Unity Linux 20.1070a Security Update: libXfont2 (UTSA-2026-141784)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-141784 advisory. A heap buffer overflow in BitmapScaleBitmaps in libXfont2 before 2.0.8 due to an overflowing 32bit size could be used by attackers able to access the X Server to...

Linux Distros Unpatched Vulnerability : CVE-2026-113866

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's AutoDiscover service over plain HTTP. Due to a bug, that...

Linux Distros Unpatched Vulnerability : CVE-2026-109709

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Information disclosure, privilege escalation in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5,...

Rocky Linux 8 [CIQ] Security Update: libsoup / libsoup-debuginfo / libsoup-debugsource / libsoup-devel Multiple Vulnerabilities (crlsa-2026_84586)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202684586 advisory. libsoup: libsoup: Heap buffer overflow from WebSocket Pong signal type confusion CVE-2026-102556 libsoup: libsoup: Heap buffer overflow during WebSocket...

Linux Distros Unpatched Vulnerability : CVE-2026-109269

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an information disclosure vulnerability in the JPEG decoder, which performs a read that exposes...

Linux Distros Unpatched Vulnerability : CVE-2026-109279

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 lacks proper synchronization when the security policy is accessed, so simultaneous reads and writes of the...

Linux Distros Unpatched Vulnerability : CVE-2026-109254

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP 2.1.0 before 3.32.0 contains a use-after-free vulnerability in the static rdpsnd channel disconnect path, which frees audio formats and device without...

Linux Distros Unpatched Vulnerability : CVE-2026-112937

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, ReadWriteLock can remove a randomized .filelock- private-hard-link directory...

SUSE SLES12 Security Update : flatpak (SUSE-SU-2026:4610-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4610-1 advisory. - CVE-2026-90616: missing symlink protection allows a malicious sandboxed app to obtain arbitrary read and write access to files on...

Linux Distros Unpatched Vulnerability : CVE-2026-97206

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC DoQ lifetime bug reachable by a remote DoQ client under multi-threaded...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libsoup (UTSA-2026-142305)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142305 advisory. A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent...

Amazon Linux 2 : unbound (ALAS-2026-4000)

The version of unbound installed on the remote host is prior to 1.7.3-15. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-4000 advisory. Amazon Linuxvended DNS resolvers shipped with an older DNSSEC root signing key. For hosts configured with DNSSEC validation enable...

RHEL 10 : gvfs (RHSA-2026:85941)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:85941 advisory. GVFS is the GNOME Desktop Virtual File System layer that allows users to easily access local and remote data using File Transfer Protocol...

Fedora 44 : ghostscript (2026-cf31315f93)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-cf31315f93 advisory. CVE-2026-39919 ghostscript: Heap buffer overflow in JPEG 2000 JPXDecode output adapter CVE-2026-101258 ghostscript: ghostscript: -dSAFER sandbox...

Atlassian Confluence 7.2.x < 9.2.26 / 9.3.x < 10.2.19 / 11.0.0 (CONFSERVER-104517)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-104517 advisory. - Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances e.g. CLIENT-CERT, SPNEGO that a user would be authenticat...

Linux Distros Unpatched Vulnerability : CVE-2026-109256

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP 3.10.0 through 3.32.2 contains a heap buffer overflow in the WinPR pngwritedata callback that writes past the buffer after a realloc failure. A maliciou...

Oracle Access Manager (October 2026 CPU)

The 12.2.1.4.0 and 14.1.2.1.0 versions of Access Manager installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2026 CPU advisory. - Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware component: Authentication Engine. Support...

AlmaLinux 10 : bubblewrap (ALSA-2026:85308)

The remote AlmaLinux 10 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:85308 advisory. bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup CVE-2026-87766 Tenable has extracted the preceding description block...

SUSE SLED15 / SLES15 Security Update : fetchmail (SUSE-SU-2026:4604-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4604-1 advisory. This update for fetchmail fixes the following issue: - CVE-2026-94184: stack-based buffer overflow in NTLM authenticati...

Linux Distros Unpatched Vulnerability : CVE-2026-109245

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP 3.0.0 before 3.32.0 contains an improper certificate validation vulnerability in freerdphttprequest in libfreerdp/utils/http.c that completes TLS...

Linux Distros Unpatched Vulnerability : CVE-2026-109379

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cockpit CMS 2.14.1 contains an observable timing discrepancy vulnerability that allows unauthenticated attackers to enumerate accounts due to an incomplete timi...

RockyLinux 9 : openexr (RLSA-2026:86983)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:86983 advisory. openexr: OpenEXR: Memory corruption and Denial of Service via crafted EXR file processing CVE-2026-34544 openexr: OpenEXR: Denial of Service or...

