Linux Distros Unpatched Vulnerability : CVE-2026-114459

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in modqos. When inspecting HTTP response bodies, improper boundary checking can cause the module to read memory outside allocated buffer...

Fedora 44 : ca-certificates (2026-0609e13c0d)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-0609e13c0d advisory. Update ca-certificates to ca-certificates-2026.2.92v9.0.319-2.fc44 Remove emSign Root CS CA - G3 Additional code signing certificate that sign 2 of the...

Linux Distros Unpatched Vulnerability : CVE-2026-101770

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Client programs. Supported versions that are affected are MySQL Server:...

Linux Distros Unpatched Vulnerability : CVE-2026-106584

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can be a slightly more...

Curl 8.12.0 < 8.23.0 HTTP/2 Upload Use-After-Free

The version of curl installed on the remote host is 8.12.0 prior to 8.23.0. It is, therefore, affected by a use-after-free vulnerability: - During an upload, curl mishandles HTTP/2 RSTSTREAM received from the server with reason HTTP11REQUIRED or REFUSEDSTREAM leading to a use after free of a stru...

Curl 8.7.0 < 8.23.0 Cookie Jar Parsing Issue

The version of curl installed on the remote host is 8.7.0 prior to 8.23.0. It is, therefore, affected by a cookie jar vulnerability: - When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make curl write a record that exceeds its line-length parsing limit...

Linux Distros Unpatched Vulnerability : CVE-2026-93521

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A buffer overflow in RandR ChangeProviderProperty requests in X.Org X Server before 2.1.25 and XWayland before 24.4.14 could be used by authenticated X clients ...

Linux Distros Unpatched Vulnerability : CVE-2026-98958

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: mt76: account non-AQL frames per peer rather than per link The driver increments wcid-nonaqlpackets when a frame goes to the hardware queue. The completio...

Linux Distros Unpatched Vulnerability : CVE-2025-60487

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A segmentation violation in the gfisomgetesd function /isomedia/isomread.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS v...

Linux Distros Unpatched Vulnerability : CVE-2026-99022

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - regulator: ltc3676: don't read the write-only HRST and CLIRQ registers HRST 0x1e and CLIRQ 0x1f are write-only command strobes. Writing HRST triggers a hard res...

Linux Distros Unpatched Vulnerability : CVE-2026-113732

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.2, FishActivator inherits ViaTemplateActivator.quote, which uses POSIX...

Debian dla-4853 : chromium - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4853 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4853-1 [email protected]...

Rocky Linux 8.10 [CIQ] Security Update: bpftool / kernel / kernel-abi-stablelists / kernel-core / etc (ciqsa-2026_1691)

The Rocky Linux 8.10 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261691 advisory. This advisory aggregates security fixes for the kernel SRPM in CIQ Core 8.10. It addresses 1 CVE: CVE-2026-53264. Tenable has extracted the preceding description...

Linux Distros Unpatched Vulnerability : CVE-2026-115389

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 does not adequately account for host allocations when lifting guest values through the...

Linux Distros Unpatched Vulnerability : CVE-2026-114145

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitPython is a python library used to interact with Git repositories. Prior to 3.2.1, createsubmodule in git/objects/submodule/base.py accepts an...

MiracleLinux 9 : php:8.1 (AXSA:2026-2127:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2127:01 advisory. php: OOM bailout during request parsing leads to memory corruption and RCE CVE-2026-109618 php: fatal error handling retains stale request state...

Linux Distros Unpatched Vulnerability : CVE-2026-99008

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: RFCOMM: Fix NULL ttydev dereference in rfcommdevshutdown syzbot hit a NULL pointer dereference in rfcommdevshutdown when an RFCOMM tty is closed...

Linux Distros Unpatched Vulnerability : CVE-2026-98989

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - namespace: check a recursive bind mount for mount namespace loops doloopback refuses to bind mount the file of a mount namespace that is as old as the caller's ...

CentOS Linux 7 [TuxCare] Security Update: gstreamer1-plugins-base / gstreamer1-plugins-base-devel / etc (CENTOS7:CLSA-2026:1790603589)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1790603589 advisory. - GStreamer OGG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execu...

Linux Distros Unpatched Vulnerability : CVE-2026-98975

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xfs: stop exchanging reflink flags when exchanging mappings When an exchange covers both files from offset 0 to idisksize, xmicanexchangereflinkflags assumes...

Linux Distros Unpatched Vulnerability : CVE-2026-105243

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Insufficient Logging vulnerability in the EventLogAppender of Apache log4net. Long messages were truncated to a fixed size that exceeds what the Windows Event L...

Linux Distros Unpatched Vulnerability : CVE-2026-93523

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A heap buffer overflow caused by a XIPassiveUngrabDevice request with an out-of-range modifier value in X.Org X Server before 21.1.15 and XWayland before 24.1.1...

MiracleLinux 8 : php:7.4 (AXSA:2026-2134:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2134:01 advisory. php: php: Out-of-bounds read via empty HTTP redirect Location header CVE-2026-93682 php: PHP: Archive entry injection via integer overflow in TAR...

Linux Distros Unpatched Vulnerability : CVE-2026-114370

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the PathResourceManager component of the Undertow web server. This component is responsible for serving static files from the file system. T...

MiracleLinux 8 : php:7.2 (AXSA:2026-2132:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2132:01 advisory. php: OOM bailout during request parsing leads to memory corruption and RCE CVE-2026-109618 php: fatal error handling retains stale request state...

Linux Distros Unpatched Vulnerability : CVE-2026-99037

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - dm-crypt: reject the lmk IV mode with AEAD ciphers A capi: table line that pairs an AEAD cipher with the lmk IV mode, for example capi:gcmaes-lmk with the...

