Apache OpenOffice < 4.1.17 Multiple Vulnerabilities

The version of Apache OpenOffice installed on the remote host is prior to 4.1.17. It is, therefore, affected by multiple vulnerabilities: - A code execution issue in the Java integration in Apache OpenOffice v4.1.16 and earlier allows a crafted untrusted document to trigger executing arbitrary ev...

Linux Distros Unpatched Vulnerability : CVE-2026-114613

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.3, the msgpack-python C extension msgpack.cmsgpack leaks a decoded map value...

MiracleLinux 8 : librsvg2-2.42.7-6.el8_10 (AXSA:2026-2133:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-2133:01 advisory. librsvg: Use-after-free when XML includes have duplicated entities CVE-2026-96889,RUSTSEC-2026-0305 Tenable has extracted the preceding description block...

Linux Distros Unpatched Vulnerability : CVE-2026-98978

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - namespace: never expire a locked mount Locked mounts are special. They protect the underlying files and directories from being revealed. doumount refuses to...

Linux Distros Unpatched Vulnerability : CVE-2026-98910

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amdkfd: Unwind debug trap enable on copytouser failure If kfddbgtrapenable fails while copying runtimeinfo to userspace, it had already activated the trap,...

Linux Distros Unpatched Vulnerability : CVE-2026-99056

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - strparser: make sure strprecv isn't running before tearing down the parser The comment above strpdone claims that if strp is stopped, strprecv will no longer be...

Slackware Linux 15.0 / current patch Vulnerability (SSA:2026-296-02)

The version of patch installed on the remote host is prior to 2.8.1. It is, therefore, affected by a vulnerability as referenced in the SSA:2026-296-02 advisory. New patch packages are available for Slackware 15.0 and -current to fix a security issue. Tenable has extracted the preceding descripti...

Tenable Security Center Multiple Vulnerabilities (TNS-2026-28)

According to its self-reported version, the Tenable Security Center running on the remote host is 6.9.1 or earlier and missing security patch SC-202610.1. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2026-28 advisory. - PHP uses longjmp for out-of-memory OOM...

Linux Distros Unpatched Vulnerability : CVE-2026-99052

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - selinux: preserve NATIVELABELS on already-initialized sb in setmntopts When an NFSv4 filesystem exported with securitylabel is mounted a second time, sgetfc...

Oracle Linux 10 : buildah (ELSA-2026-88262)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-88262 advisory. - Rebuild for CVE-2026-111943 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessu...

SUSE SLED15 / SLES15 Security Update : go1.26-openssl (SUSE-SU-2026:4866-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4866-1 advisory. Update to version 1.26.10 bsc1255111, jscSLE-18320: - CVE-2026-56857: os: Root.MkdirAll can follow junctions o...

RockyLinux 8 : grafana (RLSA-2026:88188)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:88188 advisory. net/http: golang: golang: Denial of Service via crafted HTTP Range headers CVE-2026-78667 crypto/tls: golang: crypto/tls: Denial of Service via multiple...

Linux Distros Unpatched Vulnerability : CVE-2026-99072

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipv4: stop route notification sizing when nexthop group shrinks Commit 680aea08e78c net: ipv4: Emit notification when fib hardware flags are changed added an...

SUSE SLES15 Security Update : go1.26-openssl (SUSE-SU-2026:4867-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4867-1 advisory. Update to version 1.26.10 bsc1255111, jscSLE-18320: - CVE-2026-56857: os: Root.MkdirAll can follow junctions out of the root on...

RockyLinux 10 : podman (RLSA-2026:88336)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:88336 advisory. net/http: golang: golang: Denial of Service via crafted HTTP Range headers CVE-2026-78667 net/http: net/http/internal/http2: golang.org/x/net/http2:...

Oracle E-Business Suite (October 2026 CPU)

The versions of Oracle E-Business Suite installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2026 CPU advisory. - Vulnerability in the Workflow product of Oracle E-Business Suite component: Workflow Notification Mailer. Supported versions that are...

