETXMITCN when past bufferlimit CVE-2025-39766 kernel: scsi: qla2xxx: Fix improper freeing of purex item...

RHEL 10 : golang (RHSA-2026:37436)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:37436 advisory. The golang packages provide the Go programming language compiler. Security Fixes: golang.org/x/net/idna: golang: golang.org/x/net/idna:...

Siemens SCALANCE, RUGGEDCOM, and SIPLUS Out-of-bounds Write (CVE-2025-15467)

Issue summary: Parsing CMS AuthEnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow. Impact summary: A stack buffer overflow may lead to a crash, causing Denial of Service, or potentially remote code execution. When parsing CMS AuthEnvelopedData...

Langflow < 1.9.2 Multiple Vulnerabilities

The version of Langflow installed on the remote host is prior to 1.9.2. It is, therefore, affected by multiple vulnerabilities: - The Shareable Playground feature enables execution of workflows by unauthenticated users. When the route /api/v1/buildpublictmp executes a flow, it allows providing...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : LibRaw vulnerabilities (USN-8522-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8522-1 advisory. It was discovered that LibRaw incorrectly handled certain Nikon RAW image files. An attacker could possibly use this issue to cau...

EulerOS 2.0 SP12 : polkit (EulerOS-SA-2026-2553)

According to the versions of the polkit packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in polkit. A local user can exploit this by providing a specially crafted, excessively long input to the polkit-agent-helper-1...

EulerOS 2.0 SP12 : golang (EulerOS-SA-2026-2591)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv...

EulerOS 2.0 SP12 : libsoup (EulerOS-SA-2026-2542)

According to the versions of the libsoup packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in libsoup. When establishing HTTPS tunnels through a configured HTTP proxy, sensitive session cookies are transmitted in...

RockyLinux 9 : gstreamer1-plugins-bad-free (RLSA-2026:36834)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:36834 advisory. gstreamer1-plugins-bad-free: GStreamer: Denial of service via AV1 tilelistobu parser byte/bit confusion CVE-2026-52718 gstreamer1-plugins-bad-free:...

Fedora 43 : python-pendulum (2026-e55bcd0c54)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-e55bcd0c54 advisory. Update to 3.2.0 final. Update PyO3 to 0.29, fixing RUSTSEC-2026-0176 and RUSTSEC-2026-0177. Tenable has extracted the preceding description block directly fr...

EulerOS 2.0 SP12 : libarchive (EulerOS-SA-2026-2538)

According to the versions of the libarchive packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in libarchive. An Undefined Behavior vulnerability exists in the zisofs decompression logic, caused by improper validation of...

GStreamer < 1.28.5 Multiple Vulnerabilities

The version of GStreamer installed on the remote host is prior to 1.28.5. It is, therefore, affected by multiple vulnerabilities: - A signed integer overflow vulnerability was found in GStreamer's VMnc decoder. A crafted VMnc stream with large cursor dimensions can overflow signed integer...

AlmaLinux 9 : gstreamer1-plugins-good (ALSA-2026:37129)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:37129 advisory. gstreamer1-plugins-good: GStreamer: Heap buffer overflow in WavPack decoder via integer overflow CVE-2026-53705 Tenable has extracted the preceding description...

Langflow < 1.9.0 Missing Authorization (CVE-2026-33760)

The version of Langflow installed on the remote host is prior to 1.9.0. It is, therefore, affected by a missing authorization vulnerability: - The /api/v1/monitor router exposes 7 endpoints that perform read, write, and delete operations on user-owned resources without verifying that the...

Linux Distros Unpatched Vulnerability : CVE-2026-39178

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A SQL injection vulnerability in SOGo before 5.12.7 allows authenticated users to execute arbitrary SQL statements via the search parameter of the...

EulerOS 2.0 SP12 : libcap (EulerOS-SA-2026-2539)

According to the versions of the libcap packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use TOCTOU race condition in the capsetfile function...

EulerOS 2.0 SP12 : expat (EulerOS-SA-2026-2526)

According to the versions of the expat packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : libexpat before 2.7.5 allows an infinite loop while parsing DTD content.CVE-2026-32777 libexpat before 2.7.5 allows a NULL pointer dereference with...

RockyLinux 10 : gstreamer1-plugins-ugly-free (RLSA-2026:36673)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:36673 advisory. gstreamer1-plugins-ugly-free: GStreamer: Out-of-bounds read in RealMedia demuxer audio stream header parser CVE-2026-53703 Tenable has extracted the preceding...

EulerOS 2.0 SP12 : ruby (EulerOS-SA-2026-2567)

According to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : ERB is a templating system for Ruby. Ruby 2.7.0 before ERB 2.2.0 was published on rubygems.org introduced an @init instance variable guard in...

EulerOS 2.0 SP12 : openssl (EulerOS-SA-2026-2551)

According to the versions of the openssl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Issue summary: During processing of a crafted CMS EnvelopedData message with KeyAgreeRecipientInfo a NULL pointer dereference can happen. Impact...

EulerOS 2.0 SP12 : python3 (EulerOS-SA-2026-2625)

According to the versions of the python3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : User-controlled header names and values containing newlines can allow injecting HTTP headers.CVE-2026-0865 Tenable has extracted the preceding...

EulerOS 2.0 SP12 : libxml2 (EulerOS-SA-2026-2605)

According to the versions of the libxml2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A vulnerability was found in libxml2 up to 2.14.5. It has been declared as problematic. This vulnerability affects the function xmlParseSGMLCatal...

EulerOS 2.0 SP12 : kata-containers (EulerOS-SA-2026-2534)

"According to the versions of the kata-containers package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input...

SUSE SLED15 / SLES15 Security Update : rustup (SUSE-SU-2026:2832-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2832-1 advisory. This update for rustup fixes the following issues Security issues: - CVE-2024-12224: idna: idna accepts Punyco...

EulerOS 2.0 SP12 : util-linux (EulerOS-SA-2026-2635)

According to the versions of the util-linux packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU Time-of-Check- Time-of-Use vulnerability has been...

EulerOS 2.0 SP12 : openjpeg2 (EulerOS-SA-2026-2549)

According to the versions of the openjpeg2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A vulnerability was identified in uclouvain openjpeg up to 2.5.4. This impacts the function opjpiinitialiseencode in the library...

Linux Distros Unpatched Vulnerability : CVE-2026-50813

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in SQLite before Fossil check-in 869a51ae84df allows a local attacker to obtain sensitive information via the Session Extension changeset...

EulerOS 2.0 SP12 : python-ecdsa (EulerOS-SA-2026-2616)

According to the versions of the python-ecdsa packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : The ecdsa PyPI package is a pure Python implementation of ECC Elliptic Curve Cryptography with support for ECDSA Elliptic Curve Digital...

RockyLinux 10 : aardvark-dns (RLSA-2026:36782)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:36782 advisory. aardvark-dns: Aardvark-dns: Denial of Service via truncated TCP DNS query and connection reset CVE-2026-35406 Tenable has extracted the preceding description...

EulerOS 2.0 SP12 : libssh2 (EulerOS-SA-2026-2543)

According to the versions of the libssh2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function userauthpassword of the file...

EulerOS 2.0 SP12 : tigervnc (EulerOS-SA-2026-2633)

According to the versions of the tigervnc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : In TigerVNC before 1.16.2, Image.cxx in x0vncserver allows other users to observe or manipulate the screen contents, or cause an application...

EulerOS 2.0 SP12 : rsync (EulerOS-SA-2026-2566)

According to the versions of the rsync packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter is not checke...

EulerOS 2.0 SP12 : libarchive (EulerOS-SA-2026-2598)

According to the versions of the libarchive packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in libarchive. An Undefined Behavior vulnerability exists in the zisofs decompression logic, caused by improper validation of...

Langflow < 1.9.1 Multiple Vulnerabilities

The version of Langflow installed on the remote host is prior to 1.9.1. It is, therefore, affected by multiple vulnerabilities: - An Insecure Direct Object Reference IDOR vulnerability in the /api/v1/responses endpoint allows an authenticated attacker to execute any flow belonging to another user...

EulerOS 2.0 SP12 : vim (EulerOS-SA-2026-2636)

According to the versions of the vim packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Vim is an open source, command line text editor. Prior to 9.2.0479, a command injection vulnerability exists in tarVimuntar in runtime/autoload/tar.v...

openSUSE 16 Security Update : python-joserfc (openSUSE-SU-2026:21263-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21263-1 advisory. Changes in python-joserfc: - CVE-2026-49852: HS256/HS384/HS512 verify accepts empty/nil HMAC key bsc1270234 Tenable has extracted the preceding...

EulerOS 2.0 SP12 : systemd (EulerOS-SA-2026-2572)

According to the versions of the systemd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in systemd. The systemd-machined service contains an Improper Access Control vulnerability due to insufficient validation of the...

EulerOS 2.0 SP12 : systemd (EulerOS-SA-2026-2632)

According to the versions of the systemd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in systemd. The systemd-machined service contains an Improper Access Control vulnerability due to insufficient validation of the...

Linux Distros Unpatched Vulnerability : CVE-2026-15308

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The incremental HTML parser html.parser.HTMLParser allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontroll...

Oracle Linux 8 : 389-ds:1.4 (ELSA-2026-36201)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-36201 advisory. - Resolves: RHEL-182162 - EMBARGOED CVE-2026-11610 389-ds-base: 389-ds-base: Heap buffer overflow in sasliorecv via padded SASL UNBIND rhel-8.10.z -...

RHEL 8 : tomcat (RHSA-2026:37136)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:37136 advisory. Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages JSP technologies. Security Fixes: Apache Tomcat: Apache...

openSUSE 16 Security Update : alloy (openSUSE-SU-2026:21251-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21251-1 advisory. Update to version 1.17.0. Security issues fixed: - CVE-2026-25680: golang.org/x/net/html: parsing arbitrary HTML can consume excessive CPU time,...

Linux Distros Unpatched Vulnerability : CVE-2026-15168

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - BLF file parser in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows possible information disclosure CVE-2026-15168 Note that Nessus relies on the presence of...

TencentOS Server 4: firefox (TSSA-2026:0545)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0545 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

RHEL 9 : kernel (RHSA-2026:36767)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:36767 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: Bluetooth: Fix use-after-free...

Linux Distros Unpatched Vulnerability : CVE-2026-59936

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pypdf is a free and open-source pure-python PDF library. Prior to 6.14.1, an attacker can craft a PDF with a page content stream containing a not terminated...

AlmaLinux 10 : gstreamer1-plugins-bad-free (ALSA-2026:36749)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:36749 advisory. gstreamer1-plugins-bad-free: GStreamer: Denial of service via AV1 tilelistobu parser byte/bit confusion CVE-2026-52718 gstreamer1-plugins-bad-free:...