RHEL 9 : tomcat (RHSA-2026:36877)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:36877 advisory. Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages JSP technologies. Security Fixes: Apache Tomcat: Apache...

Fedora 44 : perl-CSS-Minifier-XS (2026-9f14575d85)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-9f14575d85 advisory. This package contains the Perl module CSS::Minifier::XS. Versions of the module before 0.14 have a memory leak when the entire document is minified away...

TencentOS Server 4: libsoup3 (TSSA-2026:0564)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0564 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

MiracleLinux 8 : php:7.4 (AXSA:2026-1217:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1217:01 advisory. php: php-soap: php-src: PHP SOAP extension: Remote Code Execution via use-after-free vulnerability CVE-2026-6722 PHP: PHP: Denial of Service via...

FreeBSD : libXfont2 -- Multiple vulnerabilities (9a1fdf39-7b10-11f1-a315-589cfc10a551)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 9a1fdf39-7b10-11f1-a315-589cfc10a551 advisory. X.Org project reports: Multiple issues have been found in the libXfont2 library published by...

TencentOS Server 4: haproxy (TSSA-2026:0548)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0548 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

AlmaLinux 10 : openexr (ALSA-2026:19146)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:19146 advisory. OpenEXR: OpenEXR: Arbitrary code execution and information disclosure via crafted EXR file CVE-2026-34588 Tenable has extracted the preceding description block...

Fedora 43 : opkssh (2026-387cf555e7)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-387cf555e7 advisory. Update to opkssh 0.15.0. This release fixes several CVEs in bundled/vendored dependencies: - CVE-2026-39829: golang.org/x/crypto/ssh: Denial of...

RHEL 9 : Red Hat Edge Manager Version 1.0.3 Security Update (Important) (RHSA-2026:36796)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:36796 advisory. Red Hat Edge Manager RHEM provides simple, scalable, and security-focused management of edge devices and applications. It supports image-mo...

RHEL 8 : rhc (RHSA-2026:36776)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:36776 advisory. rhc is a client tool and daemon that connects the system to Red Hat hosted services enabling system and subscription management. Security Fixes: net...

Oracle Linux 9 : skopeo (ELSA-2026-36317)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-36317 advisory. - Rebuild for golang = 1.26.4 to fix CVE-2026-27145 Tenable has extracted the preceding description block directly from the Oracle Linux security...

openSUSE 16: qemu / qemu-SLOF / qemu-accel-qtest / qemu-arm / qemu-audio-alsa / etc (openSUSE-SU-2026:21253-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21253-1 advisory. Update to version 10.0.11. Security issues fixed: - CVE-2026-3886: integer overflow leading to privilege escalation due to lack of proper...

Linux Distros Unpatched Vulnerability : CVE-2026-59929

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the safeurl filter in src/mistune/renderers/html.py blocks only javascript:,...

Linux Distros Unpatched Vulnerability : CVE-2026-56297

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.22.0 contains a use-after-free vulnerability in dvcmanchannelclose and dvcmancallonreceive due to improper synchronization of channelcallback...

openSUSE 16 Security Update : go1.26-openssl (openSUSE-SU-2026:21254-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21254-1 advisory. Update to go1.26.4 bsc1255111. Security issues fixed: - CVE-2026-27140: cmd/go: trust layer bypass when using cgo and SWIG bsc1261653. -...

AlmaLinux 9 : oci-seccomp-bpf-hook (ALSA-2026:36617)

The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:36617 advisory. net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME CVE-2026-33811 Tenable has extracted the preceding description block directl...

TencentOS Server 4: shim (TSSA-2026:0499)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0499 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

Linux Distros Unpatched Vulnerability : CVE-2026-59873

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce hard upper bounds on total decompressed data, entry count...

Debian dsa-6384 : chromium - security update

The remote Debian 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6384 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6384-1 [email protected] https://www.debian.org/security/ Andres...

Linux Distros Unpatched Vulnerability : CVE-2026-59874

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded...

RHEL 8 : libxml2 (RHSA-2026:36734)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:36734 advisory. The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fixes: libxml2: Stack Buffer Overflow i...

Oracle Linux 9 : libyang (ELSA-2026-25051)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-25051 advisory. 2.1.148-1.1 - Fix integer overflow and OOM in LYB parser string/value reading - Resolves: RHEL-177019 Tenable has extracted the preceding description block...

Linux Distros Unpatched Vulnerability : CVE-2026-15173

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pcapng file parser crash in Wireshark 4.6.0 to 4.6.6 allows denial of service CVE-2026-15173 Note that Nessus relies on the presence of the package as reported ...

Linux Distros Unpatched Vulnerability : CVE-2026-58388

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - gimp - None Ubuntu Linux - Unknown description CVE-2026-58388 Note that Nessus relies on the presence of the package as reported by the vendor...

