Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: thunderbird (UTSA-2026-101078)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101078 advisory. Incorrect boundary conditions in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-100152)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100152 advisory. In the Linux kernel, the following vulnerability has been resolved: crypto: marvell/cesa - Handle zero-length skcipher requests Do not access random memory for...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-100156)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100156 advisory. In the Linux kernel, the following vulnerability has been resolved: usb: usbtmc: Flush anchored URBs in usbtmcrelease When calling usbtmcrelease, pending anchored UR...

Fortinet FortiClient Heap overflow in kernel driver due to missing size validation (FG-IR-26-156)

The version of FortiClient installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-26-156 advisory. - A buffer copy without checking size of input 'classic buffer overflow' vulnerability in Fortinet FortiClientWindows 7.4.0...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100390)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100390 advisory. In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mvpp2main: fix possible OOB write in mvpp2ethtoolgetrxnfc rules is allocated in...

Unity Linux 20.1070e Security Update: ImageMagick (UTSA-2026-099485)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099485 advisory. ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, when identifying an image wi...

Fedora 44 : jfrog-cli (2026-9f70b173c8)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-9f70b173c8 advisory. Update to 2.119.0. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested...

Linux Distros Unpatched Vulnerability : CVE-2026-72887

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently downgrade OAuth 1.0a to OAuth 1.0 in getrequesttoken. Passing a callback...

Fedora 44 : rust-bat / rust-git-delta / rust-git-interactive-rebase-tool / etc (2026-74c4a6f82e)

The remote Fedora 44 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-74c4a6f82e advisory. Rebuild applications that use libgit2 via the Rust bindings git2 / libgit2-sys crates with the latest version of the libgit2-sys crate. This ensures...

Linux Distros Unpatched Vulnerability : CVE-2026-49263

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's WebAssembly backend accepts attacker-controlled raw WASM instruction bytes throug...

Fedora 44 : pdns-recursor (2026-707054d631)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-707054d631 advisory. Update to latest upstream version Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

Linux Distros Unpatched Vulnerability : CVE-2026-20731

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper buffer restrictions for the IntelR NPU Driver for all versions within Ring 3: User Applications may allow a denial of service. Unprivileged software...

Debian dla-4742 : libaprutil1 - security update

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4742 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4742-1 [email protected]...

Linux Distros Unpatched Vulnerability : CVE-2026-49282

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's public csinsnname API forwards caller-supplied instruction IDs directly to the...

Debian dla-4741 : unzip - security update

The remote Debian 11 / 12 host has a package installed that is affected by a vulnerability as referenced in the dla-4741 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4741-1 [email protected]...

Fedora 44 : jrnl (2026-1f4ad7617f)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-1f4ad7617f advisory. Update to version 4.6: fixes GHSA-rhx6-37mm-5q9r and other bugs. Tenable has extracted the preceding description block directly from the Fedora security...

Fedora 44 : libgsasl (2026-f2ced62115)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-f2ced62115 advisory. Fix for CVE-2026-48829 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for...

Linux Distros Unpatched Vulnerability : CVE-2026-20786

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Out-of-bounds read for the IntelR NPU Driver for all versions within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary wi...

Fedora 43 : libgsasl (2026-110274a705)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-110274a705 advisory. Fix for CVE-2026-48829 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for...

Linux Distros Unpatched Vulnerability : CVE-2026-20783

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper conditions check in the firmware for the IntelR NPU Driver for all versions within Ring 1: Device Drivers may allow a denial of service. Unprivileged...

Fedora 44 : stunnel (2026-67c2201ad8)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-67c2201ad8 advisory. Security bugfixes - CVE-2026-70368: Fixed an out-of-bounds memory access triggered by logging attacker-controlled protocol messages longer than 1,02...

Fedora 43 : jrnl (2026-d51fe2075c)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-d51fe2075c advisory. Update to version 4.6: fixes GHSA-rhx6-37mm-5q9r and other bugs. Tenable has extracted the preceding description block directly from the Fedora security...

Linux Distros Unpatched Vulnerability : CVE-2026-63650

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenVPN 2.7alpha1 through 2.7.5 using mbedTLS allows remote authenticated users to be misidentified by ignoring the configured X.509 username identity lookup...

Debian dsa-6444 : neutron-api - security update

The remote Debian 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6444 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6444-1 [email protected] https://www.debian.org/security/ Moritz...

Linux Distros Unpatched Vulnerability : CVE-2026-20769

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper conditions check for the IntelR NPU Driver for all versions within Ring 3: User Applications may allow a denial of service. Unprivileged software...

Fedora 43 : stunnel (2026-de8630b736)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-de8630b736 advisory. Security bugfixes - CVE-2026-70368: Fixed an out-of-bounds memory access triggered by logging attacker-controlled protocol messages longer than 1,02...

MiracleLinux 8 : glibc-2.28-251.el8_10.40 (AXSA:2026-1373:08)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1373:08 advisory. glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide character encodings CVE-2026-5928 glibc: glibc:...

Linux Distros Unpatched Vulnerability : CVE-2026-46603

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - VP8L decoding in golang.org/x/image/vp8l can allocate an excessive amount of memory when processing a crafted VP8L image containing many unused Huffman tree...

