Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kafka (UTSA-2026-150449)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150449 advisory. A race condition in the Apache Kafka Java producer clients buffer pool management can cause messages to be silently delivered to incorrect topics. When a produce bat...

RockyLinux 9 : webkit2gtk3 (RLSA-2026:95194)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:95194 advisory. chromium-browser: skia: chromium-browser: skia: Use after free in Skia CVE-2026-85049 chromium-browser: skia: Skia: Cross-origin data disclosure via...

Linux Distros Unpatched Vulnerability : CVE-2026-55367

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 4212ce114506a073505fd389db16ad2ba4e582a0, a client could send an incomplete...

MiracleLinux 9 : fetchmail-6.4.24-1.el9_8.1 (AXSA:2026-2265:02)

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-2265:02 advisory. fetchmail: fetchmail: stack-based buffer overflow in NTLM authentication fetchmail-SA-2026-01 CVE-2026-94184 Tenable has extracted the preceding description...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : Pillow vulnerabilities (USN-8999-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8999-1 advisory. It was discovered that Pillow incorrectly handled map stride values when loading certain McIdas AREA images. An attacker could...

Unity Linux 20.1060a / 20.1070a Security Update: nginx (UTSA-2026-150423)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150423 advisory. A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: libX11 (UTSA-2026-150481)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150481 advisory. A malicious X server could exploit a buffer overflow in libX11 before 1.8.14 during handling of XkbGetMap overflowing the keysymmap. Tenable has extracted the...

Fedora 45 : libmongocrypt (2026-f82738ad62)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-f82738ad62 advisory. Version 1.21.1 Fixed - Validate inputs before interpolating them into a KMS HTTP request. CVE-2026-114655 Tenable has extracted the preceding description blo...

Linux Distros Unpatched Vulnerability : CVE-2026-121997

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A heap buffer overflow in gdbserver's QTDPsrc packet handler allows an unauthenticated remote attacker to achieve native code execution in the gdbserver process...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: libreswan (UTSA-2026-150491)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150491 advisory. Libreswan has a null pointer dereference bug in the PKCS7 handling code for IKE certificate authentication. When libreswan decodes an IKE CERT payload of type...

Linux Distros Unpatched Vulnerability : CVE-2026-121953

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.32.2 has a use-after-free in the client's rdpgfx dynamic virtual channel: a duplicate- name channel with a new ChannelId overwrites the...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: libXrender (UTSA-2026-150502)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150502 advisory. A heap overflow in libXrender before 0.9.13 inRenderQueryPictFormats could be used by malicious X servers to inject code into attached X clients. Tenable has extract...

AlmaLinux 9.6 [TuxCare] Security Update: webkit2gtk3 / webkit2gtk3-devel / webkit2gtk3-jsc / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1793757492)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793757492 advisory. - Integer overflow in Skia in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to leak cross- origin data via a crafte...

Qnap QTS / QuTS hero NULL Pointer Dereference (CVE-2025-47213)

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service DoS attack. We have already fixed the vulnerability in the...

Rocky Linux 8.6 [CIQ] Security Update: libsoup / libsoup-devel Multiple Vulnerabilities (ciqsa-2026_1756)

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261756 advisory. This advisory aggregates security fixes for the libsoup SRPM in CIQ LTS 8.6. It addresses 11 CVEs: CVE-2025-32049, CVE-2026-15711, CVE-2025-32906,...

AlmaLinux 9.6 [TuxCare] Security Update: grafana / grafana-selinux (ALMALINUX9.6:CLSA-2026:1793884447)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793884447 advisory. - Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker ca...

Linux Distros Unpatched Vulnerability : CVE-2026-121962

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.32.2 contains a heap buffer overflow in transportdefaultreadpdu when handling partial Early User Authorization reads during PROTOCOLHYBRIDEX...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: nginx (UTSA-2026-150434)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150434 advisory. A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return...

RockyLinux 10 : tesseract (RLSA-2026:95085)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:95085 advisory. tesseract: Tesseract: Heap out-of-bounds write/read leading to information disclosure via crafted data CVE-2026-88048 tesseract: Tesseract: Stack buffe...

MiracleLinux 9 : tesseract-4.1.1-11.el9_8 (AXSA:2026-2262:03)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2262:03 advisory. tesseract: Tesseract: Heap out-of-bounds write/read leading to information disclosure via crafted data CVE-2026-88048 tesseract: Tesseract: Stack...

Rocky Linux 10.2 [CIQ] Security Update: podman / podman-debuginfo / podman-debugsource / podman-docker / etc (crlsa-2026_93464)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202693464 advisory. podman: Arbitrary file write when importing OCI archive CVE-2025-11395 Tenable has extracted the preceding description block directly from the CIQ security...

Fedora 45 : bind / bind-dyndb-ldap (2026-468290e984)

The remote Fedora 45 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-468290e984 advisory. Security updates using git snapshot Release 9.18 is end-of-life upstream. Apply security fixes including medium CVEs from somehow maintained git...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : libvips vulnerabilities (USN-8994-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8994-1 advisory. It was discovered that libvips incorrectly handled certain PDF files with a page that defines...

Linux Distros Unpatched Vulnerability : CVE-2026-122299

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dulwich before 1.2.20 contains a commit object parsing vulnerability where the read path in parsecommit resolves a duplicate tree header to the last occurrence...

Fedora 46 : python-joserfc (2026-6527dc724a)

The remote Fedora 46 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-6527dc724a advisory. Automatic update for python-joserfc-1.8.0-1.fc46. Changelog Thu Nov 5 2026 Chih-Tao Lee - 1.8.0-1 - Update to 1.8.0 rhbz2567025 Tenable has extracted the...

