Mozilla Thunderbird < 158.0.1

The version of Thunderbird installed on the remote Windows host is prior to 158.0.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-114 advisory. - Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was...

CentOS Linux 7 [TuxCare] Security Update: bpftool / kernel / kernel-debug / kernel-debug-devel / kernel-devel / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1792234299)

"The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1792234299 advisory. - nfqnlmangle in net/netfilter/nfnetlinkqueue.c in the Linux kernel through 5.18.14 allows remote attackers to cause a denial of servic...

RHEL 10 : python3.12 (RHSA-2026:77020)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:77020 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level...

Linux Distros Unpatched Vulnerability : CVE-2026-113129

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper access control in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially leak sensitive information via a crafted...

Rocky Linux 9.6 [TuxCare] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1792445930)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792445930 advisory. - In the Linux kernel, the following vulnerability has been resolved: virt: tdx-guest: Just leak decrypted memory on unrecoverable...

Atlassian Confluence < 9.2.26 / 9.3.x < 10.2.19 / 11.0.0 (CONFSERVER-104506)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-104506 advisory. - Netty io.netty:netty-handler versions from 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final disable TLS hostname verification ...

Oracle Linux 10 : lrzsz (ELSA-2026-86056)

The remote Oracle Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-86056 advisory. - Backport tightened path handling from 0.13.1 CVE-2026-105840 Tenable has extracted the preceding description block directly from the Oracle Linux...

Linux Distros Unpatched Vulnerability : CVE-2026-113868

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When authenticating to a POP3 or SMTP server using NTLM, Thunderbird did not check whether the server's challenge was valid base64. A malicious server could sen...

RockyLinux 8 : python3 (RLSA-2026:85239)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:85239 advisory. python: python: Arbitrary file deletion via race condition during temporary directory cleanup CVE-2026-12345 python: python: Certificate verification...

Linux Distros Unpatched Vulnerability : CVE-2026-105923

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A malicious SVG can trigger an integer overflow which in turn triggers a null-pointer dereference in VectorImage QML Type. CVE-2026-105923 Note that Nessus reli...

Linux Distros Unpatched Vulnerability : CVE-2026-109680

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP 3.18.0 before 3.32.0 has a heap-based out-of-bounds write in freerdpinterruptiblegetline, which shrinks the buffer to 32 bytes while keeping a pre-fille...

Fedora 44 : perl-Net-Whois-Raw (2026-78d9d79627)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-78d9d79627 advisory. Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for the wrong domain for unicode domain names. This tool...

Linux Distros Unpatched Vulnerability : CVE-2026-109764

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

Linux Distros Unpatched Vulnerability : CVE-2026-113116

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a...

Linux Distros Unpatched Vulnerability : CVE-2026-113146

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox...

Linux Distros Unpatched Vulnerability : CVE-2026-113117

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper input validation in ANGLE in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the...

Linux Distros Unpatched Vulnerability : CVE-2026-113260

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a craft...

Linux Distros Unpatched Vulnerability : CVE-2026-92539

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same...

Linux Distros Unpatched Vulnerability : CVE-2026-113036

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in HTML in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a craft...

Linux Distros Unpatched Vulnerability : CVE-2026-113238

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in CustomTabs in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the...

Linux Distros Unpatched Vulnerability : CVE-2026-113163

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in WebGL in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a craft...

Linux Distros Unpatched Vulnerability : CVE-2026-113026

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in PDF in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a...

Linux Distros Unpatched Vulnerability : CVE-2026-113288

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-113247

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML...

Linux Distros Unpatched Vulnerability : CVE-2026-113250

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted...

Amazon Linux 2023 : dnsmasq, dnsmasq-utils (ALAS2023-2026-3223)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3223 advisory. Amazon Linuxvended DNS resolvers shipped with an older DNSSEC root signing key. For hosts configured with DNSSEC validation enabled, this could result in DNS resolution failures, including for names in...

Linux Distros Unpatched Vulnerability : CVE-2026-80430

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Link Resolution Before File Access in the drag source staging path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program...

AlmaLinux 10 : lrzsz (ALSA-2026:86056)

The remote AlmaLinux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:86056 advisory. lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode CVE-2026-105840 lrzsz: lrzsz: Arbitrary command execution via...

Linux Distros Unpatched Vulnerability : CVE-2026-79607

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - During Xenstore live update the state record for a Xenstore watch with specified watch depth is written with two bytes missing. This results in an inconsistent...