GLSA-202608-13 : NTFS-3G: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202608-13 NTFS-3G: Multiple Vulnerabilities Multiple vulnerabilities have been discovered in NTFS-3G. Please review the CVE identifiers referenced below for details. Tenable has extracted the preceding description block directly...

Linux Distros Unpatched Vulnerability : CVE-2026-72888

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Net::OAuth versions before 0.32 for Perl allow memory exhaustion via unbounded caching of failed module loads in smartrequire. smartrequire stores results in a...

Linux Distros Unpatched Vulnerability : CVE-2026-74576

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mm/slab: prevent unbounded recursion in free path with new kmalloc type Commit 280ea9c3154b mm/slab: avoid allocating slabobjext array from its own slab avoided...

Linux Distros Unpatched Vulnerability : CVE-2026-74477

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - uprobes: Fix NULL pointer dereference in hprobeexpire Forking a task that has a pending uretprobe can oops the kernel with a NULL pointer dereference in the clo...

Linux Distros Unpatched Vulnerability : CVE-2026-72168

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mtd: maps: vmu-flash: fix fault in unaligned fixup Use kzallocobj / kzallocobjs to allocate the memcard structs, instead of kmallocobj / kmallocobjs to prevent...

Linux Distros Unpatched Vulnerability : CVE-2026-72191

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ntfs3: validate split-point offset in indxinsertintobuffer indxinsertintobuffer computes used = used1 - tocopy - spsize; memmovedet, Add2Ptrsp, spsize, used -...

Linux Distros Unpatched Vulnerability : CVE-2026-74544

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/sched: clsu32: validate offshift to prevent shift-out-of-bounds u32change copies the user-provided tcu32sel.offshift unsigned char, 0-255 into the kernel...

Linux Distros Unpatched Vulnerability : CVE-2026-72416

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfilter: nftcompat: ebtables emulation must reject non-bridge targets xtables targets return netfilter verdicts: NFACCEPT, NFDROP, and so on. ebtables targets...

openSUSE 16: ffmpeg-7 / ffmpeg-7-libavcodec-devel / ffmpeg-7-libavdevice-devel / etc (openSUSE-SU-2026:21572-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21572-1 advisory. - CVE-2026-64830: Heap Buffer Overflow via VobSub Subtitle Demuxer bsc1272752. - CVE-2026-64832: Double-Free in NVDEC Hardware Decoder via nvdec...

Linux Distros Unpatched Vulnerability : CVE-2026-72243

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - selinux: check connect-related permissions on TCP Fast Open Similar to Landlock, SELinux was not updated when TCP Fast Open support was introduced to ensure...

Linux Distros Unpatched Vulnerability : CVE-2026-74345

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RDMA/siw: Fix endpoint/socket association handling Disassociating a socket from an endpoint via siwsocketdisassoc may release the last reference on that endpoin...

Linux Distros Unpatched Vulnerability : CVE-2026-74523

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - qede: sync udptunnel ports outside qedelock in the recovery path A TX timeout on a qede NIC that has VXLAN/GENEVE tunnel ports configured wedges the rtnetlink...

Linux Distros Unpatched Vulnerability : CVE-2026-72397

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - hwmon: pmbus/core honor vrmversion in pmbusdata2regvid pmbusdata2regvid hardcoded the VR11 encoding regardless of the vrmversion configured by the driver, while...

Linux Distros Unpatched Vulnerability : CVE-2026-74454

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size vc4overflowmemwork points BPOA at a 512KB slot inside the 16MB binner BO, but writes t...

Linux Distros Unpatched Vulnerability : CVE-2026-72166

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/9p: fix infinite loop in p9clientrpc on fatal signal When p9clientrpc is called with type P9TFLUSH and the transport has no peer e.g. fd transport backed b...

FreeBSD : OpenEXR -- 3.4.14 fixes multiple vulnerabilities (56449320-97c5-11f1-84d7-3c7c3fba4204)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 56449320-97c5-11f1-84d7-3c7c3fba4204 advisory. Cary Phillips reports: The OpenEXR 3.4.14 release addresses the following security...

Linux Distros Unpatched Vulnerability : CVE-2026-72045

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF rvumboxhandlerlmtsttblsetup uses req-basepcifunc as a direct index into the LMT map table to read...

Linux Distros Unpatched Vulnerability : CVE-2026-74563

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rds: tcp: hold the RCU lock across ipv6chkaddr in rdstcpladdrcheck rdstcpladdrcheck looks up a scoped IPv6 interface with devgetbyindexrcu, drops the RCU...

Linux Distros Unpatched Vulnerability : CVE-2026-74339

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: seq: Clear variable event pointer on read sndseqread copies a queued variable-length event header to userspace before expanding the payload. Queued...

Linux Distros Unpatched Vulnerability : CVE-2026-72392

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipv6: fib6: fix NULL deref in fib6walkcontinue on multi-batch dump inet6dumpfib saves its progress in cb-args1 as a positional index within the current hash...

Linux Distros Unpatched Vulnerability : CVE-2026-72015

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list A pseudo-locked group's RMID is freed when it is created. On unmount rmdirallsub...

Linux Distros Unpatched Vulnerability : CVE-2026-74318

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - btrfs: fix deadlock cloning inline extent when using flushoncommit In commit b48c980b6a7e btrfs: fix deadlock between reflink and transaction commit when using...