Fedora 43 : tor (2026-aa3e7e6d5b)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-aa3e7e6d5b advisory. Update to latest upstream release https://forum.torproject.org/t/security-release-0-4-9-11/21786 bz2483769 Tenable has extracted the preceding description...

Juniper Junos OS Vulnerability (JSA110079)

The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA110079 advisory. - An Improper Validation of Specified Quantity in Input vulnerability in the Packet Forwarding Engine pfe of Juniper Networks Junos OS on MX Series allows an unauthenticate...

Juniper Junos OS Vulnerability (JSA110073)

The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA110073 advisory. - An Improper Check for Unusual or Exceptional Conditions vulnerability in the advanced forwarding toolkit evo-aftmand of Juniper Networks Junos OS Evolved on PTX Series...

Amazon Linux 2 : containerd, --advisory ALAS2NITRO-ENCLAVES-2026-114 (ALASNITRO-ENCLAVES-2026-114)

The version of containerd installed on the remote host is prior to 2.1.9-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2026-114 advisory. x509.Certificate.VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternativ...

RHEL 10 : 389-ds-base (RHSA-2026:36670)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:36670 advisory. 389 Directory Server is an LDAP version 3 LDAPv3 compliant server. The base packages include the Lightweight Directory Access Protocol LDA...

Fedora 44 : perl-JavaScript-Minifier-XS (2026-634b594205)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-634b594205 advisory. 0.16 bump - Fix CVE-2026-56017 and CVE-2026-56018 Tenable has extracted the preceding description block directly from the Fedora security advisory...

Oracle Linux 8 : freeipmi (ELSA-2026-36307)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-36307 advisory. 1.6.18-1 - Update to 1.6.18, fixes CVE-2026-50031 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2026-124 (ALASKERNEL-5.10-2026-124)

"The version of kernel installed on the remote host is prior to 5.10.259-258.1043. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2026-124 advisory. In the Linux kernel, the following vulnerability has been resolved: net/sched: teql: Fix double-free i...

RHEL 9 : nginx:1.24 (RHSA-2026:36618)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:36618 advisory. nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security...

Fedora 43 : betterleaks (2026-97d351d54e)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-97d351d54e advisory. Update to 1.6.0 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...

RHEL 9 : 389-ds-base (RHSA-2026:36671)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:36671 advisory. 389 Directory Server is an LDAP version 3 LDAPv3 compliant server. The base packages include the Lightweight Directory Access Protocol LDAP...

Fedora 44 : python-cramjam (2026-ed6d2b806a)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-ed6d2b806a advisory. Update to PyO3 0.29, with fixes for RUSTSEC-2026-0176 and RUSTSEC-2026-0177. Tenable has extracted the preceding description block directly from the Fedora...

Palo Alto Networks PAN-OS 10.2.x / 11.1.x / 11.2.x / 12.1.x Vulnerability

The version of Palo Alto Networks PAN-OS running on the remote host is a vulnerable version of 10.2.x, 11.1.x, 11.2.x, or 12.1.x. It is, therefore, affected by a vulnerability. A server-side request forgery SSRF vulnerability in Palo Alto Networks PAN-OS software enables an authenticated...

RHEL 9 : nginx:1.26 (RHSA-2026:36639)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:36639 advisory. nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security...

RHEL 9 : aardvark-dns (RHSA-2026:36318)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:36318 advisory. Authoritative DNS server for A/AAAA container records Forwards other request to configured resolvers. Read more about configuration in...

Foxit PDF Editor < 2026.1.2 Multiple Vulnerabilities

According to its version, the Foxit PDF Editor application previously named Foxit PhantomPDF installed on the remote Windows host is prior to 2026.1.2. It is, therefore affected by multiple vulnerabilities: Note that Nessus has not tested for this issue but has instead relied only on the...

RockyLinux 9 : perl-HTTP-Daemon (RLSA-2026:36187)

The remote RockyLinux 9 host has a package installed that is affected by a vulnerability as referenced in the RLSA-2026:36187 advisory. perl-HTTP-Daemon: HTTP::Daemon: Arbitrary code execution via OS command injection in sendfile CVE-2026-8450 Tenable has extracted the preceding description block...

Amazon Linux 2 : gstreamer1-plugins-good, --advisory ALAS2-2026-3788 (ALAS-2026-3788)

The version of gstreamer1-plugins-good installed on the remote host is prior to 1.18.4-6. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3788 advisory. Heap buffer overflow in the Matroska MKV demuxer when calculating decompressed buffer sizes for...

MiracleLinux 9 : libsndfile-1.0.31-9.el9_8.1 (AXSA:2026-1219:04)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1219:04 advisory. libsndfile: integer overflow in imareaderinit CVE-2026-37555 Tenable has extracted the preceding description block directly from the MiracleLinux security...

Fedora 43 : python-cramjam (2026-07ef57edc0)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-07ef57edc0 advisory. Update to PyO3 0.29, with fixes for RUSTSEC-2026-0176 and RUSTSEC-2026-0177. Tenable has extracted the preceding description block directly from the Fedora...

Palo Alto Networks PAN-OS 11.1.x < 11.1.16 / 11.2.x < 11.2.13 / 12.1.x < 12.1.8 Vulnerability

The version of Palo Alto Networks PAN-OS running on the remote host is 11.1.x prior to 11.1.16, 11.2.x prior to 11.2.13, or 12.1.x prior to 12.1.8. It is, therefore, affected by a vulnerability. A file deletion vulnerability in Palo Alto Networks PAN-OS software enables an unauthenticated attacke...

Linux Distros Unpatched Vulnerability : CVE-2026-56001

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A heap buffer overflow in BitmapScaleBitmaps in libXfont2 before 2.0.8 due to an overflowing 32bit size could be used by attackers able to access the X Server t...

Linux Distros Unpatched Vulnerability : CVE-2026-42505

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the...

Foxit PDF Editor < 13.2.5 Multiple Vulnerabilities

According to its version, the Foxit PDF Editor application previously named Foxit PhantomPDF installed on the remote Windows host is prior to 13.2.5. It is, therefore affected by multiple vulnerabilities: Note that Nessus has not tested for this issue but has instead relied only on the...

Amazon Linux 2 : containerd, --advisory ALAS2DOCKER-2026-135 (ALASDOCKER-2026-135)

The version of containerd installed on the remote host is prior to 2.1.9-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2026-135 advisory. x509.Certificate.VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name S...

Linux Distros Unpatched Vulnerability : CVE-2026-42218

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xrdp is an open source RDP server. Versions 0.10.6 and prior contain a timing side-channel vulnerability in the login interface. Due to a discrepancy in respons...

MiracleLinux 9 : PackageKit-1.2.6-2.el9_8 (AXSA:2026-1214:03)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1214:03 advisory. PackageKit: race condition vulnerability leads to arbitrary package installation as root CVE-2026-41651 Tenable has extracted the preceding description block...

Linux Distros Unpatched Vulnerability : CVE-2026-60001

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay. CVE-2026-60001 Note that Nessus relies on the presence of the package as...

Juniper Junos OS Vulnerability (JSA110085)

The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA110085 advisory. - A Return of Pointer Value Outside of Expected Range vulnerability in the fileio library of Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privilged...

Linux Distros Unpatched Vulnerability : CVE-2026-55645

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the processing of Client Control PDUs. During the RDP connection...

MiracleLinux 9 : xorg-x11-server-Xwayland-24.1.9-4.el9_8 (AXSA:2026-1215:05)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1215:05 advisory. xorg: xwayland: X.Org X server: Denial of Service via integer underflow in XKB compatibility map handling CVE-2026-33999 xorg: xwayland: X.Org X...

RHEL 9 : kpatch-patch-5_14_0-570_116_1, kpatch-patch-5_14_0-570_17_1, kpatch-patch-5_14_0-570_39_1, kpatch-patch-5_14_0-570_66_1, and kpatch-patch-5_14_0-570_94_1 (RHSA-2026:36534)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:36534 advisory. This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the code of a running kernel. This patc...

Linux Distros Unpatched Vulnerability : CVE-2026-55626

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xrdp is an open source RDP server. In versions 0.10.6 and prior, when an authenticated user session is initialized using the Xvnc backend over UNIX domain...

Amazon Linux 2 : samba, --advisory ALAS2-2026-3493 (ALAS-2026-3493)

The version of samba installed on the remote host is prior to 4.10.16-24. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3493 advisory. unauthenticated udp packet crashes AD DC nbt server CVE-2026-3238 Samba file servers and classic non-AD domain controller...

IBM WebSphere Application Server Liberty 17.0.0.3 < 26.0.0.8 DoS (7279284)

The version of IBM WebSphere Application Server Liberty running on the remote host is affected by a DoS vulnerability as referenced in the 7279284 advisory. - In Eclipse Parsson published Maven Central artifacts before version 1.1.8, the JSON parser did not enforce a default maximum on the number...

IBM WebSphere Application Server 8.5.x < 8.5.5.30 / 9.x < 9.0.5.29 XSRF (7279256)

The version of IBM WebSphere Application Server running on the remote host is affected by a vulnerability as referenced in the 7279256 advisory. - IBM WebSphere Application Server is affected by a cross-site request forgery, caused by improper validation of user-supplied input to the Administrati...

RockyLinux 10 : 389-ds-base (RLSA-2026:36196)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:36196 advisory. 389-ds-base: 389-ds-base: Heap buffer overflow in sasliorecv via padded SASL UNBIND CVE-2026-11610 389-ds-base: 389-ds-base: integer overflow in SASL...

RockyLinux 10 : nginx (RLSA-2026:36364)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:36364 advisory. nginx: NGINX: Arbitrary code execution or Denial of Service via heap-based buffer overflow with crafted HTTP/2 headers CVE-2026-42055 Bug Fixes and Enhancements...

Oracle Linux 8 : compat-openssl10 (ELSA-2026-36215)

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-36215 advisory. 1.1.0-2o-4.3 - Fix CVE-2026-45447: Fix double-free of caller-owned BIO in PKCS7verify Tenable has extracted the preceding description block directly from the...

Linux Distros Unpatched Vulnerability : CVE-2026-59995

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when sftp server:/path . is used with an attacker-controlled server...

RockyLinux 9 : nginx:1.24 (RLSA-2026:36618)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:36618 advisory. nginx: NGINX: Arbitrary code execution or Denial of Service via heap-based buffer overflow with crafted HTTP/2 headers CVE-2026-42055 Bug Fixes and Enhancements:...

Amazon Linux 2 : qt5-qt3d, --advisory ALAS2-2026-3797 (ALAS-2026-3797)

The version of qt5-qt3d installed on the remote host is prior to 5.15.3-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3797 advisory. A vulnerability was detected in Assimp up to 6.0.4. Affected is the function glTF2Importer::ImportEmbeddedTextures in th...

Fedora 45 : python-safetensors / rust-safetensors (2026-9db41d0ada)

The remote Fedora 45 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-9db41d0ada advisory. Update safetensors to 0.8.0 and build the Python extension using PyO3 0.29, which fixes RUSTSEC-2026-0176 and RUSTSEC-2026-0177. Tenable has extracted the...

Linux Distros Unpatched Vulnerability : CVE-2026-55999

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Local attackers with a X connection able to provide PCX fonts to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a heap buffer...

Linux Distros Unpatched Vulnerability : CVE-2026-55191

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - freerdp2 - None freerdp3 - None Ubuntu Linux - Heap-buffer-overflow write in AVC444 YUV buffer allocation CVE-2026-55191 Note that Nessus relies ...

Amazon Linux 2 : firefox, --advisory ALAS2FIREFOX-2026-062 (ALASFIREFOX-2026-062)

The version of firefox installed on the remote host is prior to 140.12.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2FIREFOX-2026-062 advisory. Privilege escalation in the Graphics: WebRender component. This vulnerability was fixed in Firefox 152, Firefox E...

Linux Distros Unpatched Vulnerability : CVE-2026-14895

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - String::Util versions before 1.36 for Perl are susceptible to a regular expression denial of service. The trim and rtrim functions stripped trailing whitespace...

RHEL 9 : xorg-x11-server-Xwayland (RHSA-2026:36633)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:36633 advisory. Xwayland is an X server for running X clients under Wayland. Security Fixes: xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server:...

Amazon Linux 2 : opensc, --advisory ALAS2-2026-3492 (ALAS-2026-3492)

The version of opensc installed on the remote host is prior to 0.19.0-6. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3492 advisory. A flaw has been found in OpenSC up to 0.26.1. This affects the function testkpgencertwrite of the file src/tools/pkcs11-tool.c of t...

RHEL 8 : httpd:2.4 (RHSA-2026:36373)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:36373 advisory. The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: Apache HTTP...