Linux Distros Unpatched Vulnerability : CVE-2026-101729

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Replication. Supported versions that are affected are MySQL Server:...

Linux Distros Unpatched Vulnerability : CVE-2026-115392

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 allows a filesystem sandbox escape in wasmtime-wasi because its...

Linux Distros Unpatched Vulnerability : CVE-2026-101778

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Components Services. Supported versions that are affected are MySQL...

Linux Distros Unpatched Vulnerability : CVE-2026-115379

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a missing GC rooting vulnerability that leaves references live across trycall unrooted when...

Linux Distros Unpatched Vulnerability : CVE-2026-101779

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Telemetry. Supported versions that are affected are MySQL Server:...

SUSE SLED15: cyrus-sasl / cyrus-sasl-32bit / cyrus-sasl-bdb / etc (SUSE-SU-2026:4836-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4836-1 advisory. This update for cyrus-sasl fixes the following issue: - CVE-2026-107161: Heap buffer overflow in cyrus-sasl...

Linux Distros Unpatched Vulnerability : CVE-2026-98931

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mtd: spinand: fix NULL pointer dereference with no ECC engine When nand-no-ecc-engine is set in DT, nanddevgeteccengine takes the NANDECCENGINETYPENONE path and...

Linux Distros Unpatched Vulnerability : CVE-2026-115355

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../ sequences i...

nginx 0.1.29 < 1.30.6 / 1.31.x < 1.31.7 Buffer Overflow Vulnerability

According to its Server response header, the installed version of nginx is 0.1.29 prior to 1.30.6 or 1.31.0 prior to 1.31.7. It is, therefore, affected by the following issue : - A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive...

AlmaLinux 10 : podman (ALSA-2026:88202)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:88202 advisory. podman: The podman run command can be instructed to disable almost all sandboxing - including user- requested sandboxing - by image annotation CVE-2026-94603...

AlmaLinux 9 : cockpit-machines (ALSA-2026:86970)

The remote AlmaLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:86970 advisory. cockpit-machines: cockpit-machines: Sensitive data exposure via command-line arguments CVE-2026-92768 cockpit-machines: cockpit-machines: Sensitive Data...

MiracleLinux 9 : cockpit-files-36.1-1.el9_8 (AXSA:2026-2124:03)

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-2124:03 advisory. cockpit-files: cockpit-files: Arbitrary file ownership change via symlink following in privileged paste CVE-2026-91202 cockpit-files: cockpit-files:...

RHEL 9 : ca-certificates (RHSA-2026:88563)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:88563 advisory. The ca-certificates package contains a set of Certificate Authority CA certificates chosen by the Mozilla Foundation for use with the Internet Publi...

openSUSE 16 Security Update : python-soupsieve (openSUSE-SU-2026:22149-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22149-1 advisory. - CVE-2026-85999: quadratic complexity when running the whitespace/comment trimming regex REWSEND can lead to DoS bsc1281119. - CVE-2026-86000:...

Rocky Linux 8.6 [CIQ] Security Update: bpftool / kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ciqsa-2026_1676)

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261676 advisory. This advisory aggregates security fixes for the kernel SRPM in CIQ FIPS 8.6 Compliant. It addresses 2 CVEs: CVE-2026-53359, CVE-2026-46113. Tenable has...

Linux Distros Unpatched Vulnerability : CVE-2026-114096

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkoutpaths=... that allows attackers to write arbitrary files by...

Oracle Linux 9 : sudo (ELSA-2026-12310)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-12310 advisory. 1.9.5p2-15 RHEL 9.7.0 ERRATUM - CVE-2026-35535 - Privilege escalation due to failure in privilege drop calls Resolves: RHEL-166065 Tenable has extracted the...

Linux Distros Unpatched Vulnerability : CVE-2026-115221

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in FreeIPA. An improper authorization check allows an authenticated host to retrieve and revoke digital certificates assigned to other users or...

Linux Distros Unpatched Vulnerability : CVE-2026-99063

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - dm ioctl: don't let datastart run past the buffer struct dmioctl has seven bytes of trailing padding, so the smallest buffer userspace is allowed to ask for,...

SUSE SLES15 Security Update : distribution (SUSE-SU-2026:4861-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4861-1 advisory. This update for distribution rebuilds it against the current go security release. Tenable has extracted the preceding description block...

Linux Distros Unpatched Vulnerability : CVE-2026-101780

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: X Plugin. Supported versions that are affected are MySQL Server:...

Linux Distros Unpatched Vulnerability : CVE-2026-99086

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - dm-integrity: validate the superblock on resume dmintegrityresume re-reads the superblock from the device so that it picks up the flags and the recalculate...

Rocky Linux 8.6 [CIQ] Security Update: bpftool / kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ciqsa-2026_1671)

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261671 advisory. This advisory aggregates security fixes for the kernel SRPM in CIQ FIPS 8.6 Compliant. It addresses 3 CVEs: CVE-2026-31677, CVE-2026-31431, CVE-2026-2306...

Rocky Linux 8.10 [CIQ] Security Update: bpftool / kernel / kernel-abi-stablelists / kernel-core / etc (ciqsa-2026_1686)

The Rocky Linux 8.10 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261686 advisory. This advisory aggregates security fixes for the kernel SRPM in CIQ Core 8.10. It addresses 1 CVE: CVE-2026-43284. Tenable has extracted the preceding description...

Linux Distros Unpatched Vulnerability : CVE-2026-101621

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: InnoDB. Supported versions that are affected are MySQL Server: 8.4.0-8.4.12,...

Linux Distros Unpatched Vulnerability : CVE-2026-98945

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HID: steam: Rearrange teardown sequence This fixes a narrow window during the teardown sequence where callbacks could still be scheduled during cleanup that wou...

