Linux Distros Unpatched Vulnerability : CVE-2026-101747

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: InnoDB. Supported versions that are affected are MySQL Server: 8.4.0-8.4.12,...

Amazon Corretto Java 11.x < 11.0.33.0.9 Multiple Vulnerabilities

The version of Amazon Corretto installed on the remote host is 11 prior to 11.0.33.0.9. It is, therefore, affected by multiple vulnerabilities as referenced in the corretto-11-2026-Oct-20 advisory. - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition...

Linux Distros Unpatched Vulnerability : CVE-2026-98996

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fs: don't silently unmount busy mounts The propagatemountbusy helper exists to decide whether a synchronous can suceed. It does that by looking at the copies of...

MiracleLinux 9 : php:8.2 (AXSA:2026-2126:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2126:01 advisory. php: OOM bailout during request parsing leads to memory corruption and RCE CVE-2026-109618 php: fatal error handling retains stale request state...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 : Tornado vulnerabilities (USN-8952-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8952-1 advisory. It was discovered that Tornado did not properly handle certain HTTP requests and...

Linux Distros Unpatched Vulnerability : CVE-2026-113718

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, POSIX xonsh activation quote uses repr to write printable non-ASCII...

MiracleLinux 9 : openssl-3.5.8-2.el9_8.ML.1 (AXSA:2026-2062:18)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-2062:18 advisory. openssl: compat-openssl: DTLS Retransmits Handshake Messages From a Stale Buffer Offset CVE-2026-84782 Tenable has extracted the preceding description block...

Linux Distros Unpatched Vulnerability : CVE-2026-99076

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipv6: udp: Create exceptions before socket matching Currently, when ICMPv6 Packet Too Big and Redirect Message packets are locally delivered and quote a UDP...

Linux Distros Unpatched Vulnerability : CVE-2026-99039

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - memstick: core: wait for request completion before freeing card In memstickalloccard and memsticksetrwaddr, waitforcompletiontimeout is used to wait for device...

Oracle Linux 9 : expat (ELSA-2026-88247)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-88247 advisory. - CVE-2026-102633 expat: expat: Denial of Service via integer overflow in expatrealloc - CVE-2026-77214 expat: expat: Information disclosure via heap...

Linux Distros Unpatched Vulnerability : CVE-2026-101609

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: InnoDB. Supported versions that are affected are MySQL Server: 8.4.0-8.4.12,...

RHEL 9 : php:8.2 (RHSA-2026:88834)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:88834 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: OOM bailout during request parsi...

Ubuntu 24.04 LTS / 26.04 LTS / 26.10 : zlib vulnerability (USN-8954-1)

The remote Ubuntu 24.04 LTS / 26.04 LTS / 26.10 host has packages installed that are affected by a vulnerability as referenced in the USN-8954-1 advisory. Ali Firas discovered that zlib incorrectly handled certain non-blocking write operations. An attacker could possibly use this issue to trigger...

RockyLinux 10 : iperf3 (RLSA-2026:88207)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:88207 advisory. iperf3: iperf3: Denial of Service via UDP receive worker infinite loop CVE-2026-102253 Tenable has extracted the preceding description block directly from the...

Linux Distros Unpatched Vulnerability : CVE-2026-98940

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ASoC: qcom: lpass-cpu: use DAI table index for playback constraints The DAI ID is a hardware port ID and is not necessarily the index of the corresponding entry...

SUSE SLES15: apache2-mod_php8 / php8 / php8-bcmath / php8-bz2 / php8-calendar / etc (SUSE-SU-2026:4843-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4843-1 advisory. This update for php8 fixes the following issue: - CVE-2026-109618,CVE-2026-109619: memory corruption leading to RCE bsc1286027...

Linux Distros Unpatched Vulnerability : CVE-2026-113602

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - json-smart through 2.6.0 contains an input validation bypass vulnerability that allows attackers to evade strict-mode trailing-data checks by inserting a litera...

Linux Distros Unpatched Vulnerability : CVE-2026-99027

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: team: stop reusing skb after queue override A nonzero devqueuexmit result does not return ownership of the skb. When an override port's qdisc drops it, the...

Linux Distros Unpatched Vulnerability : CVE-2026-90800

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read the full contents of a prefixed user or...

Linux Distros Unpatched Vulnerability : CVE-2026-101612

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: InnoDB. Supported versions that are affected are MySQL Server: 8.4.0-8.4.12,...

Linux Distros Unpatched Vulnerability : CVE-2026-98878

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - irqchip/gic-v5: Immediately exec priority drop following activate With GICv5 an interrupt of equal or lower priority cannot be signalled until there has been a...

Linux Distros Unpatched Vulnerability : CVE-2025-60478

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A use-after-free in the gffilterpacketdestroy function /filtercore/filterpck.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service D...

Linux Distros Unpatched Vulnerability : CVE-2026-115349

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parselinktext function in src/mistune/helpers.py...

Linux Distros Unpatched Vulnerability : CVE-2026-90458

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenStack Ironic before 39.0.1 allows DELETE and GET via vendorpassthru, e.g., to delete accounts from the BMC's Redfish service. CVE-2026-90458 Note that Nessu...

RHEL 8 : ca-certificates (RHSA-2026:88668)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:88668 advisory. The ca-certificates package contains a set of Certificate Authority CA certificates chosen by the Mozilla Foundation for use with the Internet Publi...

Linux Distros Unpatched Vulnerability : CVE-2026-113721

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, ViaTemplateActivator.generate removes an existing output only when...

Linux Distros Unpatched Vulnerability : CVE-2025-71438

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An out-of-bounds read in gfodfac4cfgdsiv1 /odf/descriptors.c in GPAC Project/MP4Box before v26.07.0 allows attackers to cause a Denial of Service DoS via...

Fedora 44 : knot-resolver (2026-97432ec1d3)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-97432ec1d3 advisory. New upstream release. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for...

AlmaLinux 9.6 [TuxCare] Security Update: httpd / httpd-core / httpd-devel / httpd-filesystem / httpd-manual / etc (ALMALINUX9.6:CLSA-2026:1792765962)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792765962 advisory. - Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's modsessioncookie module. When...

Linux Distros Unpatched Vulnerability : CVE-2026-105242

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Handling of Exceptional Conditions vulnerability in the aspnet-request pattern converter of Apache log4net. Reading request parameters triggers ASP.NET...

nginx 1.25.0 < 1.30.6 / 1.31.x < 1.31.7 Request Body Injection

According to its Server response header, the installed version of nginx is 1.25.0 prior to 1.30.6 or 1.31.0 prior to 1.31.7. It is, therefore, affected by the following issue: - NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpv3module module. When using HTTP/3 with...

Cisco IOS XR Software for ASR 9000 Series Routers IPv4 Unicast Packets DoS (cisco-sa-asr9k-tUyxcyXN)

According to its self-reported version, Cisco IOS XR is affected by a vulnerability. - A vulnerability in the IPv4 packet processing functionality of Cisco IOS XR Software that affects Cisco ASR 9000 and 9900 Series Aggregation Services Routers as well as Cisco ASR 9902 and 9903 Compact...

Linux Distros Unpatched Vulnerability : CVE-2026-99054

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tipc: destroy topsrv workqueues before closing connections tipctopsrvstop closed subscriber connections while the topology server's send and receive workqueues...

Linux Distros Unpatched Vulnerability : CVE-2026-83404

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Connectors product of Oracle MySQL component: Connector/Python. The supported version that is affected is 26.7.0. Easily exploitable...

Linux Distros Unpatched Vulnerability : CVE-2026-98967

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - cxgb4/chktls: disable softirqs around tidlist erases chcrktlscplactopenrpl inserts into tidlist from the receive path using xainsertbh. The array is shared by t...

MiracleLinux 9 : php-8.0.30-8.el9_8.ML.1 (AXSA:2026-2115:04)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2115:04 advisory. php: OOM bailout during request parsing leads to memory corruption and RCE CVE-2026-109618 php: fatal error handling retains stale request state...

Linux Distros Unpatched Vulnerability : CVE-2025-60476

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A heap use-after-free in the gfodfac4cfgcleanlist function /odf/descriptors.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service Do...

Fedora 44 : socat (2026-4172dae890)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-4172dae890 advisory. - Update to 1.8.1.3 rhbz2492929 - Fix for CVE-2026-56123 rhbz2535043 Tenable has extracted the preceding description block directly from the Fedora security...

Linux Distros Unpatched Vulnerability : CVE-2026-99007

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/fb-helper: defer setup when fbdevprobe fails, not just on -EAGAIN drmfbhelperinitialconfigandunlock calls drmclientmodesetprobe first, which already fills i...

Curl 7.30.0 < 8.22.0 IMAP Command Injection

The version of curl installed on the remote host is 7.30.0 prior to 8.22.0. It is, therefore, affected by a command injection vulnerability: - Enabling CURLOPTCRLF causes curl to advertise the raw input byte count in the IMAP APPEND N literal while transmitting line-ending expanded data. The serv...

Linux Distros Unpatched Vulnerability : CVE-2026-98971

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gpio: exar: initialize the ID before registering its cleanup devmaddactionorreset invokes the cleanup action immediately when registering the action fails...

Linux Distros Unpatched Vulnerability : CVE-2026-98947

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - vsock: Fix memory leak in vmcitransportrecvdgramcb During the closure of a datagram socket, the vmcitransportrecvdgramcb function may be called, which will add...

openSUSE 16 Security Update : guava (openSUSE-SU-2026:22143-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:22143-1 advisory. This update for guava fixes the following issue: - CVE-2026-102554: Allocation of resources without limits or throttling CWE-770 during Java object...

Linux Distros Unpatched Vulnerability : CVE-2026-106583

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection. CVE-2026-106583 Note that Nessus relies on the...

Linux Distros Unpatched Vulnerability : CVE-2026-114097

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dulwich from 0.23.1 before 1.2.8 contains a path traversal vulnerability in CommitFilter.applyindexfilter that allows attackers to write files outside the worki...

Linux Distros Unpatched Vulnerability : CVE-2026-107755

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Insufficient filtering of credentials in the replicator database in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to read...

RHEL 7 : ca-certificates (RHSA-2026:88779)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:88779 advisory. The ca-certificates package contains a set of Certificate Authority CA certificates chosen by the Mozilla Foundation for use with the Internet Publi...

Linux Distros Unpatched Vulnerability : CVE-2026-99032

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/smc: protect clcsock lifetime in smcgetname smcgetname dereferences smc-clcsock without holding clcsockreleaselock. Link-group termination can release the C...

Linux Distros Unpatched Vulnerability : CVE-2026-114460

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in modqos. An off-by-one pointer calculation error occurs when merging request body parameters with an existing URL query, which truncates the...

Slackware Linux 15.0 / current python-certifi Vulnerability (SSA:2026-296-03)

The version of python-certifi installed on the remote host is prior to 2026.10.23. It is, therefore, affected by a vulnerability as referenced in the SSA:2026-296-03 advisory. New python-certifi packages are available for Slackware 15.0 and -current to fix a security issue. Tenable has extracted...