Linux Distros Unpatched Vulnerability : CVE-2026-73144

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - svxlink - None Ubuntu Linux - GHSA-qccg-7pw6-787v: FRN module: unbounded memory growth CVE-2026-73144 Note that Nessus relies on the presence of...

Windows Package Manager (WinGet) < 1.29.280 Elevation of Privilege (CVE-2026-68821)

The version of Windows Package Manager WinGet installed on the remote host is prior to 1.29.280. It is, therefore, affected by an elevation of privilege vulnerability: - An elevation of privilege vulnerability exists in Windows Package Manager that allows a local attacker with low privileges to...

Linux Distros Unpatched Vulnerability : CVE-2026-72694

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in MRTG. When the MRTG daemon is started as a root user and subsequently drops privileges, a local, low-privileged attacker can exploit a...

Security Update for Microsoft Power BI Report Server (August 2026)

The Microsoft Power BI Report Server on the remote host is missing the February 2026 security update. It is, therefore, affected by an RCE vulnerability. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 809...

Fedora 43 : mingw-gstreamer1-plugins-good (2026-1e22d3b0bf)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-1e22d3b0bf advisory. Backport fix for CVE-2026-5056. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

ImageMagick < 6.9.13-51 / 7.x < 7.1.2-26 Heap Buffer Over-write (CVE-2026-62343)

The remote host has a version of ImageMagick installed that is prior to 6.9.13-51 or 7.x prior to 7.1.2-26. It is, therefore, affected by a heap buffer over-write vulnerability: - An invalid kernel can cause a heap buffer over-write when performing a morphology operation with a user supplied...

Linux Distros Unpatched Vulnerability : CVE-2026-68311

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: mt76: mt7925: guard link STA in decap offload mt7925stasetdecapoffload iterates over the vif validlinks mask when updating decap offload state for an MLO...

Linux Distros Unpatched Vulnerability : CVE-2026-68091

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HID: wacom: stop hardware after post-start probe failures wacomparseandregister starts HID hardware before registering inputs and initializing pad LEDs/remotes...

MiracleLinux 9 : jackson-annotations, jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base (AXSA:2026-1514:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1514:01 advisory. jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution CVE-2026-54513 jackson-databind: jackson-databind: Arbitrary cod...

Langflow validate/code exec() Remote Code Execution (CVE-2026-0770) (Direct Check)

Binary data langflowvalidatecodercecve20260770.nbin...

MiracleLinux 9 : glib2-2.68.4-19.el9_8.2 (AXSA:2026-1511:12)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1511:12 advisory. glib: integer underflow in gio/gdbusintrospection.c via gdbusnodeinfonewforxml CVE-2026-58016 Tenable has extracted the preceding description block directly...

Linux Distros Unpatched Vulnerability : CVE-2026-68290

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rds: tcp: unregister sysctl before tearing down listen socket rdstcpexitnet frees the per-netns RDS TCP listen socket via rdstcpkillsock before unregistering th...

RockyLinux 10 : libarchive (RLSA-2026:52675)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:52675 advisory. libarchive: Double-Free Vulnerability in RAR5 Decompression Logic via dangling filteredbuf pointer in initunpack CVE-2026-14164 Tenable has extracted the...

Debian dsa-6430 : postfix - security update

The remote Debian 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6430 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6430-1 [email protected] https://www.debian.org/security/...

Photon OS 5.0: Protobuf PHSA-2026-5.0-92-0949

An update of the protobuf package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-92-0949. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Linux Distros Unpatched Vulnerability : CVE-2026-72568

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An out-of-bounds read vulnerability in Redis through 8.8.1 allows an adjacent unauthenticated attacker to cause denial of service or information disclosure by...

Oracle Linux 10 : kernel (ELSA-2026-34911)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-34911 advisory. - crypto: ccp - copy IV using skcipher ivsize CKI Backport Bot RHEL-188463 CVE-2026-53016 - futex/requeue: Revert 'Prevent NULL pointer dereference i...