Linux Distros Unpatched Vulnerability : CVE-2026-114618

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, the default RFC 7523 JWTBearerGrant.getaudiences returns an empty lis...

Linux Distros Unpatched Vulnerability : CVE-2026-99009

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: RFCOMM: connect the session socket without rfcommmutex An RFCOMM connect issued while a BR/EDR link is being authenticated makes lockdep report a...

Linux Distros Unpatched Vulnerability : CVE-2026-98964

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nvmet: use the local P2P device on metadata allocation failure nvmetreqallocp2pmemsgls assigns req-p2pdev only after the data and metadata SGL allocations...

Linux Distros Unpatched Vulnerability : CVE-2026-101775

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Replication. Supported versions that are affected are MySQL Server:...

Oracle Linux 8 : openssh (ELSA-2026-88211)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-88211 advisory. - CVE-2026-59998: Document caveat regarding GSSAPIStrictAcceptorCheck Resolves: RHEL-272840 - CVE-2026-59997: Fix internal-sftp server argument parsin...

Linux Distros Unpatched Vulnerability : CVE-2026-98946

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/vc4: Disable the V3D interrupt across runtime suspend vc4irqdisable masks the V3D interrupt sources and then calls synchronizeirq before the V3D is powered...

FreeBSD : chromium -- security fixes (f4f0bb8d-ce20-11f1-9bfa-a8a1599412c6)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the f4f0bb8d-ce20-11f1-9bfa-a8a1599412c6 advisory. Chrome Releases reports: This update includes 353 security fixes: Tenable has extracted the...

Python Library Werkzeug < 3.1.9 DoS (CVE-2026-102598)

The version of the Werkzeug Python package installed on the remote Windows host is prior to 3.1.9. It is, therefore, affected by a denial of service vulnerability: - Werkzeug is a WSGI web application library. Prior to 3.1.9, the safejoin function used by sendfromdirectory can allow a NUL:...

Linux Distros Unpatched Vulnerability : CVE-2026-98908

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: microchip: sparx5: clean up PSFP resources on flower setup failure sparx5tcflowerpsfpsetup allocates PSFP stream gate, flow meter and stream filter resourc...

Linux Distros Unpatched Vulnerability : CVE-2026-98979

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - namespace: refuse an automount below a mount that is in no namespace It's possible to add autmounts even when the parent mount isn't in the mount namespace of t...

CentOS Linux 7 [TuxCare] Security Update: gstreamer1-plugins-good Multiple Vulnerabilities (CENTOS7:CLSA-2026:1792239628)

The CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1792239628 advisory. - A flaw was found in GStreamer gst-plugins-good avidemux. When parsing FUJIFILM metadata in an AVI strd chunk, gstavidemuxparsestrd...

Cisco Unified Communications Manager (CUCM) < 15SU5 Improper Access Control (cisco-sa-cucm-access-PW9e8Jt2)

According to its self-reported version, Cisco Unified Communications Manager is affected by an improper access control vulnerability. - A vulnerability in Cisco Unified Communications Manager Unified CM and Cisco Unified Communications Manager Session Management Edition Unified CM SME could allow...

Linux Distros Unpatched Vulnerability : CVE-2026-115390

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Wasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 contains a fuel accounting flaw in Cranelift- compiled callref and trytable catch paths. Malicious guests...

Linux Distros Unpatched Vulnerability : CVE-2026-99025

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - openvswitch: fix soft lockup in the netlink flow dump A production compute node carrying a few thousand datapath flows hit a soft lockup inside a single netlink...

SUSE SLES16: apache2-mod_php8 / php8 / php8-bcmath / php8-bz2 / php8-calendar / etc (SUSE-SU-2026:24271-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:24271-1 advisory. This update for php8 fixes the following issue: Update to php 8.4.27: - CVE-2026-109618,CVE-2026-109619: memory corruption leading...

Linux Distros Unpatched Vulnerability : CVE-2026-115638

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka a gzip bomb...

SUSE SLED15: MozillaFirefox / MozillaFirefox-devel / etc (SUSE-SU-2026:4834-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4834-1 advisory. Firefox Extended Support Release 153.5.0 ESR MFSA 2026-108, bsc1284493: - CVE-2026-109704: Privilege escalatio...

Linux Distros Unpatched Vulnerability : CVE-2026-114094

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write. Attackers can craft a...

Linux Distros Unpatched Vulnerability : CVE-2026-99026

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: team: free skb when broadcast has no txable port bctransmit sends the original skb through the last txable port. When no port is txable, it returns false...

Linux Distros Unpatched Vulnerability : CVE-2026-101788

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Components Services. Supported versions that are affected are MySQL...

AlmaLinux 9 : expat (ALSA-2026:88247)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:88247 advisory. expat: expat: Denial of Service via integer overflow in expatrealloc CVE-2026-102633 expat: expat: Information disclosure via heap buffer over-read in...

Linux Distros Unpatched Vulnerability : CVE-2025-55640

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A heap buffer overflow in the stblAddSize function isomedia/stblwrite.c of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service DoS via supplying a...

AlmaLinux 9.6 [TuxCare] Security Update: postgresql / postgresql-contrib / postgresql-docs / etc (ALMALINUX9.6:CLSA-2026:1792746510)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792746510 advisory. - Untrusted search path in PostgreSQL amcheck allows a grantee of amcheck function EXECUTE privilege to execute arbitrary functions as the...

AlmaLinux 9.2 [TuxCare] Security Update: ruby / ruby-default-gems / ruby-devel / ruby-doc / ruby-libs / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1792800480)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792800480 advisory. - An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before...