Linux Distros Unpatched Vulnerability : CVE-2026-109595

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Hugo from v0.84.0 before v0.167.0 contains a path traversal vulnerability that allows malicious themes or modules to read files outside the project root via...

Linux Distros Unpatched Vulnerability : CVE-2026-109678

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP 3.0.0-beta1 before 3.32.0, when built with verbose WinPR assertions and using smartcard emulation, has a reachable assertion: the emulated SCardStatusA...

RockyLinux 8 : bind9.16 (RLSA-2026:79113)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:79113 advisory. bind9: bind: BIND 9: Denial of Service via 16-bit length truncation in DNS negative cache handling CVE-2026-19667 bind: BIND: Denial of Service via...

Fedora 46 : rust-onefetch / rust-onefetch-ascii / rust-onefetch-image / etc (2026-85e3705d0b)

The remote Fedora 46 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-85e3705d0b advisory. https://github.com/o2sh/onefetch/releases/tag/3.0.0 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note th...

RHEL 9 : gvfs (RHSA-2026:85939)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:85939 advisory. GVFS is the GNOME Desktop Virtual File System layer that allows users to easily access local and remote data using File Transfer Protocol...

RHEL 9 : fetchmail (RHSA-2026:86981)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:86981 advisory. Fetchmail is a remote mail retrieval and forwarding utility intended for use over on-demand TCP/IP links, like SLIP or PPP connections. Fetchmail...

Amazon Linux 2023 : loupe (ALAS2023-2026-3216)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3216 advisory. Fix RUSTSEC-2026-0221: event-listener allows !Send tags to cross thread boundaries via StackSlot Fix RUSTSEC-2026-0186: Unchecked pointer offset in crate memmap2 Fix RUSTSEC-2026-0190: Unsoundness in...

Amazon Linux 2 : unbound (ALASUNBOUND-1.17-2026-012)

The version of unbound installed on the remote host is prior to 1.17.0-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2UNBOUND-1.17-2026-012 advisory. Amazon Linuxvended DNS resolvers shipped with an older DNSSEC root signing key. For hosts configured with DNSSEC...

RHEL 9 : sudo (RHSA-2026:86635)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:86635 advisory. The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged...

RockyLinux 10 : environment-modules (RLSA-2026:80664)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:80664 advisory. environment-modules: Command injection in environment-modules Bash completion via malicious module names containing shell metacharacters CVE-2026-85013 Tenable...

Unity Linux 20.1070a Security Update: python3.11 (UTSA-2026-141792)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-141792 advisory. An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters...

Linux Distros Unpatched Vulnerability : CVE-2026-109273

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an information disclosure vulnerability in the PostScript decoder, which allocates a buffer one by...

Linux Distros Unpatched Vulnerability : CVE-2026-109710

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: lrzsz (UTSA-2026-142360)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142360 advisory. lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying...

Linux Distros Unpatched Vulnerability : CVE-2026-109718

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free in the XML component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

RHEL 9 : kernel (RHSA-2026:86089)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:86089 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: ipv4: validate checksumstart before...

Debian dsa-6573 : firefox-esr - security update

The remote Debian 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6573 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6573-1 [email protected] https://www.debian.org/security/ Moritz...

Slackware Linux 15.0 / current python-certifi Vulnerability (SSA:2026-293-06)

The version of python-certifi installed on the remote host is prior to 2026.10.19. It is, therefore, affected by a vulnerability as referenced in the SSA:2026-293-06 advisory. New python-certifi packages are available for Slackware 15.0 and -current to fix a security issue. Tenable has extracted...

Linux Distros Unpatched Vulnerability : CVE-2026-109752

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free in the DOM: Workers component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

RHEL 8 : bind9.16 (RHSA-2026:79113)

"The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:79113 advisory. The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named...

SUSE SLES15 Security Update : fetchmail (SUSE-SU-2026:4605-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4605-1 advisory. This update for fetchmail fixes the following issue: - CVE-2026-94184: stack-based buffer overflow in NTLM authentication can lead to remote...

Atlassian Confluence 8.9.x < 9.2.24 / 9.3.x < 10.2.17 / 11.0.0 (CONFSERVER-104470)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-104470 advisory. - In Bouncy Castle for Java before 1.85, RSA PKCS1 verification skips last two hash bytes in NULL-omitted path. This issue also affects Bouncy Cast...

AlmaLinux 8 : gimp:2.8 (ALSA-2026:84744)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:84744 advisory. gimp: gimp: out-of-bounds write in lighting effects plugin via crafted preset file CVE-2026-90947 gimp: gimp: heap-based buffer overflow in ICO loader vi...

Unity Linux 20.1070a Security Update: libXfont2 (UTSA-2026-141782)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-141782 advisory. fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slic...

Linux Distros Unpatched Vulnerability : CVE-2026-109261

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the GIF encoder because allocated memory is not released when color quantization...

Linux Distros Unpatched Vulnerability : CVE-2026-112936

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - filelock is a platform-independent file lock for Python. From 3.20.4 until 4.0.9, ReadWriteLock and AsyncReadWriteLock versions from 3.20.4 resolve the lock pat...

Rocky Linux 9 [CIQ] Security Update: cockpit-files Multiple Vulnerabilities (crlsa-2026_84595)

The Rocky Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ crlsa-202684595 advisory. cockpit-files: cockpit-files: Arbitrary file ownership change via symlink following in privileged paste CVE-2026-91202 cockpit-files: cockpit-files: Local...

Linux Distros Unpatched Vulnerability : CVE-2026-109744

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Other issue in the DOM: File component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. CVE-2026-109744...

AlmaLinux 9.6 [TuxCare] Security Update: gstreamer1-plugins-good / gstreamer1-plugins-good-gtk / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1792572593)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792572593 advisory. - An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gstwavparseadtlchunk function. The patch added a size...

RHEL 8 : kernel (RHSA-2026:87086)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:87086 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: ipv4: validate checksumstart before...

Linux Distros Unpatched Vulnerability : CVE-2026-109723

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Integer overflow in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

Slackware Linux 15.0 / current mozilla-firefox Vulnerability (SSA:2026-293-03)

The version of mozilla-firefox installed on the remote host is prior to 140.17.0esr / 153.5.1esr. It is, therefore, affected by a vulnerability as referenced in the SSA:2026-293-03 advisory. New mozilla-firefox packages are available for Slackware 15.0 and -current to fix a security issue. Tenabl...

RHEL 9 : kpatch-patch-5_14_0-687_10_1 and kpatch-patch-5_14_0-687_42_1 (RHSA-2026:81452)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:81452 advisory. This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the code of a running kernel. This patc...

Linux Distros Unpatched Vulnerability : CVE-2026-113650

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ApostropheCMS is an open-source Node.js content management system. In sanitize-html 2.18.0, when an is not allowed and disallowedTagsMode is 'discard' the...

Linux Distros Unpatched Vulnerability : CVE-2026-109272

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick 7.1.1-31 before 7.1.2-32 contains a NULL pointer dereference in the PostScript decoder that is triggered when a policy limit is reached. Attackers c...

Linux Distros Unpatched Vulnerability : CVE-2026-56857

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction...

AlmaLinux 9.6 [TuxCare] Security Update: dovecot / dovecot-devel / dovecot-mysql / dovecot-pgsql / etc (ALMALINUX9.6:CLSA-2026:1792596933)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792596933 advisory. - An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing...

RockyLinux 8 : emacs (RLSA-2026:80506)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:80506 advisory. emacs: GNU Emacs: Heap over-read leading to information disclosure via crafted image CVE-2026-77219 emacs: local shell command injection through the use...

Linux Distros Unpatched Vulnerability : CVE-2026-98163

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: cgroup: Avoid iteration of dying tasks with zero refcount The commit 260fbcb92bbea cgroup:...

Unity Linux 20.1070a Security Update: python3.11 (UTSA-2026-141779)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-141779 advisory. An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers such as HTTP...

GitLab 18.2 < 19.3.6 / 19.4 < 19.4.3 / 19.5 < 19.5.1 (CVE-2026-12664)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an...

Linux Distros Unpatched Vulnerability : CVE-2026-94300

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Replaying GSS-TSIG signed UDP messages can result in memory corruption in named. An attacker who can capture a previously signed UDP message can replay it while...

RHEL 9 : glibc (RHSA-2026:79281)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:79281 advisory. The glibc packages provide the standard C libraries libc, POSIX thread libraries libpthread, standard math libraries libm, and the name...

SUSE SLES15: glibc / glibc-32bit / glibc-devel / glibc-devel-32bit / etc (SUSE-SU-2026:4591-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4591-1 advisory. - CVE-2026-6368: wordexp WRDEAPPEND rollback restores stale wewordv, leading to invalid free in wordfree bsc1274726. - CVE-2026-679...

Linux Distros Unpatched Vulnerability : CVE-2026-113055

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Type confusion in FullScreen in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a...

RHEL 8 : glibc (RHSA-2026:80798)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:80798 advisory. The glibc packages provide the standard C libraries libc, POSIX thread libraries libpthread, standard math libraries libm, and the name...

Fedora 43 : rust-backtrace / rust-object / rust-object0.37 / rust-object0.38 / etc (2026-9e7597548d)

The remote Fedora 43 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-9e7597548d advisory. - Update the object crate to version 0.40.0. - Add a compat package for version 0.39 of the object crate. - Update the ruzstd crate to version 0.9.1. This...

RockyLinux 9 : jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base (RLSA-2026:80504)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:80504 advisory. com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing...

MiracleLinux 9 : resteasy-3.0.26-20.el9_8.1 (AXSA:2026-2106:02)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2106:02 advisory. resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode Decompression-Bomb DoS CVE-2026-89059 resteasy-core: RESTEasy: CorsFilter Reflects...

Amazon Linux 2023 : glycin-loaders (ALAS2023-2026-3215)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3215 advisory. Fix RUSTSEC-2026-0221: event-listener allows !Send tags to cross thread boundaries via StackSlot Fix RUSTSEC-2026-0186: Unchecked pointer offset in crate memmap2 Tenable has extracted the preceding...