Linux Distros Unpatched Vulnerability : CVE-2026-102699

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. 1 XSA-437 CVE-2023-34321 addresse...

Linux Distros Unpatched Vulnerability : CVE-2026-109742

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Information disclosure in the PDF Viewer component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

GitLab 15.10 < 19.3.6 / 19.4 < 19.4.3 / 19.5 < 19.5.1 (CVE-2026-13319)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, could have allowed an authenticated to read milestone...

RHEL 8 : postgresql:12 (RHSA-2026:79028)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:79028 advisory. PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL: Arbitrary code execution via...

RockyLinux 9 : tftp (RLSA-2026:80663)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:80663 advisory. tftp: tftp-hpa: Denial of Service due to out-of-bounds read/write in remap engine CVE-2026-85234 Tenable has extracted the preceding description block directly...

Fedora 44 : xen (2026-839be67202)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-839be67202 advisory. x86/AMD: ineffectual Zenbleed workaround XSA-515, CVE-2026-79608 x86: XPTI may break on huge-memory systems XSA-516, CVE-2026-79609 grant-table:...

RockyLinux 10 : flatpak (RLSA-2026:80498)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:80498 advisory. flatpak: Flatpak: Arbitrary code execution via missing symlink protection CVE-2026-90616 flatpak: flatpak: Arbitrary write access as root via extra-dat...

CentOS Linux 7 [TuxCare] Security Update: rsync (CENTOS7:CLSA-2026:1792143084)

The CentOS Linux 7 host has a package installed that is affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1792143084 advisory. - rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the intended destination...

Amazon Linux 2 : dnsmasq (ALASDNSMASQ-2026-005)

The version of dnsmasq installed on the remote host is prior to 2.90-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2DNSMASQ-2026-005 advisory. Amazon Linuxvended DNS resolvers shipped with an older DNSSEC root signing key. For hosts configured with DNSSEC validation...

Linux Distros Unpatched Vulnerability : CVE-2026-95837

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - containerd is an open-source container runtime. From 2.1.0 until 2.2.7 and 2.3.4, containerd's CRI CreateContainer checkpoint restore is vulnerable because CRIU...

Linux Distros Unpatched Vulnerability : CVE-2026-109733

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158,...

MiracleLinux 9 : emacs-27.2-18.el9_8.3 (AXSA:2026-2110:03)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-2110:03 advisory. emacs: Emacs: arbitrary code execution in Flymake mode CVE-2026-96442 Tenable has extracted the preceding description block directly from the MiracleLinux...

Linux Distros Unpatched Vulnerability : CVE-2026-109945

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP 3.0.0 before 3.32.0 contains a heap use-after-free vulnerability in smartcard emulation when SCARDIOCTLDISCONNECT and SCARDIOCTLTRANSMIT operate...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: grafana (UTSA-2026-142362)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142362 advisory. Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives. A crafted plugin archive can chain relative symbolic link...

RockyLinux 10 : bubblewrap (RLSA-2026:85308)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:85308 advisory. bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup CVE-2026-87766 Tenable has extracted the preceding description bloc...

RHEL 8 : postgresql:12 (RHSA-2026:79009)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:79009 advisory. PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL: Arbitrary code execution via...

Linux Distros Unpatched Vulnerability : CVE-2026-109246

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.32.0 contains a divide-by-zero vulnerability in the freerdp-shadow-cli shadow server: the frame id in a client's Frame Acknowledge PDU is store...

RHEL 9 : thunderbird (RHSA-2026:81884)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:81884 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Use-after-free in the SVG component...

Linux Distros Unpatched Vulnerability : CVE-2026-91380

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Utility. Supported versions...

Linux Distros Unpatched Vulnerability : CVE-2026-91396

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Utility. Supported versions...

Linux Distros Unpatched Vulnerability : CVE-2026-91411

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JGSS. Supported versions tha...

Linux Distros Unpatched Vulnerability : CVE-2026-91452

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Networking. Supported versio...

Linux Distros Unpatched Vulnerability : CVE-2026-91462

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JGSS. Supported versions tha...

RHEL 9 : thunderbird (RHSA-2026:81393)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:81393 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Use-after-free in the SVG component...

RHEL 8 : thunderbird (RHSA-2026:81913)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:81913 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Privilege escalation in the DOM: Worke...

Linux Distros Unpatched Vulnerability : CVE-2026-83395

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Networking. Supported versio...

Linux Distros Unpatched Vulnerability : CVE-2026-87293

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in Oracle Java SE component: RMI. Supported versions that are affected are Oracle Java SE: 8u503 and 8u503-perf; Oracle GraalVM Enterprise Edition...

Linux Distros Unpatched Vulnerability : CVE-2026-91464

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JGSS. Supported versions tha...