Mozilla Thunderbird < 158.0.1

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 158.0.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-114 advisory. - Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which...

Atlassian Confluence 9.1.x < 9.2.26 / 9.3.x < 10.2.19 / 11.0.0 (CONFSERVER-104515)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-104515 advisory. - The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength when decoding JSON object property...

Rocky Linux 10.2 [CIQ] Security Update: wireshark / wireshark-cli / wireshark-cli-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_84721)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202684721 advisory. wireshark: Wireshark: Denial of Service via C12.22 protocol dissector crash CVE-2026-76886 wireshark: Wireshark: Denial of Service via RRC protocol...

Unity Linux 20.1070a Security Update: python3.11 (UTSA-2026-141781)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-141781 advisory. An issue was found in the CPython zipfile module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The zipfile module is vulnerable to...

Linux Distros Unpatched Vulnerability : CVE-2026-109786

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In fail2ban 0.10.5 through 1.1.1 before ddd879d, the sshd filter config/filter.d/sshd.conf accepts an on suffix after the host address. Because OpenSSH logs the...

Fedora 44 : dolphin (2026-85f07f4f1b)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-85f07f4f1b advisory. - CVE-2026-110236 Arbitrary command execution via crafted folder name Tenable has extracted the preceding description block directly from the Fedora security...

Linux Distros Unpatched Vulnerability : CVE-2026-109596

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Hugo from v0.162.0 before v0.167.0 contains an improper link resolution vulnerability that lets malicious themes or modules expose files outside their root via...

Linux Distros Unpatched Vulnerability : CVE-2026-79607

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - During Xenstore live update the state record for a Xenstore watch with specified watch depth is written with two bytes missing. This results in an inconsistent...

Linux Distros Unpatched Vulnerability : CVE-2026-113812

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mozilla::CA versions before 20261020 for Perl provide a CA certificate bundle containing a root linked to compromised intermediates. The bundle includes emSign...

Linux Distros Unpatched Vulnerability : CVE-2026-102342

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.3, 4.0.3, and 4.1.4, applications that allow the SVG animate or set elements c...

Atlassian Confluence 7.2.x < 9.2.26 / 9.3.x < 10.2.19 / 11.0.0 (CONFSERVER-104510)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-104510 advisory. - Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before windowSize requests have been made, a...

Linux Distros Unpatched Vulnerability : CVE-2026-109349

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gitoxide gix-pack before 0.75.0 contains a reachable assertion in BytesToEntriesIter::newfromheader: the pack header decoder accepts version 3, but a...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: rabbitmq-java-client (UTSA-2026-142330)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142330 advisory. The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, the AMQP connection tuning...

MiracleLinux 8 : bubblewrap-0.4.0-3.el8_10 (AXSA:2026-2108:01)

The remote MiracleLinux 8 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-2108:01 advisory. bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup CVE-2026-87766 Tenable has extracted the preceding description...

RockyLinux 8 : bind (RLSA-2026:79162)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:79162 advisory. bind9: bind: BIND 9: Denial of Service via 16-bit length truncation in DNS negative cache handling CVE-2026-19667 bind: BIND: Denial of Service via...

Amazon Linux 2023 : bind, bind-chroot, bind-devel (ALAS2023-2026-3221)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3221 advisory. Amazon Linuxvended DNS resolvers shipped with an older DNSSEC root signing key. For hosts configured with DNSSEC validation enabled, this could result in DNS resolution failures, including for names in...

RockyLinux 8 : perl-DBI:1.641 (RLSA-2026:85916)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:85916 advisory. perl-DBI: perl-DBI: Denial of Service via invalid memory read during numeric type casting CVE-2026-88815 Tenable has extracted the preceding description block...

Linux Distros Unpatched Vulnerability : CVE-2026-109955

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Hono from 4.12.4 before 4.13.11 contains a middleware bypass vulnerability in serveStatic that allows unauthenticated attackers to skip prefix middleware by...

Linux Distros Unpatched Vulnerability : CVE-2026-109379

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cockpit CMS 2.14.1 contains an observable timing discrepancy vulnerability that allows unauthenticated attackers to enumerate accounts due to an incomplete timi...

MiracleLinux 9 : emacs-27.2-18.el9_8.3 (AXSA:2026-2110:03)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-2110:03 advisory. emacs: Emacs: arbitrary code execution in Flymake mode CVE-2026-96442 Tenable has extracted the preceding description block directly from the MiracleLinux...

Rocky Linux 9 [CIQ] Security Update: emacs / emacs-common / emacs-common-debuginfo / emacs-debuginfo / etc (crlsa-2026_85245)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202685245 advisory. emacs: Emacs: arbitrary code execution in Flymake mode CVE-2026-96442 Tenable has extracted the preceding description block directly from the CIQ security advisory...

AlmaLinux 10 : emacs (ALSA-2026:84591)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:84591 advisory. emacs: GNU Emacs: Heap over-read leading to information disclosure via crafted image CVE-2026-77219 emacs: emacs: Command injection via crafted filename...

RHEL 8 : libxml2 (RHSA-2026:79120)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:79120 advisory. The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fixes: libxml2: Stack Buffer Overflow i...