Linux Distros Unpatched Vulnerability : CVE-2026-99035

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mmc: mtk-sd: Cancel request timeout work on remove The driver queues reqtimeout while a request is active. msdcrequestdone uses canceldelayedwork, which does no...

Linux Distros Unpatched Vulnerability : CVE-2026-101624

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: InnoDB. Supported versions that are affected are MySQL Server: 8.4.0-8.4.12,...

Rocky Linux 8.10 [CIQ] Security Update: bpftool / kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ciqsa-2026_1682)

The Rocky Linux 8.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261682 advisory. This advisory aggregates security fixes for the kernel SRPM in CIQ Core 8.10. It addresses 3 CVEs: CVE-2025-38735, CVE-2026-23386, CVE-2025-71156. Tenab...

Rocky Linux 9.6 [TuxCare] Security Update: postgresql / postgresql-contrib / postgresql-docs / etc (ALMALINUX9.6:CLSA-2026:1792746510)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792746510 advisory. - Untrusted search path in PostgreSQL amcheck allows a grantee of amcheck function EXECUTE privilege to execute arbitrary functions as the...

Linux Distros Unpatched Vulnerability : CVE-2026-114616

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.1, Authlib's OctKey.importkey and HMAC signing and verification path...

Linux Distros Unpatched Vulnerability : CVE-2025-55667

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A segmentation violation in the dumpisomsaps function /mp4box/filedump.c of GPAC MP4Box v2.5-DEV- rev1672-gc9a31d0e1-masterallows attackers to cause a Denial of...

Linux Distros Unpatched Vulnerability : CVE-2026-99071

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipv4: do not warn on route notification size race Commit 680aea08e78c net: ipv4: Emit notification when fib hardware flags are changed added asynchronous route...

Fedora 44 : clevis-pin-trustee (2026-a99da3001b)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-a99da3001b advisory. Merge 6 Rebuild for CVE-2026-93600 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

Linux Distros Unpatched Vulnerability : CVE-2026-90798

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allows the owner of a replication source or target to cause a...

Oracle Linux 8 : ca-certificates (ELSA-2026-88550)

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-88550 advisory. 2026.2.92v9.0.319-81.3 - Fix malformed patch header in remove-emsign-root-cs-ca-g3.patch 2026.2.92v9.0.319-81.2 - Removing: emSign Root CS CA - G3 from Microso...

Atlassian Jira Service Management Data Center and Server 10.0.x < 10.3.24 / 10.4.x < 11.3.10 (JSDSERVER-16700)

The version of Atlassian Jira Service Management Data Center and Server Jira Service Desk running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-16700 advisory. - Netty is a network application framework for development of protocol servers and clients. In version...

Rocky Linux 9.6 [CIQ] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc Multiple Vulnerabilities (ciqsa-2026_1715)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261715 advisory. This advisory aggregates security fixes for the php SRPM in CIQ LTS 9.6. It addresses 2 CVEs: CVE-2026-109619, CVE-2026-109618. Tenable has extracted the...

Curl 8.10.0 < 8.23.0 Transfer Timeout Bypass DoS

The version of curl installed on the remote host is 8.10.0 prior to 8.23.0. It is, therefore, affected by a denial of service vulnerability: - By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl and completely bypass its...

Linux Distros Unpatched Vulnerability : CVE-2026-101762

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Security: Encryption. Supported versions that are affected are MySQL...

Linux Distros Unpatched Vulnerability : CVE-2026-101618

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: InnoDB. Supported versions that are affected are MySQL Server: 8.4.0-8.4.12,...

Linux Distros Unpatched Vulnerability : CVE-2026-98966

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bonding: fix the program leak when XDP is replaced We need to release the reference on the old BPF prog, whether we are going to no-prog, or replacing the prog...

Linux Distros Unpatched Vulnerability : CVE-2026-113680

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HarfBuzz from 8.0.0 through 14.6.0 contains a NULL pointer dereference vulnerability in the experimental WebAssembly shaper host imports buffersetcontents,...

RockyLinux 9 : ca-certificates (RLSA-2026:88459)

The remote RockyLinux 9 host has a package installed that is affected by a vulnerability as referenced in the RLSA-2026:88459 advisory. ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns CVE-2026-114406 Tenable has extracted the preceding description block...

AlmaLinux 9.6 [TuxCare] Security Update: postgresql / postgresql-contrib / postgresql-docs / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1792796702)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792796702 advisory. - Missing authorization in PostgreSQL CREATE STATISTICS command allows a table owner to achieve denial of service against other CREA...

Curl 7.21.0 < 8.23.0 FTP Wildcard Use-After-Free

The version of curl installed on the remote host is 7.21.0 prior to 8.23.0. It is, therefore, affected by a use-after-free vulnerability: - When an FTP wildcard LIST operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the internal...

Linux Distros Unpatched Vulnerability : CVE-2026-87301

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.16. Easily exploitable...

Linux Distros Unpatched Vulnerability : CVE-2026-114137

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Django REST framework is a toolkit for building Web APIs. From 3.12.0 until 3.18.2, TokenProxy.delete in restframework/authtoken/models.py uses the proxy's...

Linux Distros Unpatched Vulnerability : CVE-2026-114614

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.13 until 1.8.0, authlib.common.security.issecuretransport uses a textual prefi...

Oracle Linux 10 : ca-certificates (ELSA-2026-88455)

The remote Oracle Linux 10 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-88455 advisory. 2026.2.92v9.0.319-100.3 - Fix malformed patch header in remove-emsign-root-cs-ca-g3.patch 2026.2.92v9.0.319-100.2 - Removing: emSign Root CS CA - G3 from...