Rocky Linux 10.2 [CIQ] Security Update: perl-URI (crlsa-2026_84587)

The Rocky Linux 10.2 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-202684587 advisory. URI: URI for Perl: Security bypass due to incorrect hostname encoding via missing Unicode normalization CVE-2026-19953 Tenable has extracted the preceding...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libXi (UTSA-2026-142325)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142325 advisory. An out-of-bounds read in libXi's XI2 class parsing via sizeclasses and copyclasses in libXi before 1.8.4 could be used by malicous servers to crash the X client...

Oracle Linux 9 : jackson-core (ELSA-2026-86706)

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-86706 advisory. - CVE-2026-89425 jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing unbounded...

Google Chrome < 156.0.8078.47 Multiple Vulnerabilities

The version of Google Chrome installed on the remote macOS host is prior to 156.0.8078.47. It is, therefore, affected by multiple vulnerabilities as referenced in the 202610stable-channel-update-for-desktop02018666648 advisory. - Incorrect authorization in Extensions in Google Chrome prior to...

RockyLinux 9 : cockpit-machines (RLSA-2026:86970)

The remote RockyLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RLSA-2026:86970 advisory. cockpit-machines: cockpit-machines: Sensitive data exposure via command-line arguments CVE-2026-92768 cockpit-machines: cockpit-machines: Sensitive Data...

Amazon Linux 2 : dnsmasq (ALAS-2026-4002)

The version of dnsmasq installed on the remote host is prior to 2.76-16. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-4002 advisory. Amazon Linuxvended DNS resolvers shipped with an older DNSSEC root signing key. For hosts configured with DNSSEC validation enabled...

RockyLinux 10 : fetchmail (RLSA-2026:85959)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:85959 advisory. fetchmail: fetchmail: stack-based buffer overflow in NTLM authentication fetchmail-SA-2026-01 CVE-2026-94184 Tenable has extracted the preceding description blo...

RHEL 10 : thunderbird (RHSA-2026:81392)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:81392 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Use-after-free in the SVG component...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: expat (UTSA-2026-142306)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142306 advisory. libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after- free can occur. NOTE: this is similar to CVE-2026-50219,...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: NetworkManager (UTSA-2026-142307)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142307 advisory. NetworkManager did not apply the privateuser restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for...

Linux Distros Unpatched Vulnerability : CVE-2026-109563

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer number pattern that backtracks quadratically on long digit runs...

AlmaLinux 9 : resteasy (ALSA-2026:85234)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:85234 advisory. resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode Decompression-Bomb DoS CVE-2026-89059 resteasy-core: RESTEasy: CorsFilter Reflects...

Fedora 43 : bind / bind-dyndb-ldap (2026-aba85b9a89)

The remote Fedora 43 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-aba85b9a89 advisory. Security updates using git snapshot Release 9.18 is end-of-life upstream. Apply security fixes including medium CVEs from somehow maintained git...

AlmaLinux 9.2 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-core / nginx-filesystem / etc (ALMALINUX9.2:CLSA-2026:1792571502)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792571502 advisory. - NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpcoremodule module. When asynchronous file I/O AIO is enabled in certain...

Linux Distros Unpatched Vulnerability : CVE-2026-113654

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: rpcbind (UTSA-2026-142356)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142356 advisory. A flaw was found in rpcbind. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service DoS by sending a large number of unique...

Ubuntu 26.04 LTS / 26.10 : Perl XS::Parse::Keyword module vulnerability (USN-8940-1)

The remote Ubuntu 26.04 LTS / 26.10 host has a package installed that is affected by a vulnerability as referenced in the USN-8940-1 advisory. It was discovered that the Perl XS::Parse::Keyword module did not correctly handle certain inputs. If a user or automated system were tricked into receivi...

Linux Distros Unpatched Vulnerability : CVE-2026-108831

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A security vulnerability has been detected in meetecho janus-gateway up to 1.4.2. This vulnerability affects unknown code of the file html/demos/admin.js of the...

RHEL 9 : sudo (RHSA-2026:86634)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:86634 advisory. The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged...

Oracle Linux 10 : rust-sequoia-sq (ELSA-2026-85848)

The remote Oracle Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-85848 advisory. - Fix CVE-2026-93657 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus has not...

Linux Distros Unpatched Vulnerability : CVE-2026-109756

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

Linux Distros Unpatched Vulnerability : CVE-2026-109706

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and...

Linux Distros Unpatched Vulnerability : CVE-2026-91375

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in Oracle Java SE component: Libraries. Supported versions that are affected are Oracle Java SE: 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1,...

MiracleLinux 9 : xorg-x11-server-Xwayland-24.1.9-4.el9_8.4 (AXSA:2026-2112:08)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2112:08 advisory. xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling CVE-2026-93516 xorg-x11-server:...

RHEL 8 : postgresql:12 (RHSA-2026:79027)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:79027 advisory. PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL: Arbitrary code execution via...

RockyLinux 8 : fetchmail (RLSA-2026:86982)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:86982 advisory. fetchmail: fetchmail: stack-based buffer overflow in NTLM authentication fetchmail-SA-2026-01 CVE-2026-94184 Tenable has extracted the preceding description bloc...

Linux Distros Unpatched Vulnerability : CVE-2026-109399

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SWUpdate through 2026.05.1 contains an improper certificate validation vulnerability in crypto/swupdatecmsverifyopenssl.c that trusts untrusted X.509 certificat...

RHEL 9 : qt5-qtbase (RHSA-2026:87082)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:87082 advisory. Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: perl-CPAN (UTSA-2026-142319)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142319 advisory. CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS. Tenable has extracted the preceding description block directly from t...

Linux Distros Unpatched Vulnerability : CVE-2026-109831

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - UnRTF by GNU Project is vulnerable to out-of-bounds write. If a user opens an RTF file crafted by an attacker, it may lead to a denial-of-service DoS condition...

Linux Distros Unpatched Vulnerability : CVE-2026-112202

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Imager::File::GIF versions before 1.006 for Perl allow out-of-bounds reads when consolidating GIF images. With gifconsolidate = 1, palette indices from the imag...

AlmaLinux 8 : fetchmail (ALSA-2026:86982)

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:86982 advisory. fetchmail: fetchmail: stack-based buffer overflow in NTLM authentication fetchmail-SA-2026-01 CVE-2026-94184 Tenable has extracted the preceding description block...

Fedora 44 : perl-GD-SecurityImage (2026-3bf1e0b3f9)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-3bf1e0b3f9 advisory. Until now, GD::SecurityImage used Perl's built-in rand function to generate secrets. The rand function is unsuitable for security applications because it is...

Linux Distros Unpatched Vulnerability : CVE-2026-109252

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP from 3.9.0 before 3.32.0 contains a NULL pointer dereference vulnerability in the RDPEAR NDR reader that allows malicious servers to crash clients via...

Linux Distros Unpatched Vulnerability : CVE-2026-91333

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in Oracle Java SE component: Security. Supported versions that are affected are Oracle Java SE: 21.0.12.1, 25.0.4.1 and 27. Difficult to exploit...

Slackware Linux 15.0 / current mozilla-thunderbird Vulnerability (SSA:2026-293-05)

The version of mozilla-thunderbird installed on the remote host is prior to 140.17.0esr / 153.5.1esr. It is, therefore, affected by a vulnerability as referenced in the SSA:2026-293-05 advisory. New mozilla-thunderbird packages are available for Slackware 15.0 and -current to fix a security issue...

Linux Distros Unpatched Vulnerability : CVE-2026-109265

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick 7.1.1-7 before 7.1.2-32 contains a heap buffer over-read vulnerability that allows attackers to read beyond allocated memory due to incorrect string...

Linux Distros Unpatched Vulnerability : CVE-2026-109395

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access vulnerability in the sun.misc.Unsafe based UnsafeChunkDecoder that fails to validate...

Oracle Linux 9 : openssl (ELSA-2026-500440)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-500440 advisory. - Fixed DTLS Retransmits Handshake Messages From a Stale Buffer Offset CVE-2026-84782 Resolves: RHEL-264479 - Patch asn1d2ireadbio to read headers without...

Linux Distros Unpatched Vulnerability : CVE-2026-109704

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

Rocky Linux 9.6 [TuxCare] Security Update: dovecot / dovecot-devel / dovecot-mysql / dovecot-pgsql / etc (ALMALINUX9.6:CLSA-2026:1792596933)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792596933 advisory. - An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editi...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: emacs (UTSA-2026-142368)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142368 advisory. GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that allows an attacker to leak heap memory contents by supplying a crafted ima...

Fedora 44 : rust-backtrace / rust-object / rust-object0.37 / rust-object0.38 / etc (2026-09783712f4)

The remote Fedora 44 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-09783712f4 advisory. - Update the object crate to version 0.40.0. - Add a compat package for version 0.39 of the object crate. - Update the ruzstd crate to version 0.9.1. This...

Linux Distros Unpatched Vulnerability : CVE-2026-81856

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in hexpm hex allows a malicious package publisher or a hostile repository server to...

Linux Distros Unpatched Vulnerability : CVE-2026-74049

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Execution After Redirect EAR vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.26, from 10.1.0-M1 through 10.1.60,...

Linux Distros Unpatched Vulnerability : CVE-2026-103119

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body being split between the current request...

Linux Distros Unpatched Vulnerability : CVE-2026-101296

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication mechanism...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libXi (UTSA-2026-142331)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142331 advisory. An out-of-bounds read in libXi's XQueryDeviceState in libXi before 1.8.4 could be used by a Tenable has extracted the preceding description block directly from the...

RHEL 10 : sssd (RHSA-2026:77534)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:77534 advisory. The System Security Services Daemon SSSD service provides a set of daemons to manage access to remote directories and authentication mechanisms. It...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libXi (UTSA-2026-142328)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142328 advisory. An out-of-bounds read in libXi's XListInputDevices in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client. Tenable has extracted th...