Linux Distros Unpatched Vulnerability : CVE-2026-68178

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - misc: nsm: pin the module while the device is open miscopen installs a misc driver's file operations with fopsget, which pins fileoperations::owner before...

SUSE SLES15 Security Update : openssl-1_1-livepatches (SUSE-SU-2026:3533-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2026:3533-1 advisory. - 'HollowByte' DoS via attacker-controlled memory allocation bsc1271712, bsc1271713. Tenable has extracted the preceding description block directly fro...

Oracle Linux 7 : evince (ELSA-2026-41904)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-41904 advisory. 3.28.2-10.0.1 - Fix CVE-2026-46529 Orabug: 39757172 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Not...

Linux Distros Unpatched Vulnerability : CVE-2026-68292

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ice: prevent tstamp ring allocation for non-PF VSI types The pf-txtimetxqs bitmap tracks which Tx queues have ETF Earliest TxTime First offload enabled. This...

Security Updates for Microsoft Outlook Products (August 2026)

The Microsoft Outlook Products are missing a security update. They are, therefore, affected by multiple vulnerabilities: - Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. CVE-2026-70329 - Heap-based buffer overflow in...

Linux Distros Unpatched Vulnerability : CVE-2026-68346

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: hda: cs35l41: validate and free ACPI mute object cs35l41getacpimutestate evaluates a DSM method to get the ACPI mute state and reads the first byte from t...

Linux Distros Unpatched Vulnerability : CVE-2026-73145

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - svxlink - None Ubuntu Linux - GHSA-58ph-q79f-7x9x: HTTP server: unbounded request accumulation CVE-2026-73145 Note that Nessus relies on the...

Fedora 43 : mingw-python-pip (2026-f7dddb6162)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-f7dddb6162 advisory. Update to pip-26.2. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for thi...

RHEL 8 : fence-agents (RHSA-2026:53363)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:53363 advisory. The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable...

RHEL 9 : fence-agents (RHSA-2026:53365)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:53365 advisory. The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable...

RockyLinux 10 : vim (RLSA-2026:38509)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:38509 advisory. vim: command injection when decompressing .tgz archives CVE-2026-46483 vim: Vim: Arbitrary Code Execution via crafted directory names CVE-2026-47162 vi...

Fedora 43 : p11-kit (2026-e281fdcb69)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-e281fdcb69 advisory. rpc: guard against overflow when decoding nested attributes CVE-2026-18938 Only affects 32 bit systems Tenable has extracted the preceding description block...

Linux Distros Unpatched Vulnerability : CVE-2026-73153

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - svxlink - None Ubuntu Linux - GHSA-624p-cp8x-6hp6: EchoLink RTCP/SDES: out-of-bounds read CVE-2026-73153 Note that Nessus relies on the presence ...

SUSE SLES12 Security Update : gd (SUSE-SU-2026:3538-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:3538-1 advisory. This update for gd fixes the following issue: - CVE-2026-9672: security issues in libgd bsc1273101. Tenable has extracted the preceding description blo...

Linux Distros Unpatched Vulnerability : CVE-2026-68358

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - hwmon: nzxt-kraken3 Stop device IO before calling hidhwstop Calling hidhwstop does not stop the device IO. This results in a race condition between hidinputrepo...

RHEL 10 : udisks2 (RHSA-2026:53435)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:53435 advisory. The Udisks project provides a daemon, tools, and libraries to access and manipulate disks, storage devices, and technologies. Security Fixes:...

Linux Distros Unpatched Vulnerability : CVE-2026-68173

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ublk: wait on ublkdevready instead of ub-completion ub-completion is only re-armed by a successful STARTUSERRECOVERY. If the ublk server sends ENDUSERRECOVERY...

KB5121003: Windows 11 Version 24H2 / Windows 11 Version 25H2 Security Update (August 2026)

The remote Windows host is missing security update 5121003 or hotpatch 5120994. It is, therefore, affected by multiple vulnerabilities - Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network. CVE-2026-62815 - Improper neutralization of special elements us...