RockyLinux 8 : kernel (RLSA-2026:95212)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:95212 advisory. kernel: sctp: stream: fully roll back denied add-stream state CVE-2026-52929 kernel: net/smc: fix UAF in smccdcrxhandler by pinning the socket...

SUSE SLED15: xen / xen-devel / xen-libs / xen-tools / xen-tools-domU / etc (SUSE-SU-2026:5087-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:5087-1 advisory. Security issue fixed: - CVE-2026-102703,CVE-2026-102704: arbitrary read/write via grant copy bsc1288663. Non...

Linux Distros Unpatched Vulnerability : CVE-2026-121263

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was determined in phpMyAdmin MoTranslator up to 6.0.1. The impacted element is the function Loader::getTranslator of the file...

Linux Distros Unpatched Vulnerability : CVE-2026-111822

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper invalidation of cached authorizations vulnerability in Apache ActiveMQ, Apache ActiveMQ Runtime Config. After the runtime configuration plugin removes ...

Fedora 43 : markdownlint-cli2 (2026-183d3c32a6)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-183d3c32a6 advisory. Update Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for these...

Linux Distros Unpatched Vulnerability : CVE-2026-121262

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was found in phpMyAdmin SQL-Parser 6.0.0/6.0.1. The affected element is the function parse of the file src/Statements/ExplainStatement.php...

Rocky Linux 10.2 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crlsa-2026_93413)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202693413 advisory. kernel: Kernel: Denial of Service in network socket error handling CVE-2026-22977 kernel: x86/CPU/AMD: Prevent improper isolation of shared resources i...

Rocky Linux 9.6 [TuxCare] Security Update: webkit2gtk3 / webkit2gtk3-devel / webkit2gtk3-jsc / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1793757492)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793757492 advisory. - Integer overflow in Skia in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to leak cross- origin data via a...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: ffmpeg (UTSA-2026-150436)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150436 advisory. FFmpeg through 9.0.2 contains an infinite loop vulnerability in ffrtspconnect in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit...

Unity Linux 20.1060e / 20.1070e Security Update: dde-app-services (UTSA-2026-150512)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150512 advisory. libdtkcore/dconfig appid=.. :isValidAppid .. + cleanPath per-uid + savesubpath ,; Tenable has extracted the preceding description block directly from the Unity Linux...

AlmaLinux 9.2 [TuxCare] Security Update: gd / gd-devel / gd-progs (ALMALINUX9.2:CLSA-2026:1793881922)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1793881922 advisory. - libgd: buffer overflow when processing specially crafted GIF file CVE-2026-9672 Note that Nessus has not tested for this issue but has...

Unity Linux 20.1060a / 20.1070a Security Update: wireshark (UTSA-2026-150474)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150474 advisory. H.245 protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service Tenable has extracted the preceding description block directly from the...

RockyLinux 8 : tang (RLSA-2023:7022)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2023:7022 advisory. tang: Race condition exists in the key generation and rotation functionality CVE-2023-1672 Tenable has extracted the preceding description block directly from the...

AlmaLinux 9.6 [TuxCare] Security Update: gd / gd-devel / gd-progs (ALMALINUX9.6:CLSA-2026:1793882237)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793882237 advisory. - libgd: buffer overflow when processing specially crafted GIF file CVE-2026-9672 Note that Nessus has not tested for this issue but has...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: NetworkManager (UTSA-2026-150506)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150506 advisory. DHCP can add routes to a clients routing table via the classless static route option 121. VPN-based security solutions that rely on routes to redirect traffic can be...

Rocky Linux 9 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crlsa-2026_93412)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202693412 advisory. kernel: sctp: stream: fully roll back denied add-stream state CVE-2026-52929 kernel: ipv6: sit: reload inner IPv6 header after GSO offloads CVE-2026-53228...

Fedora 44 : roundcubemail (2026-2aba9ce8fc)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-2aba9ce8fc advisory. Version 1.7.5 - Installer: Add possibility to detsroy the installer session/cookie - Enigma: Fix dbsync never restoring keyring files 10343 -...

Fedora 45 : python3.11 (2026-015c45363c)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-015c45363c advisory. New version of the Python interpreter Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has...

Fedora 44 : python3.15 (2026-4f056db42e)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-4f056db42e advisory. - Update to Python 3.15.2 - CVE 2026-114583: tar filter allows writing outside destination via empty-named symlink - CVE 2026-115557: Distrust compromised...

Fedora 45 : python3.14 (2026-6530ce786a)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-6530ce786a advisory. New version of the Python interpreter ---- New version of the Python interpreter. Tenable has extracted the preceding description block directly fro...

Fedora 45 : python3.13 (2026-77153b01c6)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-77153b01c6 advisory. New version of the Python interpreter ---- New version of Python 3.13. There are no significant changes. Tenable has extracted the preceding...

Fedora 44 : python3.11 (2026-7cf032d4b0)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-7cf032d4b0 advisory. New version of the Python interpreter Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: ffmpeg (UTSA-2026-150433)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150433 advisory. FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SF...

Oracle Linux 9 : kernel (ELSA-2026-95370)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-95370 advisory. - s390/qeth: validate user buffer length in SNMP and ARP query ioctls Jan Polensky RHEL-295101 CVE-2026-80584 - s390/vfioccw: Cancel existing workqueu...

AlmaLinux 9.2 [TuxCare] Security Update: pki-servlet-4.0-api / pki-servlet-engine Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1793821848)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1793821848 advisory. - Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances e.g. CLIENT-CERT, SPNEGO that a user would...