SUSE SLES12 Security Update : perl-Date-Manip (SUSE-SU-2026:3537-1)

The remote SUSE Linux SLES12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3537-1 advisory. - CVE-2026-60074: corrupted dates returned when processing non-ASCII decimal digits that pass the numeric range tests in check bsc1273063. -...

Fedora 44 : chromium (2026-eebdfdf5ba)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-eebdfdf5ba advisory. chromium-151.0.7922.108 security release fix 41 CVE CVE-2026-19137: Use after free in WebGL CVE-2026-19138: Heap buffer overflow in CrashReporting...

RockyLinux 9 : vim (RLSA-2026:38511)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:38511 advisory. vim: command injection when decompressing .tgz archives CVE-2026-46483 vim: Vim: Arbitrary Code Execution via crafted directory names CVE-2026-47162 vim...

SUSE SLES15 Security Update : podman (SUSE-SU-2026:3536-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3536-1 advisory. - CVE-2026-55686: specially crafted image where the WORKDIR path contains a symlink allows for directory creation and ownership...

MiracleLinux 9 : python3.12-3.12.13-3.el9_8.1 (AXSA:2026-1510:19)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1510:19 advisory. python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations CVE-2026-15308 Tenable has extracted the preceding...

Linux Distros Unpatched Vulnerability : CVE-2026-72693

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - openvt -u is intended to identify the owner of the current VT and then execute login as that user from a privileged context. In the documented kbrequest/init...

Linux Distros Unpatched Vulnerability : CVE-2026-73151

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - svxlink - None Ubuntu Linux - GHSA-x5r8-rq62-q9cj: remotetrx: unvalidated audio length + exposed transceiver control CVE-2026-73151 Note that...

RHEL 7 : host-metering (RHSA-2026:53416)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:53416 advisory. Host metering service Security Fixes: crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries...

Linux Distros Unpatched Vulnerability : CVE-2026-14180

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to handle chunked transfer encoding. The issue...

Linux Distros Unpatched Vulnerability : CVE-2026-68090

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - debugobjects: Plug race against a concurrent OOM disable syzbot reported a puzzling splat: WARNING: kernel/time/hrtimer.c:443 at stubtimer+0xa/0x20 stubtimer i...

Linux Distros Unpatched Vulnerability : CVE-2026-68318

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pdscore: fix use-after-free on workqueue during remove In pdscremove, the workqueue is destroyed before pdscteardown is called. This ordering allows two paths t...

Devolutions Server <= 2026.1.22 / 2026.2.0 <= 2026.2.11 Multiple Vulnerabilities (DEVO-2026-0024)

The version of Devolutions Server installed on the remote host is prior or equal to 2026.1.22 or 2026.2.0 prior or equal to 2026.2.11. It is, therefore, affected by multiple vulnerabilities, including: - Improper authorization in the access request status endpoint allows an authenticated...

RHEL 10 : gstreamer1-plugins-good (RHSA-2026:53451)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:53451 advisory. GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a...

RHEL 10 : iscsi-initiator-utils (RHSA-2026:53845)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:53845 advisory. The iscsi-initiator-utils packages provide the server daemon for the Internet Small Computer System Interface iSCSI protocol, as well as t...

Linux Distros Unpatched Vulnerability : CVE-2026-73152

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - svxlink - None Ubuntu Linux - GHSA-4g8q-rgxf-fmgf: EchoLink proxy: integer truncation in message length CVE-2026-73152 Note that Nessus relies on...

RHCOS 4 : OpenShift Container Platform 4.22.9 (RHSA-2026:51036)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:51036 advisory. - golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate CVE-2026-39835 -...

RHEL 8 : thunderbird (RHSA-2026:53453)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:53453 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Site isolation issue in the DOM:...

RHEL 10 : kernel (RHSA-2026:53330)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:53330 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: fsnotify: Fix ordering of ip...

Linux Distros Unpatched Vulnerability : CVE-2026-73030

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability in the iswithindirectory function that fails to normalize paths before...

RHEL 9 : thunderbird (RHSA-2026:53444)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:53444 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Site isolation issue in the DOM:...

Fedora 44 : emacs (2026-b4d966ae0a)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-b4d966ae0a advisory. This mitigates a vulnerability that allowed a specially crafted file to trigger execution of attacker- controlled arbitrary Emacs Lisp code immediately when...

Linux Distros Unpatched Vulnerability : CVE-2026-68332

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: airoha: Fix potential use-after-free in airohappedeinit airohappedeinit replaces the NPU pointer with NULL via rcureplacepointer but does not wait for...

Linux Distros Unpatched Vulnerability : CVE-2026-68168

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - afs: Fix afseditdirremove to get, not find, block 0 Fix afseditdirremove to use afsdirgetblock to get block 0 rather than afsdirfindblock as the latter caches t...

Oracle Linux 7 : dovecot (ELSA-2026-49513)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-49513 advisory. - Backport fix for CVE-2026-42006 Orabug: 39820967 - Backport fix for CVE-2025-59032 Orabug: 39573795 - Backport fix for CVE-2026-27856 Orabug: 39573795 -...

Linux Distros Unpatched Vulnerability : CVE-2026-68200

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: timer: don't re-enter an instance callback that is still running The userspace-driven timer utimer TRIGGER ioctl calls sndtimerinterrupt directly with no...

Fedora 43 : mingw-libidn (2026-7ddafb24a3)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-7ddafb24a3 advisory. Update to 1.44. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...

Linux Distros Unpatched Vulnerability : CVE-2026-6368

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Calling wordexp with WRDEAPPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the wewordv member, which o...

Linux Distros Unpatched Vulnerability : CVE-2026-68385

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - s390/checksum: Fix csumpartial without vector facility Currently csumpartial calls csumcopy with copy=false and dst=NULL. On machines without the vector facilit...

MiracleLinux 9 : nginx:1.24 (AXSA:2026-1509:01)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1509:01 advisory. nginx: NGINX: Arbitrary code execution or Denial of Service via heap-based buffer overflow with crafted HTTP/2 headers CVE-2026-42055 Tenable has extracted t...

Linux Distros Unpatched Vulnerability : CVE-2026-68379

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tcp: fix TIMEWAIT socket reference leak on PSP policy failure Release the TIMEWAIT socket reference and jump to discardit upon PSP policy failure in both IPv4 a...

Security Updates for Microsoft SharePoint Server 2016 (August 2026)

The Microsoft SharePoint Server 2016 installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - Improper authentication in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. CVE-2026-62827 -...

Linux Distros Unpatched Vulnerability : CVE-2026-68372

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: core: port: Deattach Type-C connector on component unbind connectorunbind is the mirror of connectorbind, but it is missing the symmetric call to...

Linux Distros Unpatched Vulnerability : CVE-2026-68392

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: mgmt: fix locking in unpairdevice/disconnectsync Dereferencing RCU-protected pointers outside critical sections is invalid and may lead to UAF. Take...

Zoom Workplace < 7.1.0 Vulnerability (ZSB-26015)

The version of Zoom Workplace installed on the remote host is prior to 7.1.0. It is, therefore, affected by a vulnerability as referenced in the ZSB-26015 advisory. - Missing bounds check in the annotator function of Zoom Clients allows buffer over-write, which may allow a meeting participant to...

SUSE SLES15 Security Update : openssl-3-livepatches (SUSE-SU-2026:3535-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2026:3535-1 advisory. - 'HollowByte' DoS via attacker-controlled memory allocation bsc1271712, bsc1271713. Tenable has extracted the preceding description block directly fro...

Linux Distros Unpatched Vulnerability : CVE-2026-68201

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: timer: drain a slave's callback before its master detaches it sndtimercloselocked drains the closing instance's own in-flight callback IFLGCALLBACK before...

Fedora 43 : libcupsfilters (2026-1ed9130cea)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-1ed9130cea advisory. fixes CVE-2026-64611 and CVE-2026-64612 fedora2506364 Tenable has extracted the preceding description block directly from the Fedora security...

Fedora 44 : mingw-python-pip (2026-676dfc2776)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-676dfc2776 advisory. Update to pip-26.2. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for thi...

Linux Distros Unpatched Vulnerability : CVE-2026-68319

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pdscore: fix deadlock between reset thread and remove pciresetfunction acquires devicelock before performing the reset. pdscremove is called by the PCI core wit...

Fedora 43 : python-webob (2026-cd35233572)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-cd35233572 advisory. Update to upstream - CVE-2024-42353. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has n...

WordPress XSS2Shell 4.7.0 < 4.7.34 / 4.8.0 < 4.8.29 / 4.9.0 < 4.9.30 / 5.0.0 < 5.0.26 / 5.1.0 < 5.1.23 / 5.2.0 < 5.2.25 / 5.3.0 < 5.3.22 / 5.4.0 < 5.4.20 / 5.5.0 < 5.5.19 / 5.6.0 < 5.6.18 / 5.7.0 < 5.7.16 / 5.8.0 < 5.8.14 / 5.9.0 < 5.9.14 / 6.0.0 < 6.0.13 / 6.1.0 < 6.1.11 / 6.2.0 < 6.2.10 / 6.3.0 < 6.3.9 / 6.4.0 < 6.4.9 / 6.5.0 < 6.5.9 / 6.6.0 < 6.6.6 / 6.7.0 < 6.7.6 / 6.8.0 < 6.8.7 / 6.9.0 < 6.9.6 / 7.0.0 < 7.0.3 Login Screen XSS

The version of WordPress installed on the remote host is 4.7.x prior to 4.7.34, or 4.8.x prior to 4.8.29, or 4.9.x prior to 4.9.30, or 5.0.x prior to 5.0.26, or 5.1.x prior to 5.1.23, or 5.2.x prior to 5.2.25, or 5.3.x prior to 5.3.22, or 5.4.x prior to 5.4.20, or 5.5.x prior to 5.5.19, or 5.6.x...

Linux Distros Unpatched Vulnerability : CVE-2026-68381

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ksmbd: pin conn during async oplock break notification smb2oplockbreaknoti and smb2leasebreaknoti store a ksmbdconn pointer in an async ksmbdwork and then queue...

RHEL 10 : isns-utils (RHSA-2026:53846)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:53846 advisory. The iSNS package contains the daemon and tools to setup a iSNS server, and iSNS client tools. The Internet Storage Name Service iSNS protocol allow...

Security Updates for Microsoft Word Products (August 2026)

The Microsoft Word Products are missing a security update. They are, therefore, affected by multiple vulnerabilities: - Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally. CVE-2026-63527, CVE-2026-64907 - Use after free in Microsoft Office...

Apache Tomcat 9.0.40 < 9.0.117 Improper Encoding or Escaping of Output Vulnerability (CVE-2026-34483)

The version of Tomcat installed on the remote host is 9.0.40 prior to 9.0.117. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat9.0.117security-9 advisory. - Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve component of Apache...

RHEL 8 : resource-agents (RHSA-2026:53364)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:53364 advisory. The resource-agents packages provide the Pacemaker and RGManager service managers with a set of scripts. These scripts interface with several servic...

RHEL 8 : fence-agents (RHSA-2026:53363)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:53363 advisory. The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable...

RHEL 9 : fence-agents (RHSA-2026:53365)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:53365 advisory. The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable...

Linux Distros Unpatched Vulnerability : CVE-2026-68358

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - hwmon: nzxt-kraken3 Stop device IO before calling hidhwstop Calling hidhwstop does not stop the device IO. This results in a race condition between hidinputrepo...

KB5120418: Windows 10 Version 1607 / Windows Server 2016 Security Update (August 2026)

The remote Windows host is missing security update 5120418. It is, therefore, affected by multiple vulnerabilities - Stack-based buffer overflow in Windows DNS allows an unauthorized attacker to execute code over a network. CVE-2026-62878 - Use after free in Windows Deployment Services allows an...