Rocky Linux 8 [CIQ] Security Update: libsoup / libsoup-debuginfo / libsoup-debugsource / libsoup-devel Multiple Vulnerabilities (crlsa-2026_84586)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202684586 advisory. libsoup: libsoup: Heap buffer overflow from WebSocket Pong signal type confusion CVE-2026-102556 libsoup: libsoup: Heap buffer overflow during WebSocket...

RockyLinux 10 : flatpak (RLSA-2026:80498)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:80498 advisory. flatpak: Flatpak: Arbitrary code execution via missing symlink protection CVE-2026-90616 flatpak: flatpak: Arbitrary write access as root via extra-dat...

Rocky Linux 10.2 [CIQ] Security Update: openexr / openexr-debuginfo / openexr-debugsource / openexr-devel / etc Multiple Vulnerabilities (crlsa-2026_84796)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202684796 advisory. OpenEXR: OpenEXR: Memory corruption and Denial of Service via crafted EXR file processing CVE-2026-34544 OpenEXR: OpenEXR: Out-of-bounds write...

RHEL 7 : gvfs (RHSA-2026:86606)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:86606 advisory. GVFS is the GNOME Desktop Virtual File System layer that allows users to easily access local and remote data using File Transfer Protocol FTP, Secur...

SUSE SLES15 Security Update : bind (SUSE-SU-2026:4608-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4608-1 advisory. - CVE-2026-19033: Unauthenticated IXFR deltas are applied to the live zone before TSIG verification bsc1280430. - CVE-2026-19662:...

CentOS Linux 8.4 [TuxCare] Security Update: krb5-devel / krb5-libs / krb5-pkinit / krb5-server / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1792592896)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1792592896 advisory. - In MIT Kerberos 5 aka krb5 before 1.22.3, there is a NULL pointer dereference if an application calls gssacceptseccontext on a...

Atlassian Confluence 7.2.x < 9.2.26 / 9.3.x < 10.2.19 / 11.0.0 (CONFSERVER-104517)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-104517 advisory. - Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances e.g. CLIENT-CERT, SPNEGO that a user would be authenticat...

Linux Distros Unpatched Vulnerability : CVE-2026-109242

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 renders uninitialized heap memory from un-decoded progressive tiles because the tile-current buffer is allocated...

SUSE SLED15: rsyslog / rsyslog-module-gssapi / rsyslog-module-gtls / etc (SUSE-SU-2026:4611-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4611-1 advisory. - imdtls permitted-peer authorization bypass bsc1281628. Changes for rsyslog: - Upgrade to version 8.2608.0...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: expat (UTSA-2026-142352)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142352 advisory. Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts function in xmlparse.c, where processing N...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: freerdp (UTSA-2026-142311)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142311 advisory. FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP clients using TS Gateway accept a server-controlled maxxmitfrag value in...

Atlassian Confluence < 9.2.22 / 9.3.x < 10.2.19 / 11.0.0 (CONFSERVER-104514)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-104514 advisory. - nanoid Nano ID before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module...

Fedora 43 : aom (2026-fd075f5751)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-fd075f5751 advisory. Update to version 3.15.2. Release notes since 3.13.3: - https://aomedia.googlesource.com/aom/+/refs/tags/v3.14.0 -...

Linux Distros Unpatched Vulnerability : CVE-2026-95838

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd's layer unpack handler repeatedly traverses directories fo...

Linux Distros Unpatched Vulnerability : CVE-2026-92823

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in libmodulemd. In builds with rpmio support enabled, compressed modulemd YAML is decompressed through a custom read handler that does not...

RHEL 10 : gd (RHSA-2026:81518)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:81518 advisory. GD is an open source code library for the dynamic creation of images by programmers. GD creates PNG, JPEG, GIF, WebP, XPM, BMP images, among other...

Linux Distros Unpatched Vulnerability : CVE-2026-109952

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The FreeRDP client 3.0.0 before 3.32.0 does not check a server-selected PROTOCOLRDSTLS or PROTOCOLHYBRIDEX against its enabled protocol set in...

Linux Distros Unpatched Vulnerability : CVE-2026-79608

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The workaround for XSA-433 Zenbleed, CVE-2023-20593 was later re-worked to better integrate with other manipulations of the same MSR. In this rework an inverted...

Linux Distros Unpatched Vulnerability : CVE-2026-112915

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock can open a crafted SQLite lock database without bounding schema...

Linux Distros Unpatched Vulnerability : CVE-2026-105460

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in BlueZ. An out-of-bounds read vulnerability exists in the btmon Bluetooth monitor tool when processing crafted HCI Return Link Keys events. A...

SUSE SLES15: apache2-mod_php8 / php8 / php8-bcmath / php8-bz2 / php8-calendar / etc (SUSE-SU-2026:4602-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4602-1 advisory. - CVE-2025-1218: php: php: Denial of Service via out-of-bounds read in mysqlnd wire protocol parser bsc1282981. - CVE-2025-14181:...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libsoup (UTSA-2026-142312)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142312 advisory. An out-of-bounds read vulnerability was found in libsoup's multipart processing subsystem. The flaw exists in the soupmultipartinputstreamreadheaders function inside...

RockyLinux 10 : lrzsz (RLSA-2026:86056)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:86056 advisory. lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode CVE-2026-105840 lrzsz: lrzsz: Arbitrary command execution via...

AlmaLinux 9.6 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-core / nginx-filesystem / etc (ALMALINUX9.6:CLSA-2026:1792589925)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792589925 advisory. - NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpcoremodule module. When asynchronous file I/O AIO is enabled in certain...

Linux Distros Unpatched Vulnerability : CVE-2026-109274

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick before 7.1.2-32 contains a time-of-check time-of-use symlink race vulnerability that allows attackers to bypass the path security policy when...

RHEL 9 : tftp (RHSA-2026:80663)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:80663 advisory. The Trivial File Transfer Protocol TFTP is typically used only for booting diskless workstations. The tftp packages include the tftp and tftp-server...

AlmaLinux 9.2 [TuxCare] Security Update: 389-ds-base / 389-ds-base-devel / 389-ds-base-libs / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1792597970)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792597970 advisory. - A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes...

Mozilla Thunderbird < 153.5.1

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 153.5.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-115 advisory. - Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libsoup (UTSA-2026-142310)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142310 advisory. A vulnerability was found in libsoup's HTTP/2 protocol implementation. The library fails to correctly release memory context blocks under specific stream termination...

Linux Distros Unpatched Vulnerability : CVE-2026-109939

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP 3.27.1 before 3.32.0 contains a NULL pointer dereference in updatereadcachebitmapv3order in libfreerdp/core/orders.c, which accesses the client bitmap...

GitLab 17.8 < 19.3.6 / 19.4 < 19.4.3 / 19.5 < 19.5.1 (CVE-2026-112378)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain conditions could have allowed an authenticated...

Oracle Linux 10 : cockpit-machines (ELSA-2026-86971)

The remote Oracle Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-86971 advisory. - CVE-2026-92768 RHEL-263124 - CVE-2026-92747 RHEL-263120 Tenable has extracted the preceding description block directly from the Oracle Linux securi...

Atlassian Confluence < 9.2.24 / 9.5.x < 10.2.17 / 11.0.0 (CONFSERVER-104473)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-104473 advisory. - In Bouncy Castle for Java before 1.85, OER parser recurses without depth limit on self-referential IEEE 1609.2 schema. This issue also affects...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: ghostscript (UTSA-2026-142364)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142364 advisory. A flaw was found in Ghostscript. When Ghostscript renders a crafted PostScript or EPS document, it can bypass the -dSAFER sandbox and execute arbitrary shell command...

Amazon Linux 2023 : systemd, systemd-boot-unsigned, systemd-container (ALAS2023-2026-3224)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3224 advisory. Amazon Linuxvended DNS resolvers shipped with an older DNSSEC root signing key. For hosts configured with DNSSEC validation enabled, this could result in DNS resolution failures, including for names in...

Linux Distros Unpatched Vulnerability : CVE-2026-109259

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an uninitialized memory read in the TGA image decoder that can expose memory contents. Attackers c...

Fedora 46 : libmspack (2026-ed3c0a9bce)

The remote Fedora 46 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-ed3c0a9bce advisory. Automatic update for libmspack-0.11-0.1.alpha.fc46. Changelog Wed Oct 21 2026 Dan Hork - 0.11-0.1.alpha - updated to 0.11alpha - fix CVE-2026-110602...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: rabbitmq-java-client (UTSA-2026-142329)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142329 advisory. The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.1,...

Splunk Enterprise 9.4.0 < 9.4.16, 10.0.0 < 10.0.11, 10.2.0 < 10.2.8, 10.4.0 < 10.4.4 (SVD-2026-1007)

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2026-1007 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number...

Linux Distros Unpatched Vulnerability : CVE-2026-96405

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for each individual domain-name operation but has no aggregate inboun...

Linux Distros Unpatched Vulnerability : CVE-2026-109425

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Tink-go tink-crypto/tink-go through 2.8.0 contains an input-validation vulnerability where keyset.NewHandleWithNoSecrets and ReadWithNoSecrets skip the structur...

RHEL 10 : rhc-worker-playbook (RHSA-2026:79112)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:79112 advisory. A worker for yggdrasil that receives Ansible playbooks and executes them against the local host. Security Fixes: ansible-collection-ansible-posix:...

Linux Distros Unpatched Vulnerability : CVE-2026-113334

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper input validation in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside...

Linux Distros Unpatched Vulnerability : CVE-2026-113173

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper input validation in UI in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the...

Linux Distros Unpatched Vulnerability : CVE-2026-113244

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper input validation in UI in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a...

Linux Distros Unpatched Vulnerability : CVE-2026-113093

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in DisplayLocking in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox v...

Linux Distros Unpatched Vulnerability : CVE-2026-113062

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper input validation in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via ...

Linux Distros Unpatched Vulnerability : CVE-2026-113333

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HT...

Linux Distros Unpatched Vulnerability : CVE-2026-113264

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper input validation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandb...

Linux Distros Unpatched Vulnerability : CVE-2026-113050

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Out of bounds read in HID in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. Chromium...