Debian dsa-6385 : postgresql-17-pgextwlist - security update

The remote Debian 13 host has a package installed that is affected by a vulnerability as referenced in the dsa-6385 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6385-1 [email protected] https://www.debian.org/security/ Moritz...

Fedora 43 : python-jiter / rust-jiter (2026-f774d1a878)

The remote Fedora 43 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-f774d1a878 advisory. Update rust-jiter to 0.16.0, adding a serde Deserializer implementation; update python-jiter to match. Both packages now use PyO3 0.29, with fixes for...

AlmaLinux 8 : libsolv (ALSA-2026:36730)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:36730 advisory. libsolv: Heap buffer overflow in libsolv repopagestore via unchecked decompression of malicious .solv page data CVE-2026-48864 Tenable has extracted the preceding...

Debian dla-4674 : chromium - security update

The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dla-4674 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4674-1 [email protected] https://www.debian.org/lts/security/...

RHEL 9 : libreoffice (RHSA-2026:37250)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:37250 advisory. LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a...

Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : mailcap vulnerability (USN-8518-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-8518-1 advisory. Aaron Rainbolt discovered that the cautious-launcher utility in the mailcap package did not properly restrict the execution of...

AlmaLinux 8 : compat-openssl10 (ALSA-2026:36215)

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:36215 advisory. openssl: Heap Use-After-Free in OpenSSL PKCS7verify CVE-2026-45447 Tenable has extracted the preceding description block directly from the AlmaLinux security...

Photon OS 4.0: Rubygem PHSA-2026-4.0-1046

An update of the rubygem package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-4.0-1046. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Linux Distros Unpatched Vulnerability : CVE-2026-57825

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The OCaml Team reports: Installing files through .install files do not check symlinks resolution of the target path, and so can bypass sandboxing. Credits:...

GitLab 9.1 < 18.11.7 / 19.0 < 19.0.4 / 19.1 < 19.1.2 (CVE-2026-7492)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.1 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an...

Linux Distros Unpatched Vulnerability : CVE-2026-59930

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the toc plugin and TableOfContents directive generate heading IDs as predictable...

SUSE SLED15: xorg-x11-server / xorg-x11-server-Xvfb / xorg-x11-server-extra / etc (SUSE-SU-2026:2788-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2788-1 advisory. This update for xorg-x11-server fixes the following issues - CVE-2026-55999: missing bounds check in...

RHEL 10 : tomcat9 (RHSA-2026:36790)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:36790 advisory. Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages...

Oracle Linux 8 : libtasn1 (ELSA-2026-36728)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-36728 advisory. 4.13-6 - Backport the fix for CVE-2025-13151 RHEL-139546 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory...

MiracleLinux 8 : grafana-pcp-5.1.1-16.el8_10 (AXSA:2026-1229:09)

The remote MiracleLinux 8 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1229:09 advisory. golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVE-2026-39821 Tenable has extracted the...

GitLab 18.2 < 18.11.7 / 19.0 < 19.0.4 / 19.1 < 19.1.2 (CVE-2026-6352)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab EE affecting all versions from 18.2 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticate...

Linux Distros Unpatched Vulnerability : CVE-2026-58203

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pydantic-settings provides settings management using Pydantic. From 2.12.0 until 2.14.2, NestedSecretsSettingsSource reads secret values from files in a...

Oracle Linux 8 : perl-HTTP-Daemon (ELSA-2026-36188)

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-36188 advisory. - Fix CVE-2026-8450: sendfile shell-magic injection via 2-arg open Tenable has extracted the preceding description block directly from the Oracle Linux securit...

RHEL 10 : gstreamer1-plugins-good (RHSA-2026:36675)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:36675 advisory. GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a...

Linux Distros Unpatched Vulnerability : CVE-2026-59868

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.0, when merge keys are enabled, js- yaml can spend quadratic CPU time parsing a document...

Photon OS 4.0: Rubygem PHSA-2026-4.0-1052

An update of the rubygem package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-4.0-1052. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Linux Distros Unpatched Vulnerability : CVE-2026-15171

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SSH protocol dissector crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service CVE-2026-15171 Note that Nessus relies on the presence of...

FreeBSD : Gitlab -- Vulnerabilities (84ce0c0c-7b4e-11f1-9c40-2cf05da270f3)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 84ce0c0c-7b4e-11f1-9c40-2cf05da270f3 advisory. Gitlab reports: Cross-site Scripting issue in vulnerability evidence table renderer impacts...

Alibaba Cloud Linux 3 : 0191: mysql:8.0 (ALINUX3-SA-2026:0191)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2026:0191 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-21998: Vulnerability in the MySQL...

TencentOS Server 4: evince (TSSA-2026:0539)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0539 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

MiracleLinux 9 : glib2-2.68.4-19.el9_8.1 (AXSA:2026-1221:09)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1221:09 advisory. glib: GLib: Buffer underflow in GVariant parser leads to heap corruption CVE-2025-14087 glib: Integer Overflow in GLib GIO Attribute Escaping Causes...