Linux Distros Unpatched Vulnerability : CVE-2026-119742

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nagios XI before 2026R2 contains an OS command injection vulnerability in the MIB upload feature where the installmib function in mibs.php sanitizes uploaded...

MiracleLinux 8 : freerdp-2.11.7-15.el8_10 (AXSA:2026-2253:34)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2253:34 advisory. freerdp: FreeRDP: Denial of Service via uninitialized progressive tile handling CVE-2026-109242 freerdp: freerdp: Denial of Service via heap-based...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: nginx (UTSA-2026-150447)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150447 advisory. A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: freeipmi (UTSA-2026-150490)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150490 advisory. FreeIPMI before 1.6.19 has a stack-based buffer overflow in ipmiseloemfujitsugetselentrylongtext in libfreeipmi/sel/ipmi-sel-string-fujitsu-irmc-common.c via malform...

Unity Linux 20.1060a / 20.1070a Security Update: wireshark (UTSA-2026-150477)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150477 advisory. ESS protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service Tenable has extracted the preceding description block directly from the...

Linux Distros Unpatched Vulnerability : CVE-2026-121996

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A length validation flaw in gdbserver's agent-expression parser allows an unauthenticated remote attacker to read uninitialized heap memory from the gdbserver...

SUSE SLES15: aws-nitro-enclaves-binaryblobs-upstream / aws-nitro-enclaves-cli / etc (SUSE-SU-2026:5066-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:5066-1 advisory. - CVE-2026-93599: rustls-webpki: Denial of service via panic on malformed CRL BIT STRING bsc1282250. - CVE-2026-93600: rustls-webpk...

Fedora 46 : python-PyMuPDF (2026-4a2913750e)

The remote Fedora 46 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-4a2913750e advisory. Automatic update for python-PyMuPDF-1.28.2-2.fc46. Changelog Wed Nov 4 2026 Michael J Gruber - 1.28.2-2 - fix CVE-2026-120752 rhbz2567075 rhbz256707...

CentOS Linux 7.9 [CIQ] Security Update: dovecot / dovecot-devel / dovecot-mysql / dovecot-pgsql / etc Multiple Vulnerabilities (ciqsa-2026_1758)

The CentOS Linux 7.9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261758 advisory. This advisory aggregates security fixes for the dovecot SRPM in CIQ CentOS Bridge 7.9. It addresses 11 CVEs: CVE-2019-11500, CVE-2026-27858,...

Rocky Linux 9.6 [TuxCare] Security Update: pki-jackson-databind (ALMALINUX9.6:CLSA-2026:1793886324)

The Rocky Linux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793886324 advisory. - jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, ev...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: freeipmi (UTSA-2026-150472)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150472 advisory. ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer over-read in ipmioemfujitsugetselentrylongtext in ipmi-oem/ipmi-oem-fujitsu.c when a BMC provides a short...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: nginx (UTSA-2026-150439)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150439 advisory. A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: unbound (UTSA-2026-150452)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150452 advisory. In NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap buffer overflow during the RRSet...

AlmaLinux 9.6 [TuxCare] Security Update: pki-jackson-databind (ALMALINUX9.6:CLSA-2026:1793886324)

The AlmaLinux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793886324 advisory. - jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even...

Fedora 45 : laszip (2026-820191aab4)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-820191aab4 advisory. Update to git a446a0c, fixes CVE-2026-110603. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...

Linux Distros Unpatched Vulnerability : CVE-2026-121964

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.32.2 contains a heap-based buffer overflow in the RD Gateway RPC client, where rpcclientrecvfragment writes BINDACK and ALTERCONTEXTRESP...

Linux Distros Unpatched Vulnerability : CVE-2026-121551

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PostfixAdmin through 4.0.5 contains a stored cross-site scripting vulnerability that allows authenticated mailbox users to inject script by creating a TOTP...

