RHEL 7 : kernel (RHSA-2026:81349)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:81349 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: netfilter: conntrack: remove...

Linux Distros Unpatched Vulnerability : CVE-2026-101356

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response...

Oracle Linux 10 : fetchmail (ELSA-2026-85959)

The remote Oracle Linux 10 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-85959 advisory. 6.4.38-3.1 - Fix CVE-2026-94184: stack-based buffer overflow in NTLM authentication fetchmail-SA-2026-01 Resolves: RHEL-265187 Tenable has extracted the...

Unity Linux 20.1070a Security Update: libXfont2 (UTSA-2026-141785)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-141785 advisory. fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c indexes the per-character encoding array using numchars from the FSQueryXBitmaps16 reply, but that...

RockyLinux 8 : libxml2 (RLSA-2026:80675)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:80675 advisory. libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation CVE-2026-86142 Tenable has extracted the preceding description bloc...

Atlassian Confluence 7.16.x < 9.2.26 / 9.3.x < 10.2.19 / 11.0.0 (CONFSERVER-104502)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-104502 advisory. - Spring MVC and WebFlux applications are vulnerable to Denial of Service DoS attacks when resolving static resources. Affected versions: Spring...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: rabbitmq-java-client (UTSA-2026-142337)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142337 advisory. The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0,...

RHEL 9 : python-tornado (RHSA-2026:82040)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:82040 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic da...

Unity Linux 20.1070a Security Update: libXfont2 (UTSA-2026-141787)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-141787 advisory. A heap bufferflow in pcfReadFont due to missing glyph bounds checkingin libXfont2 before 2.0.8 allows attackers authenticated as X client to execute code within the ...

MiracleLinux 9 : bubblewrap-0.6.3-1.el9_8.1 (AXSA:2026-2109:02)

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-2109:02 advisory. bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup CVE-2026-87766 Tenable has extracted the preceding description...

Linux Distros Unpatched Vulnerability : CVE-2026-77205

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Libreswan in FIPS mode has a vulnerability where badly formed received certificates are rejected, but not deleted from the NSS cache. As a result, any real...

RHEL 8 : flatpak-builder (RHSA-2026:86714)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:86714 advisory. Flatpak-builder is a tool for building flatpaks from sources. Security Fixes: flatpak-builder: Host code execution via git am hook execution in patc...

AlmaLinux 8 : bubblewrap (ALSA-2026:85306)

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:85306 advisory. bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup CVE-2026-87766 Tenable has extracted the preceding description block...

Linux Distros Unpatched Vulnerability : CVE-2026-109251

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.32.0 stores the server-supplied signed MS-RDPEGT geometry origin unchecked in an unsigned video surface coordinate, so the blit clamp in...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: flatpak (UTSA-2026-142347)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142347 advisory. In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalated to arbitrary code executi...

Linux Distros Unpatched Vulnerability : CVE-2026-109736

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Frame poisoning in the Layout component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. CVE-2026-109736...

RHEL 8 : libxml2 (RHSA-2026:79120)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:79120 advisory. The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fixes: libxml2: Stack Buffer Overflow i...

Linux Distros Unpatched Vulnerability : CVE-2026-113657

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From sanitize-html 2.17....

Linux Distros Unpatched Vulnerability : CVE-2026-109786

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In fail2ban 0.10.5 through 1.1.1 before ddd879d, the sshd filter config/filter.d/sshd.conf accepts an on suffix after the host address. Because OpenSSH logs the...

Atlassian Confluence < 9.2.22 / 9.3.x < 10.2.19 / 11.0.0 (CONFSERVER-104514)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-104514 advisory. - nanoid Nano ID before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module...

Linux Distros Unpatched Vulnerability : CVE-2026-109349

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gitoxide gix-pack before 0.75.0 contains a reachable assertion in BytesToEntriesIter::newfromheader: the pack header decoder accepts version 3, but a...

Linux Distros Unpatched Vulnerability : CVE-2026-102342

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.3, 4.0.3, and 4.1.4, applications that allow the SVG animate or set elements c...

Atlassian Confluence 7.2.x < 9.2.26 / 9.3.x < 10.2.19 / 11.0.0 (CONFSERVER-104510)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-104510 advisory. - Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before windowSize requests have been made, a...

Rocky Linux 9 [CIQ] Security Update: xorg-x11-server-Xwayland / xorg-x11-server-Xwayland-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_85193)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202685193 advisory. xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling CVE-2026-93516 xorg-x11-server: xorg-x11-server:...

Linux Distros Unpatched Vulnerability : CVE-2026-109781

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Denial-of-service in the Printing: Output component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: freerdp (UTSA-2026-142311)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142311 advisory. FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP clients using TS Gateway accept a server-controlled maxxmitfrag value in...

Fedora 43 : perl-Net-IDN-Encode (2026-4aec7019eb)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-4aec7019eb advisory. Net::IDN::Punycode versions before 2.590 for Perl allow an out-of-bounds read via integer overflow of the delta accumulator in encodepunycode. This...

Rocky Linux 9 [CIQ] Security Update: pki-jackson-databind (crlsa-2026_85231)

The Rocky Linux 9 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-202685231 advisory. com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion...

Linux Distros Unpatched Vulnerability : CVE-2026-109833

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. In the VNC TLS read path, partial consumption of the internal peek buffer...

Debian dsa-6523 : heif-gdk-pixbuf - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6523 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6523-1 [email protected] https://www.debian.org/securit...

Linux Distros Unpatched Vulnerability : CVE-2026-92823

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in libmodulemd. In builds with rpmio support enabled, compressed modulemd YAML is decompressed through a custom read handler that does not...

RHEL 10 : rhc-worker-playbook (RHSA-2026:79112)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:79112 advisory. A worker for yggdrasil that receives Ansible playbooks and executes them against the local host. Security Fixes: ansible-collection-ansible-posix:...

RHEL 10 : fetchmail (RHSA-2026:85959)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:85959 advisory. Fetchmail is a remote mail retrieval and forwarding utility intended for use over on-demand TCP/IP links, like SLIP or PPP connections. Fetchmail...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: rabbitmq-java-client (UTSA-2026-142330)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142330 advisory. The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, the AMQP connection tuning...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS : Squid vulnerabilities (USN-8941-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8941-1 advisory. It was discovered that Squid incorrectly handled certain HTTP Transfer- Encoding headers. An attacker cou...

RockyLinux 8 : bind (RLSA-2026:79162)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:79162 advisory. bind9: bind: BIND 9: Denial of Service via 16-bit length truncation in DNS negative cache handling CVE-2026-19667 bind: BIND: Denial of Service via...

Mozilla Firefox < 158.0.2

The version of Firefox installed on the remote Windows host is prior to 158.0.2. It is, therefore, affected by a vulnerability as referenced in the mfsa2026-116 advisory. - Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was distributed to...

AlmaLinux 10 : xorg-x11-server-Xwayland (ALSA-2026:85191)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:85191 advisory. xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling CVE-2026-93516 xorg-x11-server: xorg-x11-server:...

Linux Distros Unpatched Vulnerability : CVE-2026-109938

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Positive mapped-video coordinates overflow and abort FreeRDP clients A malicious or compromised RDP server can terminate a FreeRDP client after the user connect...

GitLab 12.0 < 19.3.6 / 19.4 < 19.4.3 / 19.5 < 19.5.1 (CVE-2026-16255)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab EE affecting all versions from 12.0 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when the instance-wide SAML or LDAP membership lock was...

AlmaLinux 8 : xorg-x11-server-Xwayland (ALSA-2026:86907)

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:86907 advisory. xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling CVE-2026-93516 xorg-x11-server: xorg-x11-server:...

Fedora 43 : perl-GD-SecurityImage (2026-bdeade52d9)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-bdeade52d9 advisory. Until now, GD::SecurityImage used Perl's built-in rand function to generate secrets. The rand function is unsuitable for security applications because it is...

RockyLinux 9 : bubblewrap (RLSA-2026:85309)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:85309 advisory. bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup CVE-2026-87766 Tenable has extracted the preceding description block...

Linux Distros Unpatched Vulnerability : CVE-2026-110249

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough attributes to keep...

Atlassian Confluence 7.2.x < 9.2.26 / 9.3.x < 10.2.19 / 11.0.0 (CONFSERVER-104516)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-104516 advisory. - Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a security constraint that limits us...

Linux Distros Unpatched Vulnerability : CVE-2026-95838

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd's layer unpack handler repeatedly traverses directories fo...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: GraphicsMagick (UTSA-2026-142304)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142304 advisory. A heap out-of-bounds write exists in the Photo CD PCD decoder of GraphicsMagick. In DecodeImage coders/pcd.c, the Huffman delta loop advances its output pointer with...

Linux Distros Unpatched Vulnerability : CVE-2026-98869

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Infer zextdst based on static register liveness analysis As reported in the thread 1, the verifier's 32-bit operations zero extension logic is broken. This...

AlmaLinux 9.2 [TuxCare] Security Update: libsoup / libsoup-devel / libsoup-doc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1792599160)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792599160 advisory. - A flaw was found in libsoup. The soupuridecodedatauri function incorrectly treated base64 data-URI payloads as NUL-terminated...

MiracleLinux 9 : jackson-databind-2.21.6-1.el9_8.1 (AXSA:2026-2107:01)

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-2107:01 advisory. com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference...