RHEL 9 : tftp (RHSA-2026:80663)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:80663 advisory. The Trivial File Transfer Protocol TFTP is typically used only for booting diskless workstations. The tftp packages include the tftp and tftp-server...

RHEL 10 : kernel (RHSA-2026:85979)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:85979 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: ipv4: validate checksumstart before...

Linux Distros Unpatched Vulnerability : CVE-2026-109274

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick before 7.1.2-32 contains a time-of-check time-of-use symlink race vulnerability that allows attackers to bypass the path security policy when...

AlmaLinux 9.6 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-core / nginx-filesystem / etc (ALMALINUX9.6:CLSA-2026:1792589925)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792589925 advisory. - NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpcoremodule module. When asynchronous file I/O AIO is enabled in certain...

Linux Distros Unpatched Vulnerability : CVE-2026-109259

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an uninitialized memory read in the TGA image decoder that can expose memory contents. Attackers c...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: ghostscript (UTSA-2026-142364)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142364 advisory. A flaw was found in Ghostscript. When Ghostscript renders a crafted PostScript or EPS document, it can bypass the -dSAFER sandbox and execute arbitrary shell command...

Rocky Linux 8 [CIQ] Security Update: delve / delve-debuginfo / delve-debugsource / go-toolset / golang / etc Multiple Vulnerabilities (crlsa-2026_86203)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202686203 advisory. net/http: golang: golang: Denial of Service via crafted HTTP Range headers CVE-2026-78667 crypto/tls: golang: crypto/tls: Denial of Service via multiple E...

Rocky Linux 9 [CIQ] Security Update: emacs / emacs-common / emacs-common-debuginfo / emacs-debuginfo / etc (crlsa-2026_85245)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202685245 advisory. emacs: Emacs: arbitrary code execution in Flymake mode CVE-2026-96442 Tenable has extracted the preceding description block directly from the CIQ security advisory...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: flatpak-builder (UTSA-2026-142349)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142349 advisory. A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use- git-am: true. An attacker who can provide a malicious sour...

RHEL 8 : .NET 9.0 (RHSA-2026:86170)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:86170 advisory. .NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It...

CentOS Linux 8.4 [TuxCare] Security Update: corosync / corosync-vqsim / corosynclib / corosynclib-devel / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1792591710)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1792591710 advisory. - Corosync through 3.1.9, if encryption is disabled or the attacker knows the encryption key, has a stack- based buffer overflow in...

Oracle HTTP Server 12c (October 2026 CPU)

The version of Oracle HTTP Server installed on the remote host is affected by multiple vulnerabilities as referenced in the October 2026 CPU advisory. - Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware component: OSSL Module. Supported versions that are affected are...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: rabbitmq-java-client (UTSA-2026-142335)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142335 advisory. The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.31.0, inbound AMQP command assembl...

Linux Distros Unpatched Vulnerability : CVE-2026-77205

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Libreswan in FIPS mode has a vulnerability where badly formed received certificates are rejected, but not deleted from the NSS cache. As a result, any real...

Linux Distros Unpatched Vulnerability : CVE-2026-109251

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.32.0 stores the server-supplied signed MS-RDPEGT geometry origin unchecked in an unsigned video surface coordinate, so the blit clamp in...

MiracleLinux 9 : bubblewrap-0.6.3-1.el9_8.1 (AXSA:2026-2109:02)

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-2109:02 advisory. bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup CVE-2026-87766 Tenable has extracted the preceding description...

Unity Linux 20.1070a Security Update: libXfont2 (UTSA-2026-141787)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-141787 advisory. A heap bufferflow in pcfReadFont due to missing glyph bounds checkingin libXfont2 before 2.0.8 allows attackers authenticated as X client to execute code within the ...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS : Squid vulnerabilities (USN-8941-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8941-1 advisory. It was discovered that Squid incorrectly handled certain HTTP Transfer- Encoding headers. An attacker cou...

Linux Distros Unpatched Vulnerability : CVE-2026-113812

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mozilla::CA versions before 20261020 for Perl provide a CA certificate bundle containing a root linked to compromised intermediates. The bundle includes emSign...

Linux Distros Unpatched Vulnerability : CVE-2026-109737

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

Linux Distros Unpatched Vulnerability : CVE-2026-112915

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock can open a crafted SQLite lock database without bounding schema...

Linux Distros Unpatched Vulnerability : CVE-2026-111943

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - golang: crypto/x509: Go: crypto/x509: mitigation for security concerns with a specific Certificate Authority CVE-2026-111943 Note that Nessus relies on the...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: flatpak (UTSA-2026-142347)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142347 advisory. In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalated to arbitrary code executi...

Linux Distros Unpatched Vulnerability : CVE-2026-87293

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in Oracle Java SE component: RMI. Supported versions that are affected are Oracle Java SE: 8u503 and 8u503-perf; Oracle GraalVM Enterprise Edition...

Rocky Linux 9.6 [TuxCare] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1792602059)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792602059 advisory. - PHP uses longjmp for out-of-memory OOM errors to exit the current context and abort handling of the request. Some contexts may n...

Linux Distros Unpatched Vulnerability : CVE-2026-113657

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From sanitize-html 2.17....

Linux Distros Unpatched Vulnerability : CVE-2026-79607

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - During Xenstore live update the state record for a Xenstore watch with specified watch depth is written with two bytes missing. This results in an inconsistent...

RHEL 10 : dogtag-pki (RHSA-2026:86621)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:86621 advisory. IdM PKI is an enterprise software system designed to manage enterprise Public Key Infrastructure deployments. IdM PKI consists of the...

AlmaLinux 9 : xorg-x11-server-Xwayland (ALSA-2026:85193)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:85193 advisory. xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling CVE-2026-93516 xorg-x11-server: xorg-x11-server:...

RHEL 10 : pcre2 (RHSA-2026:86205)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:86205 advisory. The pcre2 package contains a new generation of the Perl Compatible Regular Expression libraries for implementing regular expression patter...

AlmaLinux 9 : kernel (ALSA-2026:86033)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:86033 advisory. kernel: openvswitch: defer tunnel netdevput to RCU release CVE-2026-31678 kernel: xfrm: espintcp: do not reuse an in-progress partial send CVE-2026-52935...

Atlassian Confluence 7.2.x < 9.2.26 / 9.3.x < 10.2.19 / 11.0.0 (CONFSERVER-104510)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-104510 advisory. - Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before windowSize requests have been made, a...

Fedora 44 : dolphin (2026-85f07f4f1b)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-85f07f4f1b advisory. - CVE-2026-110236 Arbitrary command execution via crafted folder name Tenable has extracted the preceding description block directly from the Fedora security...

RHEL 9 : python-tornado (RHSA-2026:82040)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:82040 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic da...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: rabbitmq-java-client (UTSA-2026-142337)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142337 advisory. The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0,...

Linux Distros Unpatched Vulnerability : CVE-2026-102342

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.3, 4.0.3, and 4.1.4, applications that allow the SVG animate or set elements c...

RHEL 8 : libxml2 (RHSA-2026:79120)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:79120 advisory. The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fixes: libxml2: Stack Buffer Overflow i...

Atlassian Confluence < 9.2.22 / 9.3.x < 10.2.19 / 11.0.0 (CONFSERVER-104514)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-104514 advisory. - nanoid Nano ID before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module...

Linux Distros Unpatched Vulnerability : CVE-2026-109349

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gitoxide gix-pack before 0.75.0 contains a reachable assertion in BytesToEntriesIter::newfromheader: the pack header decoder accepts version 3, but a...

Linux Distros Unpatched Vulnerability : CVE-2026-109736

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Frame poisoning in the Layout component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. CVE-2026-109736...

RockyLinux 8 : .NET 10.0 (RLSA-2026:86192)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:86192 advisory. dotnet: dotnet10.0: ASP.NET Core Remote Code Execution Vulnerability CVE-2026-102870 dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service...

Atlassian Confluence 9.1.x < 9.2.26 / 9.3.x < 10.2.19 / 11.0.0 (CONFSERVER-104515)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-104515 advisory. - The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength when decoding JSON object property...

RHEL 8 : flatpak-builder (RHSA-2026:86714)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:86714 advisory. Flatpak-builder is a tool for building flatpaks from sources. Security Fixes: flatpak-builder: Host code execution via git am hook execution in patc...

RockyLinux 10 : rust-sequoia-sq (RLSA-2026:85848)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:85848 advisory. hickory-resolver: hickory-resolver: DNSSEC validation bypass allows forged DNS records CVE-2026-93657 rustls-webpki: rustls-webpki: Denial of Service v...

Linux Distros Unpatched Vulnerability : CVE-2026-109786

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In fail2ban 0.10.5 through 1.1.1 before ddd879d, the sshd filter config/filter.d/sshd.conf accepts an on suffix after the host address. Because OpenSSH logs the...

Rocky Linux 10.2 [CIQ] Security Update: wireshark / wireshark-cli / wireshark-cli-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_84721)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202684721 advisory. wireshark: Wireshark: Denial of Service via C12.22 protocol dissector crash CVE-2026-76886 wireshark: Wireshark: Denial of Service via RRC protocol...

AlmaLinux 10 : lrzsz (ALSA-2026:86056)

The remote AlmaLinux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:86056 advisory. lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode CVE-2026-105840 lrzsz: lrzsz: Arbitrary command execution via...

Linux Distros Unpatched Vulnerability : CVE-2026-109263

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the YUV encoder, which fails to release allocated memory when a specific operatio...

RockyLinux 10 : cockpit-machines (RLSA-2026:86971)

The remote RockyLinux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RLSA-2026:86971 advisory. cockpit-machines: cockpit-machines: Sensitive data exposure via command-line arguments CVE-2026-92768 cockpit-machines: cockpit-machines: Sensitive Dat...

Linux Distros Unpatched Vulnerability : CVE-2026-15577

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A user or service account with read-only access to Git Sync provisioning connections can modify a connection's configuration through its status subresource...