AlmaLinux 9 : perl-HTTP-Daemon (ALSA-2026:36187)

The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:36187 advisory. perl-HTTP-Daemon: HTTP::Daemon: Arbitrary code execution via OS command injection in sendfile CVE-2026-8450 Tenable has extracted the preceding description block...

TencentOS Server 4: grafana (TSSA-2026:0525)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0525 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

AlmaLinux 9 : grafana (ALSA-2026:35828)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:35828 advisory. golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVE-2026-39821 Tenable has extracted the...

Photon OS 5.0: Rubygem PHSA-2026-5.0-0917

An update of the rubygem package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-0917. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

SUSE SLES15 Security Update : dracut (SUSE-SU-2026:2803-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:2803-1 advisory. This update for dracut fixes the following issue - CVE-2026-6893: Root code execution via DHCP options command injection bsc1268322. Changes...

Linux Distros Unpatched Vulnerability : CVE-2026-59873

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce hard upper bounds on total decompressed data, entry count...

openSUSE 16 Security Update : jq (openSUSE-SU-2026:21248-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21248-1 advisory. - CVE-2025-48060: improper handling of string data in jvstringempty can lead to heap buffer overflow and a crash when processing crafted input...

Oracle Linux 9 : skopeo (ELSA-2026-36317)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-36317 advisory. - Rebuild for golang = 1.26.4 to fix CVE-2026-27145 Tenable has extracted the preceding description block directly from the Oracle Linux security...

FreeBSD : mailpit -- multiple vulnerabilities (7a56b0f7-7b62-11f1-8a70-10ffe07f9334)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 7a56b0f7-7b62-11f1-8a70-10ffe07f9334 advisory. Mailpit author reports: Mailpit's SMTP server reads each command line with an unbounded...

AlmaLinux 10 : python3.14-pip (ALSA-2026:36193)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:36193 advisory. python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite CVE-2026-8643 Tenable has extracted the...

openSUSE 16 Security Update : go1.26-openssl (openSUSE-SU-2026:21254-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21254-1 advisory. Update to go1.26.4 bsc1255111. Security issues fixed: - CVE-2026-27140: cmd/go: trust layer bypass when using cgo and SWIG bsc1261653. -...

openSUSE 16: qemu / qemu-SLOF / qemu-accel-qtest / qemu-arm / qemu-audio-alsa / etc (openSUSE-SU-2026:21253-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21253-1 advisory. Update to version 10.0.11. Security issues fixed: - CVE-2026-3886: integer overflow leading to privilege escalation due to lack of proper...

Fedora 44 : python-nh3 (2026-5ebb12f543)

"The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-5ebb12f543 advisory. Update to 0.3.6 Tenable, Inc. The descriptive text and package checks in this plugin were extracted from Fedora Security Advisory FEDORA-2026-5ebb12f543...

Debian dsa-6384 : chromium - security update

The remote Debian 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6384 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6384-1 [email protected] https://www.debian.org/security/ Andres...

TencentOS Server 4: shim (TSSA-2026:0499)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0499 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

AlmaLinux 10 : openexr (ALSA-2026:19146)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:19146 advisory. OpenEXR: OpenEXR: Arbitrary code execution and information disclosure via crafted EXR file CVE-2026-34588 Tenable has extracted the preceding description block...

Linux Distros Unpatched Vulnerability : CVE-2026-56297

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.22.0 contains a use-after-free vulnerability in dvcmanchannelclose and dvcmancallonreceive due to improper synchronization of channelcallback...

Linux Distros Unpatched Vulnerability : CVE-2026-13151

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitLab has remediated an issue in GitLab EE affecting all versions from 16.10 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain...

Linux Distros Unpatched Vulnerability : CVE-2026-54499

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. Prior to 1.12.2, Stanza model loaders...

RHCOS 4 : OpenShift Container Platform 4.19.37 (RHSA-2026:34755)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:34755 advisory. - Kubelet: CRI-O: kube-apiserver: Kubelet, CRI-O, kube-apiserver: Denial of Service via SPDY streaming code CVE-2026-35469 Note that Nessus...

RHEL 8 : libreoffice (RHSA-2026:37249)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:37249 advisory. LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a...

Slackware Linux 15.0 / current libXfont2 Multiple Vulnerabilities (SSA:2026-189-01)

The version of libXfont2 installed on the remote host is prior to 2.0.8. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2026-189-01 advisory. New libXfont2 packages are available for Slackware 15.0 and -current to fix security issues. Tenable has extracted the...

Linux Distros Unpatched Vulnerability : CVE-2026-59938

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pypdf is a free and open-source pure-python PDF library. Prior to 6.14.0, an attacker can craft a PDF with declared image size values that are much too large...

GitLab 9.5 < 18.11.7 / 19.0 < 19.0.4 / 19.1 < 19.1.2 (CVE-2026-11827)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab EE affecting all versions from 9.5 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated...

Linux Distros Unpatched Vulnerability : CVE-2026-14650

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw has been found in connorskees grass up to 0.13.4. The affected element is the function grasscompiler::rawtoparseerror of the component UTF-8 Character...

AlmaLinux 9 : kernel update (High) (ALSA-2026:36645)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:36645 advisory. kernel: eventpoll: defer struct eventpoll free to RCU grace period CVE-2026-43074 kernel: eventpoll: fix epremove struct eventpoll / struct file UAF...

RHEL 9 : kernel (RHSA-2026:36957)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:36957 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: net/sched: ets: Always remove...

Linux Distros Unpatched Vulnerability : CVE-2026-43825

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Untrusted Java Deserialization in Apache OpenNLP SvmDoccatModel Versions Affected: before 3.0.0-M4 libsvm document categorization module; introduced in...

Linux Distros Unpatched Vulnerability : CVE-2026-58385

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - gimp - None Ubuntu Linux - Unknown description CVE-2026-58385 Note that Nessus relies on the presence of the package as reported by the vendor...

AlmaLinux 8 : edk2 (ALSA-2026:36721)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:36721 advisory. openssl: Out-of-bounds read & write in RFC 3211 KEK Unwrap CVE-2025-9230 Bug Fixes and Enhancements: FJ8.10 Bug How to Update Secure Boot Certificates with...

RockyLinux 8 : libxml2 (RLSA-2026:36734)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:36734 advisory. libxml2: Stack Buffer Overflow in xmllint Interactive Shell Command Handling CVE-2025-6170 Tenable has extracted the preceding description block directly from th...

OpenVPN 2.6.0 < 2.6.21 / 2.7.x < 2.7.5 Multiple Vulnerabilities

According to its self-reported version number, the version of OpenVPN installed on the remote Windows host is affected by multiple vulnerabilities: - A use-after-free bug in ackwritebuf, triggerable by a well-timed sequence of control channel and authentication packets. CVE-2026-12996 - A...

Linux Distros Unpatched Vulnerability : CVE-2026-58382

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - gimp - None Ubuntu Linux - Unknown description CVE-2026-58382 Note that Nessus relies on the presence of the package as reported by the vendor...

RHEL 9 : tomcat (RHSA-2026:36876)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:36876 advisory. Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages JSP technologies. Security Fixes: Apache Tomcat: Apache...

Linux Distros Unpatched Vulnerability : CVE-2026-59869

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js- yaml can spend quadratic CPU time parsing a document...

Linux Distros Unpatched Vulnerability : CVE-2026-29007

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - U-Boot through 2026.04-rc3 contains an out-of-bounds read vulnerability in tcprxstatemachine net/tcp.c when CONFIGPROTTCP is enabled, allowing remote attackers ...

ArcGIS Server <= 12.0 Multiple Vulnerabilities (Security 2026 Update 2)

The version of ArcGIS Server installed on the remote host is 12.0 or prior. It is, therefore, affected by multiple vulnerabilities: - ArcGIS Server contains a directory traversal vulnerability. An unauthenticated attacker could exploit this issue by sending crafted path parameters. Successful...

OpenVPN 2.5.0 < 2.5.12 / 2.6.0 < 2.6.21 / 2.7.x < 2.7.5 Memory Leak DoS

According to its self-reported version number, the version of OpenVPN installed on the remote Windows host is affected by a denial of service vulnerability: - A memory leak in tls-crypt-v2 client key handling allows remote attackers with a valid tls-crypt-v2 client key to potentially cause a deni...

RockyLinux 8 : cups (RLSA-2026:36733)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:36733 advisory. cups: OpenPrinting CUPS: Shared PostScript queue lets anonymous Print-Job requests reach lp code execution over the network CVE-2026-34980 Tenable has extracted...

RHEL 10 : gstreamer1-plugins-bad-free (RHSA-2026:36749)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:36749 advisory. GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package...

Linux Distros Unpatched Vulnerability : CVE-2026-7492

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.1 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain...

RHEL 9 : gstreamer1-plugins-bad-free (RHSA-2026:36834)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:36834 advisory. GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package...

RHEL 8 : cups (RHSA-2026:36733)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:36733 advisory. The Common UNIX Printing System CUPS provides a portable printing layer for Linux, UNIX, and similar operating systems. Security Fixes: cups:...

RHEL 8 : libtasn1 (RHSA-2026:36728)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:36728 advisory. A library that provides Abstract Syntax Notation One ASN.1, as specified by the X.680 ITU-T recommendation parsing and structures management, and...

TencentOS Server 4: freerdp (TSSA-2026:0561)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0561 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

Oracle Linux 9 : openssl (ELSA-2026-50379)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-50379 advisory. 3.5.5-4.0.1fips - Replace upstream references in fips man pages Orabug: 35824276 - Update additional upstream references - Add FIPS package change: ad...

Linux Distros Unpatched Vulnerability : CVE-2026-59882

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.3, Uri::assertValidHost does not reject URI host components containing...

TencentOS Server 4: vim (TSSA-2026:0573)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0573 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

Erlang/OTP 22.2 < 27.3.4.14 / 28.0 < 28.5.0.3 / 29.0 < 29.0.3 DoS (CVE-2026-55952)

The version of Erlang/OTP installed on the remote host is 22.2 prior to 27.3.4.14, 28.0 prior to 28.5.0.3, or 29.0 prior to 29.0.3. It is, therefore, affected by a vulnerability: - The Erlang/OTP ssl application does not validate that the PSK identity list and binder list carried in a TLS 1.3...

openSUSE 16 Security Update : assimp (openSUSE-SU-2026:21242-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21242-1 advisory. This update for assimp fixes the following issues - CVE-2025-11277: large mWidth and mHeight dimensions can lead to integer overflow and a...