RHEL 10 : gvfs (RHSA-2026:85941)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:85941 advisory. GVFS is the GNOME Desktop Virtual File System layer that allows users to easily access local and remote data using File Transfer Protocol...

RockyLinux 9 : tftp (RLSA-2026:80663)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:80663 advisory. tftp: tftp-hpa: Denial of Service due to out-of-bounds read/write in remap engine CVE-2026-85234 Tenable has extracted the preceding description block directly...

RockyLinux 10 : cockpit-machines (RLSA-2026:86971)

The remote RockyLinux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RLSA-2026:86971 advisory. cockpit-machines: cockpit-machines: Sensitive data exposure via command-line arguments CVE-2026-92768 cockpit-machines: cockpit-machines: Sensitive Dat...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS : Squid vulnerabilities (USN-8941-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8941-1 advisory. It was discovered that Squid incorrectly handled certain HTTP Transfer- Encoding headers. An attacker cou...

AlmaLinux 9.2 [TuxCare] Security Update: libsoup / libsoup-devel / libsoup-doc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1792599160)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792599160 advisory. - A flaw was found in libsoup. The soupuridecodedatauri function incorrectly treated base64 data-URI payloads as NUL-terminated...

RockyLinux 8 : librsvg2 (RLSA-2026:86842)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:86842 advisory. librsvg: Use-after-free when XML includes have duplicated entities CVE-2026-96889,RUSTSEC-2026-0305 Tenable has extracted the preceding description block directl...

RHEL 9 : dovecot (RHSA-2026:80825)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:80825 advisory. Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3...

CentOS Linux 8.4 [TuxCare] Security Update: ghostscript / ghostscript-doc / ghostscript-gtk / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1792576567)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1792576567 advisory. - In Artifex Ghostscript through 10.01.0, there is a buffer overflow leading to potential corruption of data internal to the...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libsoup (UTSA-2026-142315)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142315 advisory. A flaw was found in libsoup. A remote attacker, by controlling the method parameter of the soupmessagenew function, could inject arbitrary headers and additional...

RockyLinux 10 : rust-sequoia-sq (RLSA-2026:85848)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:85848 advisory. hickory-resolver: hickory-resolver: DNSSEC validation bypass allows forged DNS records CVE-2026-93657 rustls-webpki: rustls-webpki: Denial of Service v...

AlmaLinux 10 : xorg-x11-server-Xwayland (ALSA-2026:85191)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:85191 advisory. xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling CVE-2026-93516 xorg-x11-server: xorg-x11-server:...

AlmaLinux 9 : xorg-x11-server-Xwayland (ALSA-2026:85193)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:85193 advisory. xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling CVE-2026-93516 xorg-x11-server: xorg-x11-server:...

AlmaLinux 8 : xorg-x11-server-Xwayland (ALSA-2026:86907)

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:86907 advisory. xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling CVE-2026-93516 xorg-x11-server: xorg-x11-server:...

RHEL 8 : xorg-x11-server-Xwayland (RHSA-2026:86907)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:86907 advisory. Xwayland is an X server for running X clients under Wayland. Security Fixes: xorg-x11-server: xorg-x11-server: Arbitrary code execution via...

RockyLinux 9 : php (RLSA-2026:87151)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:87151 advisory. php: php: Denial of Service via unbounded recursion in SOAP parser CVE-2026-91765 php: OOM bailout during request parsing leads to memory corruption and...

AlmaLinux 9.6 [TuxCare] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1792602059)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792602059 advisory. - PHP uses longjmp for out-of-memory OOM errors to exit the current context and abort handling of the request. Some contexts may not...

Debian dla-4848 : libapache2-mod-php8.2 - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4848 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4848-1 [email protected]...

Rocky Linux 9.6 [TuxCare] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1792602059)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792602059 advisory. - PHP uses longjmp for out-of-memory OOM errors to exit the current context and abort handling of the request. Some contexts may n...

GLSA-202610-02 : PHP: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202610-02 PHP: Multiple Vulnerabilities Multiple vulnerabilities have been discovered in PHP. Please review the CVE identifiers referenced below for details. Tenable has extracted the preceding description block directly from the...

Oracle Linux 10 : php (ELSA-2026-87070)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-87070 advisory. 8.3.36-1 - rebase to 8.3.36 8.3.35-1 - rebase to 8.3.35 Tenable has extracted the preceding description block directly from the Oracle Linux security...

RHEL 9 : openssh (RHSA-2026:85958)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:85958 advisory. OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files...

RHCOS 4 : OpenShift Container Platform 4.22.18 (RHSA-2026:79150)

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:79150 advisory. - golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVE-2026-3982...

RHEL 8 : pcre2 (RHSA-2026:81613)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:81613 advisory. The pcre2 package contains a new generation of the Perl Compatible Regular Expression libraries for implementing regular expression pattern...

Linux Distros Unpatched Vulnerability : CVE-2026-113159

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper access control in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially leak sensitive information via a crafted HT...

Linux Distros Unpatched Vulnerability : CVE-2026-113078

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper input validation in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the...

Linux Distros Unpatched Vulnerability : CVE-2026-113330

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in CustomTabs in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the...

Linux Distros Unpatched Vulnerability : CVE-2026-113270

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Internals in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML...