Linux Distros Unpatched Vulnerability : CVE-2026-112077

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was detected in radareorg radare2 6.2.0/6.2.2. This issue affects the function rcorecmdstrpipe in the library libr/core/rtrhttp.inc.c of the...

Rocky Linux 8.10 [CIQ] Security Update: bpftool / kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ciqsa-2026_1663)

The Rocky Linux 8.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261663 advisory. This advisory aggregates security fixes for the kernel SRPM in CIQ FIPS 8.10 Compliant. It addresses 26 CVEs: CVE-2023-4004, CVE-2023-51042,...

Linux Distros Unpatched Vulnerability : CVE-2026-113792

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pypdf is a free and open-source pure-python PDF library. Prior to 6.20.1, calling PdfWriter.findoutlineitem on a crafted PDF with a cyclic outline hierarchy can...

Linux Distros Unpatched Vulnerability : CVE-2025-60480

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A heap buffer overflow in the gfodfac4cfgalternativeinfo function /odf/descriptors.c of GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master allows attackers t...

RockyLinux 8 : kernel-rt (RLSA-2026:87374)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:87374 advisory. kernel: ipv4: raw: reject IPHDRINCL packets with ihl msiperm after freeing it on init failure CVE-2026-89777 Tenable has extracted the preceding...

Rocky Linux 9.2 [CIQ] Security Update: bpftool / kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ciqsa-2026_1665)

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261665 advisory. This advisory aggregates security fixes for the kernel SRPM in CIQ FIPS 9.2 Certified. It addresses 5 CVEs: CVE-2023-5178, CVE-2023-2163, CVE-2023-6817,...

Linux Distros Unpatched Vulnerability : CVE-2026-99012

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: ISO: Serialize concurrent connect calls isosockconnect checks the socket state before taking the socket lock and drops the lock again before setting ...

Linux Distros Unpatched Vulnerability : CVE-2026-114135

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Jupyter Server is the backend for Jupyter web applications. From 2.0.0 until 2.6.0, enabling GatewayClient.url replaced the normal KernelWebsocketHandler with...

Linux Distros Unpatched Vulnerability : CVE-2026-98944

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HID: steam: Refactor registration This refactors and simplifies the registration/unregistration flow. Since we now only perform registration when the client isn...

Fedora 46 : openscap (2026-88e8f36e7b)

The remote Fedora 46 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-88e8f36e7b advisory. Automatic update for openscap-1.4.6-1.fc46. Changelog Fri Oct 23 2026 Jan ern - 1:1.4.6-1 - Upgrade to the latest upstream release - CVE-2026-85518: Fix path...

Linux Distros Unpatched Vulnerability : CVE-2026-101776

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Group Replication Plugin. Supported versions that are affected are...

Linux Distros Unpatched Vulnerability : CVE-2026-101754

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Client programs. Supported versions that are affected are MySQL Server:...

Linux Distros Unpatched Vulnerability : CVE-2026-115485

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the iscsiuio component of open-iscsi. The DHCPv6 option parser calls strlen on raw network data without ensuring a NUL terminator is present...

Linux Distros Unpatched Vulnerability : CVE-2026-101615

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: InnoDB. Supported versions that are affected are MySQL Server: 8.4.0-8.4.12,...

RHEL 10 : php (RHSA-2026:88561)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:88561 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: OOM bailout during request...

Linux Distros Unpatched Vulnerability : CVE-2026-107170

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in m17n-lib. A partial failure during library initialization can leave an internal driver pointer uninitialized. Under specific error condition...

Linux Distros Unpatched Vulnerability : CVE-2025-60491

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A heap use-after-free in the dasherflushsegment function /filters/dasher.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS v...

Linux Distros Unpatched Vulnerability : CVE-2026-88812

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A double free in XKB SetGeometryin X.Org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by attached clients to cause a crash or potentially...

Linux Distros Unpatched Vulnerability : CVE-2026-98954

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: always dissect GSO packets in virtionethdrtoskb Commit 9e8db5913264 net: avoid false positives in untrusted gso validation added a '&& skb-networkheader'...

Linux Distros Unpatched Vulnerability : CVE-2025-60479

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A NULL pointer dereference in the StatSFVec2f function /scenemanager/scenestats.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Servic...

Oracle Linux 9 : cockpit-machines (ELSA-2026-86970)

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-86970 advisory. - CVE-2026-92768 RHEL-263127 - CVE-2026-92747 RHEL-263114 Tenable has extracted the preceding description block directly from the Oracle Linux securit...

Linux Distros Unpatched Vulnerability : CVE-2026-92287

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Pass-through of unvalidated KMS URLs to KMS clients in Apache C++ Parquet and PyArrow versions 4.0.0 to 25.0.1. This affects users who read Parquet files and...

RHEL 9 : ca-certificates (RHSA-2026:88564)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:88564 advisory. The ca-certificates package contains a set of Certificate Authority CA certificates chosen by the Mozilla Foundation for use with the Internet Publi...

Linux Distros Unpatched Vulnerability : CVE-2026-113730

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OGNL is an Object Graph Navigation Library for Java. Prior to 3.4.13, the optional stricter-invocation mode in OgnlRuntime.invokeMethod checks the declaring cla...

Linux Distros Unpatched Vulnerability : CVE-2026-101768

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Connectors product of Oracle MySQL component: Connector/J. The supported version that is affected is 26.7.0. Difficult to exploit...

