Linux Distros Unpatched Vulnerability : CVE-2026-98160

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - staging: rtl8723bs: fix mismatched free of HalData in rtwsdioif1init padapter-HalData is allocated via vzalloc, but incorrectly freed using kfree in the...

Linux Distros Unpatched Vulnerability : CVE-2026-97602

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - inet: frags: invalidate queues before flushing them fqdirpreexit flushes the skbs from incomplete queues without changing their completion state. A fragment whi...

Linux Distros Unpatched Vulnerability : CVE-2026-97953

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: stmmac: fix TX descriptor availability check for TSO traffic stmmactsoxmit estimates the number of free TX descriptors required by a TSO skb as: skb-len -...

Linux Distros Unpatched Vulnerability : CVE-2026-97998

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfilter: nfnetlinklog: cope with concurrent instance destruction Instances are refcounted. However, only memory release happens on the 1 - 0 transition; the...

Linux Distros Unpatched Vulnerability : CVE-2026-97987

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - virtioinput: reset device if inputregisterdevice fails Probe marks the device DRIVEROK with virtiodeviceready before calling inputregisterdevice. If registratio...

Ubuntu 24.04 LTS / 26.04 LTS / Pro Realtime 24.04 LTS : Linux kernel vulnerabilities (USN-8816-1)

The remote Ubuntu 24.04 LTS / 26.04 LTS / Pro Realtime 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8816-1 advisory. Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the...

Linux Distros Unpatched Vulnerability : CVE-2026-97917

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - accel/ivpu: Validate full buffer range in ivputocpuaddr Add a size parameter to ivputocpuaddr and validate that the whole vpuaddr, vpuaddr + size range stays...

Linux Distros Unpatched Vulnerability : CVE-2026-97560

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb: client: fix one-byte OOB read in smb2parsenativesymlink When parsing a share-root relative native symlink, memcpy copies smbtarget+1 skipping the leading...

Linux Distros Unpatched Vulnerability : CVE-2026-98086

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: ump: do not touch legacyrmidi before it exists sndumpparseendpoint sets ump-parsed on every exit, including error, before the caller attaches the legacy...

Linux Distros Unpatched Vulnerability : CVE-2026-97523

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mptcp: close race between scheduler and state change The mptcp scheduler may race with subflow sockets state change: data transmission on the selected socket ma...

Linux Distros Unpatched Vulnerability : CVE-2026-98142

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/cirrus-qemu: Validate BAR0 size during probe The cirrus-qemu driver relies on CIRRUSVRAMSIZE 4 MB to validate framebuffer sizes. However, during PCI probe,...

Linux Distros Unpatched Vulnerability : CVE-2026-97902

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fs: don't return -EINVAL for successful nested thaw Commit 7366f8b6fc6a fs: handle freezing from multiple devices replaced the freezeholders bitmask with...

Linux Distros Unpatched Vulnerability : CVE-2026-97994

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - vhost/vdpa: reject VRINGNUM larger than device max vhostvringsetnum accepts any non-zero power-of- two queue size that fits in 16 bits. vhost-vdpa then passes...

Linux Distros Unpatched Vulnerability : CVE-2026-97575

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - media: v4l2-ctrls: validate AV1 tile counts The stateless AV1 decoders use tileinfo.tilecols and tilerows as loop bounds and as indices into the mistarts and...

Linux Distros Unpatched Vulnerability : CVE-2026-97986

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - virtioinput: stop callbacks before unregistering input device virtinputremove unregisters the input device before resetting the virtio device. virtinputrecveven...

Linux Distros Unpatched Vulnerability : CVE-2026-97905

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - cpufreq: zero-initialize policy cpumask before sysfs publication cpufreqpolicyalloc allocates policy-cpus with alloccpumaskvar, i.e. without GFPZERO, unlike the...

Linux Distros Unpatched Vulnerability : CVE-2026-98075

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: reject BPFPSEUDOFUNC reference to the main program fixups.c:jitsubprogs rewrites BPFPSEUDOFUNC loads to contain real function addresses. This function is...

Linux Distros Unpatched Vulnerability : CVE-2026-98051

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: bcmasp: fix txspbringfull checking same slot cnt times The loop initialised nextindex from intf-txspbindex on every iteration, so incrring always produced...

Linux Distros Unpatched Vulnerability : CVE-2026-98001

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - hwmon: ltc4282 Make sure clkinitdata is fully initialized The clkinitdata structure contains several mutually-exclusive members for different methods to specify...

Linux Distros Unpatched Vulnerability : CVE-2026-97925

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tick/broadcast: Plug clockevents replacement race reported and decoded the following race condition when a broadcast device is replaced: CPUA CPUB...

Linux Distros Unpatched Vulnerability : CVE-2026-98012

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/sched: sfq: clamp quantum in change path sfqchange accepts any non-negative quantum only rejects intctl-quantum 120 with -EINVAL, matching fqcodelchange and...

AlmaLinux 10 : firefox (ALSA-2026:69461)

The remote AlmaLinux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:69461 advisory. firefox: thunderbird: Use-after-free in the SVG component CVE-2026-92024 firefox: thunderbird: Mitigation bypass in the Remote Settings Client component...

openSUSE 16: ant / ant-antlr / ant-apache-bcel / ant-apache-bsf / etc (openSUSE-SU-2026:21891-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21891-1 advisory. - CVE-2021-36374: excessive memory allocation when reading a specially crafted ZIP archive or a derived formats bsc1188469. - CVE-2025-7962:...

Linux Distros Unpatched Vulnerability : CVE-2026-97542

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xfs: bail out on bitmap errors in xrepagflfill LOLLM also points out that the xagbbitmapset call in xrepagflfill can fail, but we don't check the result of...

Linux Distros Unpatched Vulnerability : CVE-2026-97556

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb: client: avoid leaking refcount when cifssbtlink fails cifsoplockbreak takes over the reference that cifsqueueoplockbreak acquired when it queued the work,...

Linux Distros Unpatched Vulnerability : CVE-2026-98114

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ksmbd: propagate DACL parsing errors parsedacl silently accepts truncated ACEs and allocation failures, allowing setinfosec to continue with an incomplete ACL...

Linux Distros Unpatched Vulnerability : CVE-2026-98157

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - EDAC/devicesysfs: Use kstrtouint for pollmsec to prevent truncation The pollmsec sysfs store file uses simplestrtoul which accepts an unsigned long, but the...

Linux Distros Unpatched Vulnerability : CVE-2026-98069

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/rds: acquire the fastpath locks in rdsconnshutdown rdsconnshutdown quiesces the transmit and receive-refill paths by waiting for RDSINXMIT and RDSRECVREFILL...

Linux Distros Unpatched Vulnerability : CVE-2026-97991

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - vdpasimblk: reject out-of-range sector starts vdpasimblkcheckrange logs an invalid start sector but continues validating the request. The subsequent unsigned...

Linux Distros Unpatched Vulnerability : CVE-2026-93239

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - arm64: mm: Fix the lockless page-table walk in showpte showpte walks page tables locklessly and can run with interrupts enabled. A concurrent teardown can free ...

Linux Distros Unpatched Vulnerability : CVE-2026-98092

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ASoC: amd: yc: fix memory leak in acp6xpdmdmaclose acp6xpdmdmaclose does not free the runtime-privatedata buffer allocated in acp6xpdmdmaopen. Add the missing...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : OpenJDK 25 vulnerabilities (USN-8783-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8783-1 advisory. Weber Leon discovered that the 2D component of OpenJDK 25 did not correctly handle user authentication. A remote attacker could...

Linux Distros Unpatched Vulnerability : CVE-2026-98102

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipv6: mcast: fix RCU list diversion in ip6mcdel1src When removing a source filter whose count reaches zero, ip6mcdel1src unlinks psf from pmc-mcasources. If the...

RockyLinux 10 : libxml2 (RLSA-2026:71586)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:71586 advisory. libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow CVE-2026-86138 libxml2: libxml2: Data integrity issues due to integer overflo...

Linux Distros Unpatched Vulnerability : CVE-2026-98059

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Mark schedprocesswait argument as nullable dowait passes wo-wopid to the schedprocesswait tracepoint. kernelwait4 leaves wopid NULL for wait4-1, and...

Linux Distros Unpatched Vulnerability : CVE-2026-98016

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/mlx5e: Fix use-after-free race in samplerestoreput Concurrent teardown of TC sample rules sharing the same restore context may re-read restore-count after...

Fedora 44 : rust-cryptoki (2026-738ce6f6f8)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-738ce6f6f8 advisory. New upstream release. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for...

Linux Distros Unpatched Vulnerability : CVE-2026-97969

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - watchdog: msc313e: Fix clock leak and spurious timer in settimeout msc313ewdtsettimeout unconditionally calls msc313ewdtstart which introduces two severe bugs: ...

Adobe Experience Manager Forms JEE <= 6.5.25 / 6.5 LTS SP2 Multiple Vulnerabilities (APSB26-151)

The version of Adobe Experience Manager Forms JEE installed on the remote host is 6.5.25 or earlier, or 6.5 LTS SP2 or earlier. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB26-151 advisory. - Adobe Experience Manager Forms JEE is affected by an Incorrect...

Linux Distros Unpatched Vulnerability : CVE-2026-88366

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NanoSVG commit 239e102ec contains an incorrect numeric conversion vulnerability in nsvgpathArcTo when parsing SVG arc commands. A specially crafted SVG document...

Linux Distros Unpatched Vulnerability : CVE-2026-93243

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mm/secretmem: properly account locked pages secretmem accounts folios by treating memory as if it were mlock'd and thus limited by the RLIMITMEMLOCK limit...

Linux Distros Unpatched Vulnerability : CVE-2026-77421

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in nano editor's regex search mode passes a...

openSUSE 16 Security Update : keybase-client (openSUSE-SU-2026:21925-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21925-1 advisory. Changes in keybase-client: - CVE-2026-89090: Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder Tenable has extracted the...

Mattermost Server 11.7.x < 11.7.11 / 11.8.x < 11.8.6 / 11.9.x < 11.9.2 / 11.10.x < 11.10.2 Multiple Vulnerabilities (MMSA-2026-00771, MMSA-2026-00775, MMSA-2026-00776)

The version of Mattermost Server installed on the remote host is affected by multiple vulnerabilities as referenced in the MMSA-2026-00771, MMSA-2026-00775, MMSA-2026-00776 advisories. - Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 fail to enforce a...

openSUSE 16: lastlog2 / libblkid-devel / libblkid-devel-static / libblkid1 / etc (openSUSE-SU-2026:21905-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21905-1 advisory. - CVE-2026-13595: heap use-after-free in libblkid nested partition probing bsc1269583. - CVE-2026-27456: TOCTOU in the mount program when settin...

Linux Distros Unpatched Vulnerability : CVE-2026-88373

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libde265 commit 4d45a6b contains a NULL pointer dereference vulnerability in the NAL parsing path. When de265pushNAL is called with a zero-length NAL unit, the...

Linux Distros Unpatched Vulnerability : CVE-2026-98125

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb/client: fix stale page cache in insert/collapse range smb3insertrange and smb3collapserange use truncatepagecacherange to invalidate the affected page cache...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : GNU Bison vulnerability (USN-8777-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-8777-1 advisory. It was discovered that GNU Bison incorrectly handled grammar-defined configuration variables when generating HTML reports. An attacker cou...

Linux Distros Unpatched Vulnerability : CVE-2026-93233

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/nouveau/dmem: fix callocated underflow on large folio split nouveaudmemfoliofree drops chunk-callocated once per freed folio, while a large compound...

Linux Distros Unpatched Vulnerability : CVE-2026-97918

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tracing: Undo the registration when enabling the histogram trigger fails Commit 6f86bdeab633 tracing: Fix bad hist from corrupting namedtriggers list described...