Linux Distros Unpatched Vulnerability : CVE-2026-114583

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tarfile.tarfilter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside...

RHEL 9 : thunderbird (RHSA-2026:85241)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:85241 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Use-after-free in the Graphics: Canvas...

RHEL 8 : thunderbird (RHSA-2026:85243)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:85243 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Use-after-free in the Graphics: Canvas...

RockyLinux 10 : golang-github-openprinting-ipp-usb (RLSA-2026:88280)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:88280 advisory. net/http: golang: golang: Denial of Service via crafted HTTP Range headers CVE-2026-78667 crypto/tls: golang: crypto/tls: Denial of Service via multipl...

Oracle WebLogic Server (October 2026 CPU)

The 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 versions of WebLogic Server installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2026 CPU advisory. - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Cor...

Linux Distros Unpatched Vulnerability : CVE-2026-115352

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser that allows unauthenticated attackers to exhaust CPU by submitti...

Oracle WebCenter Sites (October 2026 CPU)

The 12.2.1.4.0 and 14.1.2.0.0 versions of WebCenter Sites installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2026 CPU advisory. - Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware component: WebCenter Sites Apache Log4j...

RockyLinux 10 : postgresql16-pgvector (RLSA-2026:88359)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:88359 advisory. pgvector: pgvector: Arbitrary code execution via out-of-bounds write during IVFFlat index build CVE-2026-103484 Tenable has extracted the preceding description...

Curl 7.81.0 < 8.23.0 SFTP/SCP Host Verification Bypass

The version of curl installed on the remote host is 7.81.0 prior to 8.23.0. It is, therefore, affected by a security bypass vulnerability: - A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a resul...

RockyLinux 9 : .NET 10.0 (RLSA-2026:86193)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:86193 advisory. dotnet: dotnet10.0: ASP.NET Core Remote Code Execution Vulnerability CVE-2026-102870 dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service...

Curl 7.75.0 < 8.22.0 SigV4 Header Leak

The version of curl installed on the remote host is 7.75.0 prior to 8.22.0. It is, therefore, affected by an information disclosure vulnerability: - Setting CURLOPTAWSSIGV4 to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the...

Rocky Linux 8.10 [CIQ] Security Update: bpftool / kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ciqsa-2026_1683)

The Rocky Linux 8.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261683 advisory. This advisory aggregates security fixes for the kernel SRPM in CIQ Core 8.10. It addresses 10 CVEs: CVE-2024-49978, CVE-2025-21927, CVE-2026-31677,...

Slackware Linux 15.0 / current brotli Vulnerability (SSA:2026-296-01)

The version of brotli installed on the remote host is prior to 1.2.1. It is, therefore, affected by a vulnerability as referenced in the SSA:2026-296-01 advisory. New brotli packages are available for Slackware 15.0 and -current to fix a security issue. Tenable has extracted the preceding...

AlmaLinux 9.6 [TuxCare] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1792762308)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792762308 advisory. - In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Synchronous access b/w reset and tm thread for...

AlmaLinux 8 : hplip (ALSA-2026:82295)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:82295 advisory. hplip: potential memory buffer overflow CVE-2020-6923 hplip: HP Linux Imaging and Printing Software - Use of DSA Key CVE-2025-43023 hplip: HPLIP: Multipl...

Linux Distros Unpatched Vulnerability : CVE-2026-105241

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Handling of Unicode Encoding vulnerability in the SmtpPickupDirAppender of Apache log4net. Content that the mail file writer cannot encode, such as an...

Linux Distros Unpatched Vulnerability : CVE-2026-85748

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - MariaDB server is a community developed fork of MySQL server. From 12.3.1 until 12.3.3 and 13.0.2, SYSREFCURSOR handling is affected because cursor-array...

Oracle Java SE Critical Certificate Trust (CVE-2026-91403 Security Alert)

The 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, or 27.0.1 versions of Java installed on the remote host are affected by a vulnerability as referenced in the CVE-2026-91403 Oracle Security Alert advisory. - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM...