Oracle Java SE Critical Certificate Trust (CVE-2026-91403 Security Alert)

The 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, or 27.0.1 versions of Java installed on the remote host are affected by a vulnerability as referenced in the CVE-2026-91403 Oracle Security Alert advisory. - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM...

Curl 8.2.0 < 8.23.0 HSTS Cache Erasure

The version of curl installed on the remote host is 8.2.0 prior to 8.23.0. It is, therefore, affected by a data loss vulnerability: - An authenticated HTTPS origin can supply an HSTS max-age value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme...

Linux Distros Unpatched Vulnerability : CVE-2026-114138

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Django REST framework is a toolkit for building Web APIs. Prior to 3.18.2, DefaultContentNegotiation.getacceptlist in restframework/negotiation.py accepts an...

Linux Distros Unpatched Vulnerability : CVE-2025-55654

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A use-after-free in the gffilterpidgetpacket function filtercore/filterpid.c of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service DoS via supplying...

Linux Distros Unpatched Vulnerability : CVE-2026-106587

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In sshd in OpenSSH before 10.6, the value none for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is...

Linux Distros Unpatched Vulnerability : CVE-2026-101771

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Client programs. Supported versions that are affected are MySQL Server:...

Linux Distros Unpatched Vulnerability : CVE-2026-98985

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - namespace: check the mounts before reading their parents in pivotroot pathpivotroot reads the parents of newroot and of the caller's root and checks whether the...

Linux Distros Unpatched Vulnerability : CVE-2026-101766

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Replication. Supported versions that are affected are MySQL Server:...

SUSE SLES15: apache2-mod_php8 / php8 / php8-bcmath / php8-bz2 / php8-calendar / etc (SUSE-SU-2026:4844-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4844-1 advisory. This update for php8 fixes the following issue: Update to php 8.3.36: - CVE-2026-109618,CVE-2026-109619: memory corruption leading ...

Debian dla-4854 : tzdata - security update

The remote Debian 12 host has a package installed that is affected by a vulnerability as referenced in the dla-4854 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4854-1 [email protected] https://www.debian.org/lts/security/...

Linux Distros Unpatched Vulnerability : CVE-2026-99041

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ip6gre: remove obsolete ERSPAN PMTU update A tc tunnelkey action can attach a METADATAIPTUNNEL dst to an skb, and mirred can redirect it to a native ip6erspan...

Linux Distros Unpatched Vulnerability : CVE-2026-113723

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, caller-supplied prompt text can become executable syntax in the bash...

Linux Distros Unpatched Vulnerability : CVE-2026-115391

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Wasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 contains an uncontrolled resource allocation vulnerability in its WASIp3 implementation that buffers...

Linux Distros Unpatched Vulnerability : CVE-2026-99085

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - schedext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF scheduler A CPU going down has to empty its own rq. Its hotplug thread waits in...

Linux Distros Unpatched Vulnerability : CVE-2026-113790

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF containing arrays or dictionaries with many elements,...

nginx 1.30.x < 1.30.6 / 1.31.2 < 1.31.7 Heap Buffer Overflow

According to its Server response header, the installed version of nginx is 1.30.0 prior to 1.30.6, or 1.31.2 prior to 1.31.7. It is, therefore, affected by the following issue: - A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root...

ServiceNow AI Platform Multiple Vulnerabilities (August 2026 CVE Advisory)

The version of the ServiceNow AI Platform Now Platform running on the remote host is missing the remediations described in the August 2026 CVE Advisory Notification. It is, therefore, affected by multiple vulnerabilities, including the following: - A sandbox escape vulnerability that could allow ...

Linux Distros Unpatched Vulnerability : CVE-2026-98883

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - serial: 8250port: recognize UPIOAU My MIPS Alchemy systems generate the following warning during probe of the 8250 driver: WARNING:...

SUSE SLES16: cyrus-sasl / cyrus-sasl-crammd5 / cyrus-sasl-devel / etc (SUSE-SU-2026:24266-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:24266-1 advisory. Security issue fixed: - CVE-2026-107161: Heap buffer overflow in cyrus-sasl addtochallenge allows malicious server to crash or compromise...

Linux Distros Unpatched Vulnerability : CVE-2026-106582

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 Crossing the Streams...

Linux Distros Unpatched Vulnerability : CVE-2026-113794

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pypdf is a free and open-source pure-python PDF library. Prior to 6.20.0, an attacker can craft an incomplete PDF that ends inside a standard cross-reference...

Atlassian Jira Service Management Data Center and Server 10.0.x < 10.3.25 / 10.4.x < 11.3.11 (JSDSERVER-16755)

The version of Atlassian Jira Service Management Data Center and Server Jira Service Desk running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-16755 advisory. - In Bouncy Castle for Java before 1.85, CMS AuthEnvelopedData fails to enforce tag-length on...

Debian dla-4852 : clamav - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4852 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4852-1 [email protected]...

Linux Distros Unpatched Vulnerability : CVE-2026-98984

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - dcache: don't put a mountpoint on a dentry that's being removed rmdir, unlink and rename call dontmount on the victim and then detachmounts with the victim's...

Linux Distros Unpatched Vulnerability : CVE-2026-99014

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: hcisync: Fix command skb lifetime during scan setup During PA sync scan setup, hcilesetextscanparamsync gets the address used for the PALINK lookup...