Linux Distros Unpatched Vulnerability : CVE-2026-98930

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: s390: Fix IRQ injection with SIGP Stop and Store Status When injectsigpstop is called for a Stop and Store Status operation, if the vCPU is running, the...

RHEL 8 : ca-certificates (RHSA-2026:88669)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:88669 advisory. The ca-certificates package contains a set of Certificate Authority CA certificates chosen by the Mozilla Foundation for use with the Internet Publi...

Linux Distros Unpatched Vulnerability : CVE-2026-99059

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wireguard: noise: reject response consumption after intermediate initiation Two threads begin processing the identical response message, received twice. The fir...

Linux Distros Unpatched Vulnerability : CVE-2026-98926

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amd/display: Remove sink usage from DPMS Why stream-sink is optional and can be null, so should always be checked before dereference. Additionally, most of...

Dell Wyse Management Suite < 2609.0.0.155 Multiple Vulnerabilities (DSA-2026-405)

The version of Dell Wyse Management Suite installed on the remote host is prior to 2609.0.0.155. It is, therefore, affected by multiple vulnerabilities, including: - Dell Wyse Management Suite WMS, versions prior to WMS 2609.0.0.155, contain an Improper Neutralization of Input During Web Page...

Linux Distros Unpatched Vulnerability : CVE-2026-101731

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are MySQL Server:...

RockyLinux 8 : openssh (RLSA-2026:88211)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:88211 advisory. openssh: OpenSSH: SFTP security bypass due to command-line argument parsing flaw CVE-2026-59997 openssh: OpenSSH: Undocumented GSSAPIStrictAcceptorCheck...

Fedora 46 : mupdf (2026-70d51c6891)

The remote Fedora 46 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-70d51c6891 advisory. Automatic update for mupdf-1.28.2-4.fc46. Changelog Fri Oct 23 2026 Michael J Gruber - 1.28.2-4 - fix CVE-2026-112036 rhbz2558213 Tenable has extracted the...

Alibaba Cloud Linux 3 : 0319: cloud-kernel bugfix, enhancement and (ALINUX3-SA-2026:0319)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2026:0319 advisory. Package updates are available for Alibaba Cloud Linux 3 Pro that fix the following vulnerabilities: CVE-2026-99999: In the Linux kernel, the...

Oracle Linux 9 : libcap (ELSA-2026-12441)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-12441 advisory. 2.48-10.1 - Fix TOCTOU race condition in capsetfile CVE-2026-4878 Resolves: RHEL-169311 Tenable has extracted the preceding description block directly from the...

AlmaLinux 9.6 [TuxCare] Security Update: flatpak-builder (ALMALINUX9.6:CLSA-2026:1792771054)

The AlmaLinux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792771054 advisory. - A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use- git-am: true. An attacker who ca...

Linux Distros Unpatched Vulnerability : CVE-2026-99010

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: RFCOMM: free the skb when the DLC has no owner rfcommrecvdata hands the skb to d-dataready and returns 0 without freeing it, so the callback owns th...

Dell SupportAssist OS Recovery < 5.5.16.3 Multiple Vulnerabilities (DSA-2026-426)

Dell SupportAssist OS Recovery is installed on the remote Windows host. It is, therefore, affected by multiple vulnerabilities as referenced in the DSA-2026-426 advisory. - Insufficient Verification of Data Authenticity. An unauthenticated attacker with adjacent network access could bypass manife...

Linux Distros Unpatched Vulnerability : CVE-2026-101625

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Connectors product of Oracle MySQL component: Connector/Net. The supported version that is affected is 26.7.0. Easily exploitable...

Linux Distros Unpatched Vulnerability : CVE-2026-93518

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An integer truncation issue in XkbResizeKeyType that could lead to a heap buffer overflow by authenticated X clients in X.org X server before 21.1.25 and XWayla...

Linux Distros Unpatched Vulnerability : CVE-2026-75507

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.0.0 until 3.2.12 and 3.3.0rc1, the OverlappingFieldsCanBeMerged rule in...

Linux Distros Unpatched Vulnerability : CVE-2026-98983

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - unshare: don't drop active namespace references that were never taken Active references on the namespaces of an nsproxy are taken when the nsproxy is installed...

Rocky Linux 9.6 [TuxCare] Security Update: ruby / ruby-default-gems / ruby-devel / ruby-doc / ruby-libs / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1792801476)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792801476 advisory. - An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before...

Security Updates for Microsoft Dynamics NAV 2018 (Oct 2026)

The Microsoft Dynamics NAV 2018 install is missing a security update. It is, therefore, affected by multiple vulnerabilities: - Deserialization of untrusted data allows an authorized attacker to execute code over a network. CVE-2026-100214 - Improper limitation of a pathname to a restricted...

Linux Distros Unpatched Vulnerability : CVE-2026-106586

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In sshd in OpenSSH before 10.6, the restrict keyword in authorizedkeys was supposed to be applicable to tunnel forwarding but was not, a different vulnerability...

SUSE SLES15: WebKitGTK-4.0-lang / WebKitGTK-4.1-lang / WebKitGTK-6.0-lang / etc (SUSE-SU-2026:4868-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4868-1 advisory. Security issues fixed: - CVE-2026-64718: webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari cra...

Oracle VM VirtualBox 7.2.22 (October 2026 CPU)

The 7.2.20 versions of VM VirtualBox installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2026 CPU advisory. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.20...

Fedora 45 : php (2026-a9354b8a1e)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a9354b8a1e advisory. Security update: - RCE via OOM corruption, CVE-2026-109618 - RCE via stale global state, CVE-2026-109619 Tenable has extracted the preceding...

Linux Distros Unpatched Vulnerability : CVE-2026-113352

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - uTox through 0.18.1 contains a path traversal vulnerability that allows Tox friends to write arbitrary files by sending absolute or ../ file names to victims wi...

Linux Distros Unpatched Vulnerability : CVE-2026-115353

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mistune before 3.3.0 contains a path traversal vulnerability in the RST include directive that allows attackers to read arbitrary files by supplying relative or...

Linux Distros Unpatched Vulnerability : CVE-2026-106444

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.precompile uses quotedString in...

Linux Distros Unpatched Vulnerability : CVE-2026-99031

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: bridge: avoid recursive multicast port cleanup brmulticastsgdelexcludeports removes automatically added STAREXCL port groups by calling brmulticastdelpg. F...

Linux Distros Unpatched Vulnerability : CVE-2026-98959

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - btrfs: fix xattr replace when multiple xattrs are packed in the same item If we have a btrfsdiritem item that packs multiple xattrs and then we replace the valu...

AlmaLinux 8 : ALSA-2026:A012php:7.3 (ALSA-2026:A012)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:A012 advisory. php: OOM bailout during request parsing leads to memory corruption and RCE CVE-2026-109618 php: fatal error handling retains stale request state leading t...

Linux Distros Unpatched Vulnerability : CVE-2026-113776

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - virtualenv is a tool for creating isolated virtual python environments. From 20.26.6 until 21.14.2, ViaTemplateActivator.instantiatetemplate replaces placeholde...

Linux Distros Unpatched Vulnerability : CVE-2026-115386

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains an information disclosure vulnerability in the WASIp1 fdreaddir implementation...

SUSE SLES16: MozillaFirefox / MozillaFirefox-devel / etc (SUSE-SU-2026:24260-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:24260-1 advisory. Firefox Extended Support Release 153.5.0 ESR MFSA 2026-108, bsc1284493: - CVE-2026-109704: Privilege escalation in the Application...

Linux Distros Unpatched Vulnerability : CVE-2026-99087

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - dm-integrity: fix NULL pointer dereference when the 'R' flag is used If the dm-integrity device has the SBFLAGDIRTYBITMAP flag set and the user activates the...

Oracle VM VirtualBox 7.2.18 (October 2026 CPU)

The 7.2.16 versions of VM VirtualBox installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2026 CPU advisory. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.16...

Linux Distros Unpatched Vulnerability : CVE-2026-101721

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Components Services. Supported versions that are affected are MySQL...

Linux Distros Unpatched Vulnerability : CVE-2026-101678

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Connectors product of Oracle MySQL component: Connector/J. The supported version that is affected is 26.7.0. Easily exploitable...

Linux Distros Unpatched Vulnerability : CVE-2026-98980

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - namei: don't reveal overmounted entries in refwalk In rcuwalk the dentry is validated before it is accepted. stepinto stepinto rechecks dseq and followmountrcu...

SUSE SLES15 Security Update : buildah (SUSE-SU-2026:4837-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4837-1 advisory. This update for buildah rebuilds it against the current go security release. Tenable has extracted the preceding description block directly...

Linux Distros Unpatched Vulnerability : CVE-2026-99002

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/vmwgfx: validate pitch coming from userspace Validate the pitch, alongside the box dimensions before trying to copy data from the underlying surface. Fixes...

Linux Distros Unpatched Vulnerability : CVE-2026-114109

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via crafted consolescripts o...

Linux Distros Unpatched Vulnerability : CVE-2026-106070

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw in the Node.js zlib.ZipFile API can cause it to return bytes that do not belong to the requested entry after the local and central header validation fail...

Linux Distros Unpatched Vulnerability : CVE-2026-98974

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xfs: fix exchange-range-to-eof file size exchange Norbert Szetei posted a patch containing an incomplete description of a bug in XFSIOCEXCHANGERANGE's TOEOF fla...

Linux Distros Unpatched Vulnerability : CVE-2026-86471

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server admin to run arbitrary shell commands as t...

Linux Distros Unpatched Vulnerability : CVE-2026-75508

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.2.3 until 3.2.12 and 3.3.0rc1, the parser's maxtokens limit in...

Linux Distros Unpatched Vulnerability : CVE-2026-93517

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A heap buffer overflow in handling GLX RenderLarge request where dataBytes exceeds cmdlen in X.org X server before 21.1.25 and XWayland before 24.1.14 that coul...

Linux Distros Unpatched Vulnerability : CVE-2026-106552

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In sftp in OpenSSH before 10.6, a server can trigger directory traversal causing files to be written to unintended locations during a recursive copy operation...

Linux Distros Unpatched Vulnerability : CVE-2026-115449

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in libslirp. When handling ICMP echo requests, the reply length is not updated to match the actual data received from the host. Under specific...

Linux Distros Unpatched Vulnerability : CVE-2026-115350

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mistune before 3.3.0 contains a cross-site scripting vulnerability in the Include directive that emits included .html, .xhtml, or .htm file content as raw...

Palo Alto Networks PAN-OS 10.2.x / 11.1.x / 11.2.x / 12.1.x / 12.2.x Multiple Vulnerabilities

The version of Palo Alto Networks PAN-OS running on the remote host is a vulnerable version of 10.2.x, 11.1.x, 11.2.x, 12.1.x, or 12.2.x. It is, therefore, affected by multiple vulnerabilities. Palo Alto Networks is aware of two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619...

AlmaLinux 10 : ca-certificates (ALSA-2026:88455)

The remote AlmaLinux 10 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:88455 advisory. ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns CVE-2026-114406 Tenable has extracted the preceding description block...