Linux Distros Unpatched Vulnerability : CVE-2026-107170

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in m17n-lib. A partial failure during library initialization can leave an internal driver pointer uninitialized. Under specific error condition...

Linux Distros Unpatched Vulnerability : CVE-2026-113794

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pypdf is a free and open-source pure-python PDF library. Prior to 6.20.0, an attacker can craft an incomplete PDF that ends inside a standard cross-reference...

Linux Distros Unpatched Vulnerability : CVE-2026-99076

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipv6: udp: Create exceptions before socket matching Currently, when ICMPv6 Packet Too Big and Redirect Message packets are locally delivered and quote a UDP...

Linux Distros Unpatched Vulnerability : CVE-2026-99087

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - dm-integrity: fix NULL pointer dereference when the 'R' flag is used If the dm-integrity device has the SBFLAGDIRTYBITMAP flag set and the user activates the...

Linux Distros Unpatched Vulnerability : CVE-2026-99034

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mmc: sdhci-sprd: disable runtime PM on remove sdhcisprdprobe enables runtime PM, while sdhcisprdremove does not perform the corresponding runtime PM cleanup. Th...

Linux Distros Unpatched Vulnerability : CVE-2026-98903

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mailbox: imx: Add a channel shutdown field sashiko complained about possible teardown problem. The scenario CPU 0 CPU 1 imxmuisr imxmushutdown imxmuxcrrmwpriv,...

Linux Distros Unpatched Vulnerability : CVE-2026-101776

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Group Replication Plugin. Supported versions that are affected are...

Amazon Corretto Java 11.x < 11.0.33.0.9 Multiple Vulnerabilities

The version of Amazon Corretto installed on the remote host is 11 prior to 11.0.33.0.9. It is, therefore, affected by multiple vulnerabilities as referenced in the corretto-11-2026-Oct-20 advisory. - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition...

Linux Distros Unpatched Vulnerability : CVE-2026-101627

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: InnoDB. Supported versions that are affected are MySQL Server: 8.4.0-8.4.12,...

Linux Distros Unpatched Vulnerability : CVE-2026-106070

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw in the Node.js zlib.ZipFile API can cause it to return bytes that do not belong to the requested entry after the local and central header validation fail...

Palo Alto Networks PAN-OS 10.2.x / 11.1.x / 11.2.x / 12.1.x / 12.2.x Multiple Vulnerabilities

The version of Palo Alto Networks PAN-OS running on the remote host is a vulnerable version of 10.2.x, 11.1.x, 11.2.x, 12.1.x, or 12.2.x. It is, therefore, affected by multiple vulnerabilities. Palo Alto Networks is aware of two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619...

Linux Distros Unpatched Vulnerability : CVE-2026-114135

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Jupyter Server is the backend for Jupyter web applications. From 2.0.0 until 2.6.0, enabling GatewayClient.url replaced the normal KernelWebsocketHandler with...

RockyLinux 9 : qt5-qtbase (RLSA-2026:87082)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:87082 advisory. qtbase: qt5-qtbase: qt6-qtbase: qtbase: Denial of Service via uncontrolled recursion in XML serialization CVE-2026-11573 qt5-qtbase: qt6-qtbase: Qt:...

Linux Distros Unpatched Vulnerability : CVE-2026-114406

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The system certificate authority CA store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of...

Unity Linux 20.1020e / 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-142523)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142523 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntrackreasm: guard macheader adjustment after IPv6 defrag nfctfrag6reasm slides...

SUSE SLES12 Security Update : kernel (Live Patch 74 for SUSE Linux Enterprise 12 SP5) (SUSE-SU-2026:4793-1)

The remote SUSE Linux SLES12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4793-1 advisory. This update for the SUSE Linux Enterprise Kernel 4.12.14-122.280 fixes various security issues: The following security issues were fixed: -...