Linux Distros Unpatched Vulnerability : CVE-2026-121542

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Docker Buildx versions v0.19.0 through v0.38.0, an untrusted Bake definition may expose files accessible to the Buildx client without the expected fs.read...

SUSE SLES15 Security Update : nodejs22 (SUSE-SU-2026:5036-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:5036-1 advisory. - CVE-2026-105481: Keep-alive socket process a response that was written before the request was sent bsc1286565. - CVE-2026-105482:...

Linux Distros Unpatched Vulnerability : CVE-2026-121961

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.32.2 contains a use-after-free vulnerability in the freerdp-proxy DRDYNVC tracker when intercepting the drdynvc channel. A malicious target...

SUSE SLED15: rsyslog / rsyslog-module-gssapi / rsyslog-module-gtls / etc (SUSE-SU-2026:5082-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:5082-1 advisory. - CVE-2026-92709: omfile dynaFile template uses a value influenced by untrusted input as a path component without...

Rocky Linux 9.6 [TuxCare] Security Update: expat / expat-devel / expat-static (ALMALINUX9.6:CLSA-2026:1793768228)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793768228 advisory. - libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XMLParserReset zeroes the direct byte count but never...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: nginx (UTSA-2026-150422)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150422 advisory. NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpcoremodule module. When asynchronous file I/O AIO is enabled in certain configurations, processin...

Fedora 43 : roundcubemail (2026-db7e033531)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-db7e033531 advisory. Version 1.6.20 - Security: Fix IMAP command injection via CRLF in uid parameter of mail/headers and mail/viewsource action - Security: Fix bug where...

Fedora 44 : 3proxy (2026-1b5ddbaeb5)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-1b5ddbaeb5 advisory. Update to 1.0.2 rhbz2560278 ---- Patch CVE-2026-109438 rhbz2553107, rhbz2553106 Tenable has extracted the preceding description block directly from the Fedor...

MiracleLinux 9 : kernel-5.14.0-687.64.1.el9_8 (AXSA:2026-2261:117)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2261:117 advisory. kernel: sctp: stream: fully roll back denied add-stream state CVE-2026-52929 kernel: ipv6: sit: reload inner IPv6 header after GSO offloads...

Rocky Linux 9.6 [CIQ] Security Update: openssh / openssh-askpass / openssh-clients / openssh-keycat / etc Multiple Vulnerabilities (ciqsa-2026_1755)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261755 advisory. This advisory aggregates security fixes for the openssh SRPM in CIQ LTS 9.6. It addresses 2 CVEs: CVE-2026-73282, CVE-2026-60001. Tenable has extracted t...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: fetchmail (UTSA-2026-150484)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150484 advisory. A stack-based buffer overflow flaw was found in fetchmail when built with NTLM support. A malicious or compromised mail server advertising NTLM authentication can se...

Oracle Linux 8 : perl-YAML:1.24 (ELSA-2026-93471)

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-93471 advisory. - CVE-2017-20285 perl-YAML:1.24/perl-YAML: perl-yaml: Arbitrary destructor method execution via crafted YAML document destructor method execution via...

openSUSE 16: warewulf4 / warewulf4-dracut / warewulf4-man / warewulf4-overlay / etc (openSUSE-SU-2026:22221-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22221-1 advisory. Changes in warewulf4: - Update google.golang.org/grpc to which fixes: CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing...

Debian dla-4885 : libtrapperkeeper-authorization-clojure - security update

The remote Debian 12 host has a package installed that is affected by a vulnerability as referenced in the dla-4885 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4885-1 [email protected] https://www.debian.org/lts/security/...

SUSE SLES15 Security Update : kernel (Live Patch 21 for SUSE Linux Enterprise 15 SP7) (SUSE-SU-2026:5085-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:5085-1 advisory. This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.53.81 fixes various security issues: The following security issues were fixed: -...

Unity Linux 20.1070a Security Update: cockpit (UTSA-2026-150344)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150344 advisory. A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowi...

Unity Linux 20.1060e Security Update: containerd (UTSA-2026-150510)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150510 advisory. containerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a crafted OCI index graph can force very high CPU/memory...

Linux Distros Unpatched Vulnerability : CVE-2026-115732

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in the certificate-name matching of trapperkeeper-authorization, as used by Puppet Server, in the affected products, allows a client tha...

RHEL 9 : .NET 10.0 (RHSA-2026:92432)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:92432 advisory. .NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly...

Linux Distros Unpatched Vulnerability : CVE-2026-108949

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Denial of Service via OOM vulnerability in Apache ActiveMQ, ActiveMQ Broker. An authenticated OpenWire client that sends a ConsumerInfo for a temporary...

ESXi 6.5 / 6.7 / 7.0 (VMSA-2022-0001.2)

The version of ESXi installed on the remote host is prior to 6.5, 6.7, 7.0. It is, therefore, affected by a vulnerability as referenced in the VMSA-2022-0001.2 advisory. - VMware ESXi 7.0, 6.7 before ESXi670-202111101-SG and 6.5 before ESXi650-202110101-SG, VMware Workstation 16.2.0 and VMware...

AlmaLinux 9 : webkit2gtk3 (ALSA-2026:95194)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:95194 advisory. chromium-browser: skia: chromium-browser: skia: Use after free in Skia CVE-2026-85049 chromium-browser: skia: Skia: Cross-origin data disclosure via...

Linux Distros Unpatched Vulnerability : CVE-2026-119673

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - MongoDB Database Tools mongofiles does not resolve existing parent-directory symlinks when validating output paths for getregex. An unauthorized user who can bo...

Fedora 44 : python-boto3 / python-botocore (2026-c23d8c6e6b)

The remote Fedora 44 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-c23d8c6e6b advisory. Latest updates. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...

Unity Linux 20.1070a Security Update: python3.11 (UTSA-2026-150499)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150499 advisory. Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata. You are...

SUSE SLES15: nv-prefer-signed-open-driver-G07 / etc (SUSE-SU-2026:5096-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:5096-1 advisory. - Update non-CUDA variant to 595.112.07 bsc1286763. - Fix build against renamed -nvidia64kb flavor bsc1282794. - Fix build against...

Rocky Linux 8 [CIQ] Security Update: raptor2 / raptor2-debuginfo / raptor2-debugsource / raptor2-devel (crlsa-2026_94519)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202694519 advisory. raptor2: raptor2: arbitrary code execution via heap-based buffer overflow in language tag handling CVE-2025-71436 Tenable has extracted the preceding description...

RHEL 9 : .NET 9.0 (RHSA-2026:92429)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:92429 advisory. .NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: freeipmi (UTSA-2026-150476)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150476 advisory. ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in getdellsysteminfoidracinfo in ipmi-oem/ipmi-oem-dell.c idrac-info subcommand to dell...

RockyLinux 8 : mod_auth_openidc:2.3 (RLSA-2023:6940)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2023:6940 advisory. modauthopenidc: Open Redirect in oidcvalidateredirecturl using tab character CVE-2022-23527 modauthopenidc: NULL pointer dereference when OIDCStripCookie...

Linux Distros Unpatched Vulnerability : CVE-2026-119672

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - MongoDB Database Tools mongofiles uses a database-stored GridFS filename as the output destination for getid when --local is not specified. A user who can modif...

Linux Distros Unpatched Vulnerability : CVE-2026-121955

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.32.2 contains a use-after-free vulnerability in EmulateSCardReleaseContext that frees the emulated SCardContext before its worker thread is...

openSUSE 16 Security Update : cadvisor (openSUSE-SU-2026:22218-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22218-1 advisory. Changes in cadvisor: - update vendor.tar to address: bsc1288588, CVE-2026-116591: github.com/klauspost/compress/zstd: crafted 27 KB two-block zs...