Oracle Linux 9 : postgresql (ELSA-2026-52395)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-52395 advisory. - Apply patch for CVE-2026-6479 in prep section - Resolves: CVE-2026-6479 - Backport fix for CVE-2026-6479 from PostgreSQL 14.23 SSL/GSS init causes denial of...

Linux Distros Unpatched Vulnerability : CVE-2026-73148

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - svxlink - None Ubuntu Linux - GHSA-6wgq-wg3w-jgvx: svxreflector: use-after-free write via dangling JSON reference CVE-2026-73148 Note that Nessus...

Debian dsa-6429 : caddy - security update

The remote Debian 13 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-6429 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6429-1 [email protected] https://www.debian.org/securit...

Google Chrome < 151.0.7922.137 Multiple Vulnerabilities

The version of Google Chrome installed on the remote Windows host is prior to 151.0.7922.137. It is, therefore, affected by multiple vulnerabilities as referenced in the 202608stable-channel-update-for-desktop01815628406 advisory. - Use after free in Blink. CVE-2026-19560 - Use after free in V8...

Security Updates for Microsoft Office Products (August 2026)

The Microsoft Office Products are missing a security update. They are, therefore, affected by multiple vulnerabilities: - Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. CVE-2026-63513, CVE-2026-63533, CVE-2026-65661 - Integer overflow or...

KB5120418: Windows 10 Version 1607 / Windows Server 2016 Security Update (August 2026)

The remote Windows host is missing security update 5120418. It is, therefore, affected by multiple vulnerabilities - Stack-based buffer overflow in Windows DNS allows an unauthorized attacker to execute code over a network. CVE-2026-62878 - Use after free in Windows Deployment Services allows an...

Apache Tomcat 9.0.116 < 9.0.117 Missing Encryption of Sensitive Data Vulnerability (CVE-2026-34486)

The version of Tomcat installed on the remote host is 9.0.116 prior to 9.0.117. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat9.0.117security-9 advisory. - Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146...

Oracle Linux 9 : libarchive (ELSA-2026-52674)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-52674 advisory. - Related: CVE-2026-14164 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus has not test...

Zoom Workplace VDI Client < 7.0.11 Vulnerability (ZSB-26018)

The version of Zoom Workplace VDI Client installed on the remote host is prior to 7.0.11. It is, therefore, affected by a vulnerability as referenced in the ZSB-26018 advisory. - Path traversal in Zoom VDI Client and Plugins may allow an authenticated user to conduct information disclosure via...

MiracleLinux 9 : nodejs:22 (AXSA:2026-1513:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1513:01 advisory. ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input CVE-2026-42338 undici: undici: Denial of Service due to...

KB5120386: Windows Server 2012 Security Update (August 2026)

The remote Windows host is missing security update 5120386. It is, therefore, affected by multiple vulnerabilities - Stack-based buffer overflow in Windows DNS allows an unauthorized attacker to execute code over a network. CVE-2026-62878 - Use after free in Windows Deployment Services allows an...

ImageMagick 7.x < 7.1.2-27 Multiple Vulnerabilities

The remote host has a version of ImageMagick 7.x installed that is prior to 7.1.2-27. It is, therefore, affected by multiple vulnerabilities: - The BGR decoder does not check for an end-of-file in every location so a crafted image could result in a heap buffer over-read. CVE-2026-64685 - A heap...

Security Update for Microsoft .NET Core SDK (August 2026)

The Microsoft .NET Core SDK installations on the remote host are missing a security update. It is, therefore, affected by a vulnerability as referenced in the vendor advisory. - .NET Elevation of Privilege Vulnerability CVE-2026-58641, CVE-2026-62871, CVE-2026-62886, CVE-2026-62909 - .NET Securit...

RockyLinux 8 : kernel-rt (RLSA-2026:52761)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:52761 advisory. kernel: iio: event: Fix event FIFO reset race CVE-2026-64496 Tenable has extracted the preceding description block directly from the RockyLinux security advisory...

Oracle Linux 7 : libarchive (ELSA-2026-8517)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-8517 advisory. - Fix CVE-2026-4424 CVE-2026-5121 Orabug: 39219508 Tenable has extracted the preceding description block directly from the Oracle Linux security...