AlmaLinux 9 : xorg-x11-server-Xwayland (ALSA-2026:85193)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:85193 advisory. xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling CVE-2026-93516 xorg-x11-server: xorg-x11-server:...

RHEL 10 : dogtag-pki (RHSA-2026:86621)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:86621 advisory. IdM PKI is an enterprise software system designed to manage enterprise Public Key Infrastructure deployments. IdM PKI consists of the...

Linux Distros Unpatched Vulnerability : CVE-2026-109596

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Hugo from v0.162.0 before v0.167.0 contains an improper link resolution vulnerability that lets malicious themes or modules expose files outside their root via...

RockyLinux 10 : cockpit-machines (RLSA-2026:86971)

The remote RockyLinux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RLSA-2026:86971 advisory. cockpit-machines: cockpit-machines: Sensitive data exposure via command-line arguments CVE-2026-92768 cockpit-machines: cockpit-machines: Sensitive Dat...

Linux Distros Unpatched Vulnerability : CVE-2026-15577

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A user or service account with read-only access to Git Sync provisioning connections can modify a connection's configuration through its status subresource...

Atlassian Confluence 9.1.x < 9.2.26 / 9.3.x < 10.2.19 / 11.0.0 (CONFSERVER-104515)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-104515 advisory. - The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength when decoding JSON object property...

Linux Distros Unpatched Vulnerability : CVE-2026-109263

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the YUV encoder, which fails to release allocated memory when a specific operatio...

Linux Distros Unpatched Vulnerability : CVE-2026-87291

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in Oracle Java SE component: Networking. Supported versions that are affected are Oracle Java SE: 21.0.12.1, 25.0.4.1 and 27. Easily exploitable...

MiracleLinux 8 : bubblewrap-0.4.0-3.el8_10 (AXSA:2026-2108:01)

The remote MiracleLinux 8 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-2108:01 advisory. bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup CVE-2026-87766 Tenable has extracted the preceding description...

Linux Distros Unpatched Vulnerability : CVE-2026-87255

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in Oracle Java SE component: Compiler. Supported versions that are affected are Oracle Java SE: 25.0.4.1 and 27. Difficult to exploit vulnerabilit...

Linux Distros Unpatched Vulnerability : CVE-2026-109776

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Race condition in the XPCOM component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. CVE-2026-109776...

Amazon Linux 2023 : bind, bind-chroot, bind-devel (ALAS2023-2026-3221)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3221 advisory. Amazon Linuxvended DNS resolvers shipped with an older DNSSEC root signing key. For hosts configured with DNSSEC validation enabled, this could result in DNS resolution failures, including for names in...

RHEL 10 : gd (RHSA-2026:81518)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:81518 advisory. GD is an open source code library for the dynamic creation of images by programmers. GD creates PNG, JPEG, GIF, WebP, XPM, BMP images, among other...

Rocky Linux 10.2 [CIQ] Security Update: wireshark / wireshark-cli / wireshark-cli-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_84721)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202684721 advisory. wireshark: Wireshark: Denial of Service via C12.22 protocol dissector crash CVE-2026-76886 wireshark: Wireshark: Denial of Service via RRC protocol...

Linux Distros Unpatched Vulnerability : CVE-2026-109770

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Spoofing issue in the DOM: Web Serial component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

Linux Distros Unpatched Vulnerability : CVE-2026-109281

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick 7.1.0-21 before 7.1.2-32 contains a heap buffer over-read in its handling of the -fx option, where a certain -fx operation reads beyond the bounds o...

Linux Distros Unpatched Vulnerability : CVE-2026-109952

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The FreeRDP client 3.0.0 before 3.32.0 does not check a server-selected PROTOCOLRDSTLS or PROTOCOLHYBRIDEX against its enabled protocol set in...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 : XZ Utils vulnerability (USN-8945-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 host has packages installed that are affected by a vulnerability as referenced in the USN-8945-1 advisory. It was discovered that XZ Utils incorrectly handled certain memory allocation...

Linux Distros Unpatched Vulnerability : CVE-2026-88833

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in BusyBox's udhcpc DHCP client. When processing raw DHCP packets, the client replaces the validated packet length with an attacker-controlled...

Atlassian Confluence 7.2.x < 9.2.26 / 9.3.x < 10.2.19 / 11.0.0 (CONFSERVER-104511)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-104511 advisory. - Off-by-one Error vulnerability in Apache Tomcat impacting the N flag on the rewrite valves causes rewrite processing to restart at the second rul...

Linux Distros Unpatched Vulnerability : CVE-2026-109777

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird...