MiracleLinux 9 : cockpit-356.4-1.el9_8.ML.1 (AXSA:2026-2267:16)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2267:16 advisory. cockpit: Cockpit: Denial of Service in cockpit-ws due to URL-root handling without a trailing slash CVE-2026-91147 cockpit: Cockpit: Denial of Servi...

Linux Distros Unpatched Vulnerability : CVE-2026-115567

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Tokio is a runtime for writing applications with Rust. In 1.54.0, a race condition between tokio::time::Interval::polltick including .tick.await and the...

Linux Distros Unpatched Vulnerability : CVE-2026-115448

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uncontrolled recursion in Apache ZooKeeper. The server serializes its data tree to a snapshot by recursing one stack frame per znode level, with no depth bound....

Linux Distros Unpatched Vulnerability : CVE-2026-123268

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A security vulnerability has been detected in libyal libvmdk up to 3fdd7839758e9f44ef95e1dfccde8552b860a4fc. Affected is the function...

Linux Distros Unpatched Vulnerability : CVE-2026-100302

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Allocation of Resources Without Limits or Throttling in the multiRead request handler of Apache ZooKeeper allows a remote attacker to crash the server denial of...

Linux Distros Unpatched Vulnerability : CVE-2026-123202

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libnxml before 0.18.6 contains a stack-based buffer overflow vulnerability in src/nxmlparser.c that allows remote attackers to write past a 1024-byte stack buff...

Linux Distros Unpatched Vulnerability : CVE-2026-92697

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, the NetFlow v9 collector calls strlen on an attacker-controlled...

Linux Distros Unpatched Vulnerability : CVE-2026-108387

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.2, attacker- controlled data from several binary format plugins coul...

Linux Distros Unpatched Vulnerability : CVE-2026-104714

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Concurrent execution using shared resource with improper synchronization 'race condition' vulnerability in Apache Struts. Where a localized message formats a da...

Oracle Linux 8 : ovirt-engine-wildfly (ELSA-2026-500570)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-500570 advisory. ovirt-engine-wildfly 24.0.1-4 - Update all bundled CXF release artifacts to 3.6.13 ovirt-engine-wildfly-overlay 24.0.1-4 - Require WildFly 24.0.1-4...

MiracleLinux 9 : dotnet9.0-9.0.123-1.el9_8.ML.1 (AXSA:2026-2272:23)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-2272:23 advisory. dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnerability CVE-2026-114148 Bug Fixes and Enhancements: Update .NET 9.0 t...

Oracle Linux 9 : delve (ELSA-2026-95518)

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-95518 advisory. 1.26.1-2.0.1 - Disable DWARF compression which has issues Alex Burmashev 1.26.1-2 - Add GOMODCACHE in check - Resolves: RHEL-289481 Tenable has...

MiracleLinux 9 : delve-1.26.1-2.el9_8 (AXSA:2026-2281:03)

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-2281:03 advisory. crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references CVE-2026-97031 crypto/x509: golang: crypto/x509:...

Oracle Linux 8 : gdb (ELSA-2026-73425)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-73425 advisory. 8.2-20.1.0.1 - Import gdb-8.2-20.1.el810 and forward-port Oracle changes. Reviewed-by: Jose E. Marchesi Oracle history: Thu Dec 7 2023 Cupertino Miranda -...

EulerOS 2.0 SP12 : kernel (EulerOS-SA-2026-4411)

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : vt: stabilize tty reference in kbdkeycode with ttyportttygetCVE-2026-74675 udp: fix potential use-after-free in tunnel segmentationCVE-2026-74705...

Fedora 43 : openbao (2026-5f701776a6)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-5f701776a6 advisory. Update to upstream 2.6.5 which includes a number of security fixes, see https://github.com/openbao/openbao/releases/v2.6.5. Also fixes golang CVE-2026-111943...

Rocky Linux 10.2 [CIQ] Security Update: freerdp / freerdp-debuginfo / freerdp-debugsource / freerdp-devel / etc Multiple Vulnerabilities (crlsa-2026_94514)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202694514 advisory. freerdp: FreeRDP: Denial of Service via uninitialized progressive tile handling CVE-2026-109242 freerdp: FreeRDP 3.0.0-beta1 before 3.32.0 Use-After-Fr...

RHEL 8 : .NET 11.0 (RHSA-2026:92511)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:92511 advisory. .NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: rsyslog (UTSA-2026-150343)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150343 advisory. A flaw was found in rsyslog. An unauthenticated remote attacker can trigger a heap buffer overflow in the RainerScript replace function by sending specially crafted...

SUSE SLES15: tomcat10 / tomcat10-admin-webapps / tomcat10-el-5_0-api / etc (SUSE-SU-2026:5073-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:5073-1 advisory. - CVE-2026-74048: Cryptographic policy bypass via FIPS activation failure bsc1286502. - CVE-2026-74049: Jasper JSTL plug-in...

SUSE SLES15: gvfs / gvfs-backend-afc / gvfs-backend-samba / gvfs-backends / etc (SUSE-SU-2026:5080-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:5080-1 advisory. This update for gvfs fixes the following issue: - CVE-2026-88924: gvfs-admin socket ownership race condition allows local users to change th...

AlmaLinux 8 : kernel-rt (ALSA-2026:95100)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:95100 advisory. kernel: sctp: stream: fully roll back denied add-stream state CVE-2026-52929 kernel: net/smc: fix UAF in smccdcrxhandler by pinning the socket...

Linux Distros Unpatched Vulnerability : CVE-2026-114550

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execut...

Rocky Linux 9.6 [TuxCare] Security Update: containernetworking-plugins (ALMALINUX9.6:CLSA-2026:1793885412)

The Rocky Linux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793885412 advisory. - Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that coul...

Unity Linux 20.1070a Security Update: python3.11 (UTSA-2026-150501)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150501 advisory. Mitgation ofCVE-2026-4519 was incomplete. If the URL contained %action the mitigation could be bypassed for certain browser types the webbrowser.open API could have...

Rocky Linux 8 [CIQ] Security Update: cockpit / cockpit-bridge / cockpit-debuginfo / cockpit-debugsource / etc Multiple Vulnerabilities (crlsa-2026_94485)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202694485 advisory. cockpit: Cockpit: Denial of Service in cockpit-ws due to URL-root handling without a trailing slash CVE-2026-91147 cockpit-ws: cockpit: cockpit-ws:...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: libreswan (UTSA-2026-150485)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150485 advisory. Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of inconsistency within the IKEv2 state...

CentOS Linux 8 [TuxCare] Security Update: squid (CENTOS-STREAM8:CLSA-2026:1793918953)

The CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1793918953 advisory. - Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of behavioral workflow bug, Squid is...

MiracleLinux 9 : opentelemetry-collector-0.158.0-2.el9_8 (AXSA:2026-2252:07)

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-2252:07 advisory. net/http: golang: golang: Denial of Service via crafted HTTP Range headers CVE-2026-78667 crypto/tls: golang: crypto/tls: Denial of Service via...

SUSE SLED15: cups / cups-client / cups-config / cups-ddk / cups-devel / libcups2 / etc (SUSE-SU-2026:5078-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:5078-1 advisory. - CVE-2026-41079: crafted SNMP response can lead to stack-based out-of-bounds read and sensitive memory...

Fedora 43 : 3proxy (2026-540af356f2)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-540af356f2 advisory. Update to 1.0.2 rhbz2560278 ---- Patch CVE-2026-109438 rhbz2553107, rhbz2553106 Tenable has extracted the preceding description block directly from the Fedor...

Unity Linux 20.1060a / 20.1070a Security Update: dde-app-services (UTSA-2026-150515)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150515 advisory. libdtkcore/dconfig appid=.. :isValidAppid .. + cleanPath per-uid + savesubpath ,; Tenable has extracted the preceding description block directly from the Unity Linux...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libsoup (UTSA-2026-150431)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150431 advisory. A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing payload, size values passed to GByteArray allocation APIs...

AlmaLinux 9.2 [TuxCare] Security Update: libpng / libpng-devel / libpng-static / libpng-tools (ALMALINUX9.2:CLSA-2026:1793890537)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1793890537 advisory. - Use-after-free in sequential reader when pngreadend called without reading image rows fedora-all CVE-2026-46675 Note that Nessus has not...

Fedora 45 : markdownlint-cli2 (2026-8f8cd892e5)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-8f8cd892e5 advisory. Update Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for these...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: libreswan (UTSA-2026-150495)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150495 advisory. Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another packet retransmit or...

Linux Distros Unpatched Vulnerability : CVE-2026-121604

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wlroots before 0.20.2 contains an out-of-bounds read vulnerability in readsurfaceclass in xwayland/xwm.c that allows local X11 clients to leak compositor heap...

SUSE SLES15 Security Update : python-sqlparse (SUSE-SU-2026:5042-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2026:5042-1 advisory. This update for python-sqlparse fixes the following issue: - CVE-2026-112307: arbitrary code execution via unescaped PHP output formatting bsc1286096...

Linux Distros Unpatched Vulnerability : CVE-2026-121960

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.32.2 contains a denial of service vulnerability in the NLA-enabled shadow server when a CredSSP TSRequest omits negoTokens. Unauthenticated...

Fedora 43 : freetype (2026-dd82a0810d)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-dd82a0810d advisory. This update fixes an integer overflow in FreeType tracked as CVE-2026-49919. Tenable has extracted the preceding description block directly from the Fedora...

Fedora 45 : openbao (2026-fc3fbffe59)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-fc3fbffe59 advisory. Update to upstream 2.6.5 which includes a number of security fixes, see https://github.com/openbao/openbao/releases/v2.6.5. Also fixes golang CVE-2026-111943...

AlmaLinux 9.6 [TuxCare] Security Update: expat / expat-devel / expat-static (ALMALINUX9.6:CLSA-2026:1793768228)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793768228 advisory. - libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XMLParserReset zeroes the direct byte count but never offse...

SUSE SLED15: apache2 / apache2-devel / apache2-event / apache2-manual / etc (SUSE-SU-2026:5077-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:5077-1 advisory. - CVE-2026-42356: deployment of wrong handler allows target of internal redirects from CGI programs to also be...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libsoup (UTSA-2026-150419)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150419 advisory. A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequately cap total message size against the limits ...

CentOS Linux 8 [TuxCare] Security Update: expat / expat-devel / expat-static (CENTOS-STREAM8:CLSA-2026:1793864770)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1793864770 advisory. - libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XMLParserReset zeroes the direct byte count but never...

Linux Distros Unpatched Vulnerability : CVE-2026-121963

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.32.2 contains a use-after-free vulnerability in the asynchronous dynamic rdpsnd channel that allows malicious RDP servers to trigger freed...

Rocky Linux 8 [CIQ] Security Update: freerdp / freerdp-debuginfo / freerdp-debugsource / freerdp-devel / etc Multiple Vulnerabilities (crlsa-2026_94510)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202694510 advisory. freerdp: FreeRDP: Denial of Service via uninitialized progressive tile handling CVE-2026-109242 freerdp: freerdp: Denial of Service via heap-based buffer...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: curl (UTSA-2026-150466)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150466 advisory. When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state...

Unity Linux 20.1060e / 20.1070e Security Update: dtkcore (UTSA-2026-150513)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150513 advisory. libdtkcore/dconfig appid=.. :isValidAppid .. + cleanPath per-uid + savesubpath ,; Tenable has extracted the preceding description block directly from the Unity Linux...

Fedora 43 : rust-app-store-connect (2026-9288162688)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-9288162688 advisory. Rebuilt with the latest Rust dependencies, addressing at least RUSTSEC-2026-0190. Tenable has extracted the preceding description block directly from the...