Linux Distros Unpatched Vulnerability : CVE-2026-98066

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: caiaq: Fix potential double-free at error path The fix for caiaq driver's resource management to handle the errors tries to release the resources in a...

Linux Distros Unpatched Vulnerability : CVE-2026-61837

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.3.3, 4.2.9, 4.1.14, and 4.0.23, AMQP 1.0 management GET /bindings exposes full binding topology...

Linux Distros Unpatched Vulnerability : CVE-2026-97619

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iouring/rw: end write accounting from -kicomplete Commit b000145e9907 moved both the fsnotify calls and the write accounting out of the kiocb completion handler...

Linux Distros Unpatched Vulnerability : CVE-2026-98064

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Fix NULL-ptr-deref when showing a void BTF type btfmodifiershow resolves the modifier and then calls btftypeopst-show unconditionally. For the void type...

Linux Distros Unpatched Vulnerability : CVE-2026-97904

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - cpufreq: initialize policy rwsem before sysfs publication cpufreqpolicyalloc initializes policy-rwsem after kobjectinitandadd has created the policy sysfs...

Linux Distros Unpatched Vulnerability : CVE-2026-67410

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.3.3 and 4.2.9, OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint CWE-200. wh...

Linux Distros Unpatched Vulnerability : CVE-2026-97923

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tracing: Free histogram the var ref when its initialization fails createvarref allocates a VARREF histfield and then calls initvarref to fill it in. When that...

Linux Distros Unpatched Vulnerability : CVE-2026-97984

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: ipv6: Fix UDP length overflow with PMTU discover and big MTU This commit bounds cork-base.fragsize to IP6MAXMTU for UDP sockets to avoid a possible overflo...

openSUSE 16 Security Update : libX11 (openSUSE-SU-2026:21908-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21908-1 advisory. This update for libX11 fixes the following issue: - CVE-2026-88806: XkbGetMap Reply Heap-based Buffer Overflow bsc1280910. Tenable has extracted the...

Linux Distros Unpatched Vulnerability : CVE-2026-98004

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iommu/riscv: Serialize command queue publishing Serialize command queue publishing so software producer state advances only after a command is written and the...

Linux Distros Unpatched Vulnerability : CVE-2026-97581

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity preparetileinfobuffer writes one entry per tile into the tilesizes DMA buffer, sized...

Linux Distros Unpatched Vulnerability : CVE-2026-88366

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NanoSVG commit 239e102ec contains an incorrect numeric conversion vulnerability in nsvgpathArcTo when parsing SVG arc commands. A specially crafted SVG document...

Linux Distros Unpatched Vulnerability : CVE-2026-98025

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: usb: cx82310eth: drop URB after 0xffff reboot sentinel to prevent partialdata heap overflow The 0xffff length sentinel detects a router reboot and schedule...

Linux Distros Unpatched Vulnerability : CVE-2026-67412

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RabbitMQ is a messaging and streaming broker. From 3.13.0 until 4.3.3, 4.2.9 , 4.1.14, 4.0.24, and 3.13.18, Federation upstream in RabbitMQ skips vhost...

Linux Distros Unpatched Vulnerability : CVE-2026-95832

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Neutralization of Special Elements in Output Used by a Downstream Component in the colour control escape code handler in kitty from 0.47.3 before 0.49....

Linux Distros Unpatched Vulnerability : CVE-2026-98083

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - btrfs: fix transaction use-after-free in raid stripe insertion If allocation of a RAID stripe extent fails, btrfsinsertoneraidextent aborts and ends the...

Linux Distros Unpatched Vulnerability : CVE-2026-98030

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: dsa: bcmsf2: bound the CFP rule dump by the caller's buffer size bcmsf2cfprulegetall walks the whole cfp.unique bitmap into rulelocs without consulting...

Linux Distros Unpatched Vulnerability : CVE-2026-97903

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - exit: hold a reference to threadpid across procflushpid Commit 0a36bad01731 releasetask: kill the no longer needed get/putpidthreadpid removed the reference...

Linux Distros Unpatched Vulnerability : CVE-2026-66078

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6, protected tag bypass via bulk-delete. dELETE...

Linux Distros Unpatched Vulnerability : CVE-2026-98125

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb/client: fix stale page cache in insert/collapse range smb3insertrange and smb3collapserange use truncatepagecacherange to invalidate the affected page cache...

Linux Distros Unpatched Vulnerability : CVE-2026-97973

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: macb: destroy the phylink instance on the probe error path macbmiiinit creates a phylink instance on both of its success paths, but the probe unwind frees...

Fedora 44 : webkitgtk (2026-40db9b80a2)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-40db9b80a2 advisory. Update to 2.54.0: Switch web process compositor to use Skia instead of TextureMapper. Improved damage handling that is now also used during the...

Linux Distros Unpatched Vulnerability : CVE-2026-98033

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Preserve inner map identity in callback frames Callback frame constructors initialize map-typed argument registers with markregknownzero and then restore...

Linux Distros Unpatched Vulnerability : CVE-2026-97928

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amdgpu: skip the VMID 0 flush for VRAM Clear-on-release only runs on VRAM, which amdgputtmmapbuffer reaches via its direct MC address without programming a...

SUSE SLES11: kernel-default / kernel-default-base / kernel-ec2 / kernel-ec2-base / etc (SUSE-SU-2026:1130-1)

The remote SUSE Linux SLES11 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1130-1 advisory. The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security bugfixes. The following security bugs were fixed: -...

Linux Distros Unpatched Vulnerability : CVE-2026-97548

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xfs: fix the rtrmap and rtrefcount maxlevelsondisk functions The maxlevelsondisk functions are used to compute the size of in-memory btree cursors for each btre...

Linux Distros Unpatched Vulnerability : CVE-2026-67234

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, getauthmechanism/1 used termtobinary/1 on the strictauthmechanism or...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : ClamAV vulnerabilities (USN-8788-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8788-1 advisory. It was discovered that ClamAV incorrectly handled certain zip archive files. A remote attacker could possibly use this issue to...

Linux Distros Unpatched Vulnerability : CVE-2026-98008

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: macb: fix NULL pointer dereference on unbind with fixed-link When the device tree describes a fixed- link and has no mdio child node, macbmiiinit returns...

Linux Distros Unpatched Vulnerability : CVE-2026-97552

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xfs: initialise error in xfsdeferfinishone xfsdeferfinishone declares error without an initialiser and only assigns it inside the loop over dfp-dfpwork. When th...

Oracle Linux 10 : libxml2 (ELSA-2026-71586)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-71586 advisory. - Fix CVE-2026-86144 RHEL-256302 - Fix CVE-2026-86140 RHEL-256024 - Fix CVE-2026-74860 RHEL-255957 - Fix CVE-2026-86142 RHEL-256368 - Fix...

Linux Distros Unpatched Vulnerability : CVE-2026-98015

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/mlx5: E-Switch: fix use-after-free in mlx5eswitchtermtblput In mlx5eswitchtermtblput, the zero-ref cleanup check reads tt-refcount after termtblmutex has be...

Linux Distros Unpatched Vulnerability : CVE-2026-66073

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6, Atom table exhaustion via management API node field. pU...

Linux Distros Unpatched Vulnerability : CVE-2026-97922

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tracing: Free histogram var refs regardless of how often they are referenced Using the same variable three or more times in one hist trigger leaks the variable...

Linux Distros Unpatched Vulnerability : CVE-2026-93220

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - schedext: Keep kicksync waiting on the rq's own CPU kicksyncwaitbalcb assumes it runs on the rq's CPU from the schedule tail: the snapshots it compares against...

Linux Distros Unpatched Vulnerability : CVE-2026-93210

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb: client: harden DFS cache against invalid target hints Currently, gettgtname returns ERRPTR-ENOENT when ce-tgthint is NULL, and dfscachenorequpdatetgthint...

Linux Distros Unpatched Vulnerability : CVE-2026-97576

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - media: v4l2-ctrls: validate HEVC tile counts The stateless HEVC decoders read numtilecolumnsminus1 + 1 entries from columnwidthminus1 and numtilerowsminus1 + 1...

SUSE SLES15 Security Update : freerdp (SUSE-SU-2026:1129-1)

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1129-1 advisory. - CVE-2026-26271: Buffer Overread in FreeRDP Icon Processing bsc1258979. - CVE-2026-26955: Out-of-bounds Write in freerdp bsc1258982. -...

Linux Distros Unpatched Vulnerability : CVE-2026-97920

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tracing: Keep the entry count when the histogram stats allocation fails printentries uses nentries both as the number of sort entries and as its own return...

openSUSE 16: exiv2 / exiv2-lang / libexiv2-28 / libexiv2-28-x86-64-v3 / etc (openSUSE-SU-2026:21904-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21904-1 advisory. - CVE-2026-49275: Out of bounds read in CrwMap::decodeBasic bsc1277791. - CVE-2026-68546: Heap out-of-bounds read in RemoteIo when reading...

Linux Distros Unpatched Vulnerability : CVE-2026-97955

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: mana: restore the XDP program pointer when pre-allocation fails manaxdpset publishes the new program into apc-bpfprog before it allocates anything, because...

Oracle Linux 8 : corosync (ELSA-2026-69277)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-69277 advisory. 3.1.8-1.2 - Resolves: RHEL-251531 - totempg: Replace assert with check in deliverfn fixes CVE-2026-81665 Tenable has extracted the preceding description block...

Linux Distros Unpatched Vulnerability : CVE-2026-97549

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xfs: fix under-reservation of blocks when repairing sf directories Whilst running QA on XFS for-next as of 7.3-rc2 with MKFSOPTIONS=-n size=8192, I observed th...

Linux Distros Unpatched Vulnerability : CVE-2026-93213

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - of: fix out-of-bounds read in ofaliasscan stem parser The stem parser tests isdigitend - 1 before checking end start and so reads one byte before the property...

Linux Distros Unpatched Vulnerability : CVE-2026-93265

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PCI/pwrctrl: tc9563: Fix parsing the integrated Ethernet MAC Endpoint node DSP3 has an integrated Ethernet MAC Endpoint which has its own set of config register...

Linux Distros Unpatched Vulnerability : CVE-2026-88830

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A unit confusion in BusyBox TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted...

Fedora 45 : sipp (2026-3059115f48)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-3059115f48 advisory. Fixed a bunch of CVEs Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

Linux Distros Unpatched Vulnerability : CVE-2026-97608

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfilter: nflog: unregister loggers before per-net teardown nflogsyslog and nfnetlinklog unregister their per-network namespace operations before unregistering...

Mattermost Server 10.11.x < 10.11.23 / 11.7.x < 11.7.8 / 11.8.x < 11.8.5 / 11.9.x < 11.9.1 Incorrect Authorization (MMSA-2026-00702)

The version of Mattermost Server installed on the remote host is affected by a vulnerability as referenced in the MMSA-2026-00702 advisory. - Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to sanitize Team objects returned by the data retention team...

Linux Distros Unpatched Vulnerability : CVE-2026-59990

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Jawn is an open source JSON parser. Prior to 1.7.0, Jawn parse methods accept arbitrarily deep JSON array and object nesting without a depth limit, allowing a...