Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kafka (UTSA-2026-150479)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150479 advisory. Incorrect Implementation of Authentication Algorithm in Apache Kafka's SCRAM implementation. Issue Summary: Apache Kafka's implementation of the Salted Challenge...

Linux Distros Unpatched Vulnerability : CVE-2026-111821

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB. A user can create a durable subscription with a clientId and subscription na...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: nginx (UTSA-2026-150427)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150427 advisory. A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: libXi (UTSA-2026-150489)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150489 advisory. An out-of-bounds read in libXi's XI2 class parser in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client. Tenable has extracted the...

Linux Distros Unpatched Vulnerability : CVE-2026-123151

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the GNU debugger GDB. When GDB connects to a remote debug target, a malicious target can cause GDB to overflow a buffer on the stack while...

Linux Distros Unpatched Vulnerability : CVE-2026-118517

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Symfony HtmlSanitizer component UrlSanitizer parses URLs differently from browsers, allowing the allowLinkHosts and allowMediaHosts checks to be bypassed fo...

MiracleLinux 8 : gcc-toolset-15-gcc-15.2.1-7.2.el8_10.ML.1 (AXSA:2026-2247:03)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-2247:03 advisory. gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: Denial of Service via use-after-free in binary heap eraseif CVE-2026-102010 Tenable has extracted the preceding...

Fedora 43 : python-lxml-html-clean (2026-768edcd81d)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-768edcd81d advisory. Fixes three high severity ReDOS flaws. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has...

Fedora 43 : rply (2026-5079b4320a)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-5079b4320a advisory. Fix for CVE-2026-115722 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

Linux Distros Unpatched Vulnerability : CVE-2026-63183

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OmniAuth is a flexible authentication system utilizing Rack middleware. Prior to 2.2.0, OmniAuth derives provider callback URLs from request-controlled host...

Oracle Linux 7 : host-metering (ELSA-2026-71619)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-71619 advisory. - Rebuild with latest go-toolset-1.19-golang to fix CVE-2026-56860 Orabug: 40071668 - Rebuild with latest go-toolset-1.19-golang to fix CVE-2026-27145 Orabug:...

Linux Distros Unpatched Vulnerability : CVE-2026-121994

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A stack buffer overflow in the GDB client's remote protocol handler allows an attacker-controlled debug target to execute arbitrary code in the GDB process. The...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: nginx (UTSA-2026-150430)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150430 advisory. NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpcoremodule module. When asynchronous file I/O AIO is enabled in certain configurations, processin...

Fedora 45 : libical (2026-9616ace61b)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-9616ace61b advisory. Add a patch for CVE-2026-88383: Denial of Service via crafted iCalendar property parsing Tenable has extracted the preceding description block...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: ffmpeg (UTSA-2026-150448)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150448 advisory. FFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata allocation paths in libavcodec/wmaenc.c. Tenable has extracted the...

Rocky Linux 9.6 [TuxCare] Security Update: gd / gd-devel / gd-progs (ALMALINUX9.6:CLSA-2026:1793882237)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793882237 advisory. - libgd: buffer overflow when processing specially crafted GIF file CVE-2026-9672 Note that Nessus has not tested for this issue but has...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kafka (UTSA-2026-150451)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150451 advisory. Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper. If SASL Quorum Peer authentication is enabled in ZooKeeper...

macOS Autodesk Fusion 360 <= 2705.1.30 Multiple Vulnerabilities (adsk-sa-2026-0019)

The version of Autodesk Fusion 360 installed on the remote macOS or Mac OS X host is less than or equal to 2705.1.30. It is, therefore, affected by multiple vulnerabilities: - A maliciously crafted dynamic library, when loaded from an arbitrary path through the TextCommands.LoadDll command expose...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: pcre2 (UTSA-2026-150342)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150342 advisory. PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data. Tenable has...

Linux Distros Unpatched Vulnerability : CVE-2026-121956

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.32.2 contains a double free in the WinPR Kerberos SSPI retrieveSomeTgt function, which installs the krb5 default realm into a target principal...

Linux Distros Unpatched Vulnerability : CVE-2026-121261

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability has been found in phpMyAdmin ShapeFile up to 4.0.1. Impacted is the function ShapeRecord::loadFromFile of the component SHP File Handler. Such...

Fedora 44 : erlang-jose (2026-85312f9b13)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-85312f9b13 advisory. jove ver. 1.11.13 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...

Rocky Linux 10.2 [CIQ] Security Update: dpdk / dpdk-debuginfo / dpdk-debugsource / dpdk-devel / dpdk-doc / etc Multiple Vulnerabilities (crlsa-2026_94630)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202694630 advisory. dpdk: dpdk: Missing memory size validation before mmap in vhost memory region setup CVE-2026-86561 dpdk: dpdk: Control-queue descriptor double-fetch...

openSUSE 16 Security Update : python-pypdf (openSUSE-SU-2026:22219-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22219-1 advisory. Changes in python-pypdf: - CVE-2026-119209: negative /Index values and multiplied xref streams can lead to clamp bypass and server memory...

openSUSE 16 Security Update : gh (openSUSE-SU-2026:22222-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:22222-1 advisory. Changes in gh: - Update to version 2.103.3: fixgh auth status: only diagnose token expiry after HTTP 401 fixgh auth status: explain expired expiring...

Linux Distros Unpatched Vulnerability : CVE-2026-100408

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Git for Windows is the Windows port of Git. From 2.43.0.windows.1 until 2.55.0.windows.3, when a matching git: credential exists in Windows Credential Manager a...

Unity Linux 20.1060e Security Update: containerd (UTSA-2026-150509)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150509 advisory. containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd's layer unpack handler repeatedly traverses directories for...

Fedora 45 : python-lxml-html-clean (2026-7c58252e69)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-7c58252e69 advisory. Fixes three high severity ReDOS flaws. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has...

Oracle Linux 7 : ELSA-2026-65442-0: / firefox (ELSA-2026-654420)

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-654420 advisory. - Update to 140.14.0 ESR Orabug: 40189882CVE-2026-74934CVE-2026-74935 CVE-2026-74936CVE-2026-74939CVE-2026-74940CVE-2026-74941CVE-2026-74942...

RHEL 10 : .NET 9.0 (RHSA-2026:93458)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:93458 advisory. .NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly...

Linux Distros Unpatched Vulnerability : CVE-2026-65160

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NVIDIA nvJPEG contains a vulnerability where an attacker could cause a divide-by-zero. A successful exploit of this vulnerability might lead to denial of servic...

CentOS Linux 8.5 [TuxCare] Security Update: expat / expat-devel / expat-static (CENTOS8.5:CLSA-2026:1793864886)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2026:1793864886 advisory. - libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XMLParserReset zeroes the direct byte count but never offse...

MiracleLinux 9 : bind9.18-9.18.29-14.el9_8.12 (AXSA:2026-2263:08)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2263:08 advisory. bind: BIND: Denial of Service via unbounded processing of crafted DNS messages CVE-2026-19630 bind: bind: Arbitrary code execution via GSS-TSIG UDP...

Rocky Linux 9 [CIQ] Security Update: fence-agents-aliyun / fence-agents-all / fence-agents-amt-ws / etc Multiple Vulnerabilities (crlsa-2026_94500)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202694500 advisory. pyjwt: pyjwt: Authentication bypass via empty HMAC key acceptance CVE-2026-102266 pyjwt: PyJWT: Authentication bypass via improper public key validation...

SUSE SLED15 / SLES15 Security Update : libsoup (SUSE-SU-2026:5062-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:5062-1 advisory. This update for libsoup fixes the following issue: - CVE-2026-103399: incomplete request body draining in HTTP/1.x earl...

MiracleLinux 8 : python-jwt-1.6.1-2.el8_10.1 (AXSA:2026-2259:01)

The remote MiracleLinux 8 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-2259:01 advisory. pyjwt: PyJWT accepts unknown crit header extensions RFC 7515 ?4.1.11 MUST violation CVE-2026-32597 Tenable has extracted the preceding description block...

SUSE SLES15 Security Update : kernel (Live Patch 29 for SUSE Linux Enterprise 15 SP6) (SUSE-SU-2026:5053-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:5053-1 advisory. This update for the SUSE Linux Enterprise Kernel 6.4.0-150600.23.125 fixes various security issues: The following security issues were fixed: -...

Unity Linux 20.1070a Security Update: python3.11 (UTSA-2026-150493)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150493 advisory. User-controlled header names and values containing newlines can allow injecting HTTP headers. Tenable has extracted the preceding description block directly from the...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: freeipmi (UTSA-2026-150471)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150471 advisory. FreeIPMI before 1.6.19 has a stack-based buffer overflow in readfrudata in libfreeipmi/fru/ipmi-fru.c when a BMC returns more bytes than requested. Tenable has...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: nginx (UTSA-2026-150421)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150421 advisory. NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpcoremodule module. When asynchronous file I/O AIO is enabled in certain configurations, processin...

Fedora 44 : mongo-c-driver (2026-bc9f778646)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-bc9f778646 advisory. libmongoc 1.30.14 Fixes - Fix handling of large usernames for GSSAPI on Windows. CVE-2026-114645 Tenable has extracted the preceding description block direct...

FreeBSD : openvox -- Authenticated RCE on OpenVox server via Event Deserialization (923b5da5-d8db-11f1-8d43-18cf5efc6bb4)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 923b5da5-d8db-11f1-8d43-18cf5efc6bb4 advisory. The OpenVoxProject reports: The Puppet/OpenVox report is a JSON document the agent sends to the server...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libsoup (UTSA-2026-150457)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150457 advisory. A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large outgoing message, truncated size calculations used for GByteArra...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 : Twisted vulnerability (USN-9000-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 host has a package installed that is affected by a vulnerability as referenced in the USN-9000-1 advisory. It was discovered that Twisted's IMAP server mishandled wildcard patterns in mailbox list commands. An authenticated remote attack...

Linux Distros Unpatched Vulnerability : CVE-2026-121971

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The component ScopingHttpClient in Symfony HttpClient merges the options of its default scope such as authbearer or authbasic into a request before resolving a...

Unity Linux 20.1070a Security Update: python3.11 (UTSA-2026-150482)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150482 advisory. There is a defect in the CPython tarfile module affecting the TarFile extraction and entry enumeration APIs. The tar implementation would process tar archives with...

AlmaLinux 9 : tesseract (ALSA-2026:95086)

The remote AlmaLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:95086 advisory. tesseract: Tesseract: Heap out-of-bounds write/read leading to information disclosure via crafted data CVE-2026-88048 tesseract: Tesseract: Stack buffer...

Linux Distros Unpatched Vulnerability : CVE-2026-121954

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.32.2 has a heap out-of-bounds write in the planar codec because freerdpbitmapplanarcontextreset commits new dimensions before buffer reallocati...

Slackware Linux 15.0 / current rsync Vulnerability (SSA:2026-308-01)

The version of rsync installed on the remote host is prior to 3.5.2. It is, therefore, affected by a vulnerability as referenced in the SSA:2026-308-01 advisory. New rsync packages are available for Slackware 15.0 and -current to fix security issues. Tenable has extracted the preceding descriptio...

Rocky Linux 8 [CIQ] Security Update: bind9.16 / bind9.16-chroot / bind9.16-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_94011)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202694011 advisory. bind9: bind: BIND 9: Denial of Service via crafted DNSSEC responses CVE-2026-19662 bind: BIND: Denial of Service via unbounded processing of crafted DNS...