Fedora 45 : rply (2026-b2f81db711)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-b2f81db711 advisory. Fix for CVE-2026-115722 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: unbound (UTSA-2026-150442)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150442 advisory. In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in the DNSSEC validator that enables denial of service and possible remote code execution...

Linux Distros Unpatched Vulnerability : CVE-2026-121944

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sngrep through 1.9.0 contains an infinite loop vulnerability in capturepacketreasmip in src/capture.c that allows attackers to cause denial of service via craft...

TencentOS Server 4: git-lfs (TSSA-2026:1325)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1325 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

Fedora 44 : markdownlint-cli2 (2026-6215800886)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-6215800886 advisory. Update Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for these...

TencentOS Server 4: pcs (TSSA-2026:1351)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1351 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

MiracleLinux 8 : libXi-1.7.10-4.el8_10 (AXSA:2026-2251:04)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2251:04 advisory. libXi: libXi: Arbitrary code execution via oversized DEVICEENABLE reply CVE-2026-109090 libXi: libXi: Arbitrary code execution via DEVICERESOLUTION...

Cisco Identity Services Engine (cisco-sa-ise-cert-mE9BD5GO)

According to its self-reported version, Cisco ISE is affected by a vulnerability. - A vulnerability in the authorization mechanism of Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an unauthenticated, remote attacker to obtain an endpoint identity...

Fedora 45 : dhcpcd (2026-c36b5fc4ca)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-c36b5fc4ca advisory. - Fix daemonising broken by RLIMITNOFILE of 0 on Linux rhbz2547780 - Update to 10.5.2 rhbz2511521 The upstream release contains fixes for the...

AlmaLinux 9.6 [TuxCare] Security Update: containernetworking-plugins (ALMALINUX9.6:CLSA-2026:1793885412)

The AlmaLinux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793885412 advisory. - Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could...

Fedora 45 : curl (2026-f2ecc7c470)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-f2ecc7c470 advisory. - multi: adjust the cleanup order in multidone CVE-2026-92392 Tenable has extracted the preceding description block directly from the Fedora security advisor...

MiracleLinux 9 : gimp-3.0.4-4.el9_8.15 (AXSA:2026-2255:12)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2255:12 advisory. gimp: GIMP: heap buffer overflow in DDS loader on crafted DirectDraw Surface file CVE-2026-106062 gimp: gimp: heap out-of-bounds read/write in PSD...

Fedora 45 : mongo-c-driver (2026-dbe693ee92)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-dbe693ee92 advisory. libmongoc 2.5.7 Fixes - Fix handling of large usernames for GSSAPI on Windows. CVE-2026-114645 - Fix container client metadata. Tenable has extracted the...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kafka (UTSA-2026-150463)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150463 advisory. By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. T...

AlmaLinux 9.2 [TuxCare] Security Update: openexr / openexr-devel / openexr-libs (ALMALINUX9.2:CLSA-2026:1793882896)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1793882896 advisory. - OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR...

RHEL 8 : .NET 10.0 (RHSA-2026:92431)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:92431 advisory. .NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly...

ESXi 6.5 / 6.7 / 7.0 (VMSA-2022-0020.2)

The version of ESXi installed on the remote host is prior to 6.5, 6.7, 7.0. It is, therefore, affected by multiple vulnerabilities as referenced in the VMSA-2022-0020.2 advisory. - Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their retpoline...

Unity Linux 20.1070a Security Update: python3.11 (UTSA-2026-150498)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150498 advisory. When building nested elements using xml.dom.minidom methods such as appendChild that have a dependency on clearidcache the algorithm is quadratic. Availability can b...

Oracle Linux 10 : delve (ELSA-2026-95519)

The remote Oracle Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-95519 advisory. 1.26.1-3.0.1 - Disable DWARF compression which has issues Alex Burmashev 1.26.1-3 - Add GOMODCACHE in %check Tenable has extracted the preceding...

MiracleLinux 8 : kernel-4.18.0-553.182.1.el8_10 (AXSA:2026-2257:116)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-2257:116 advisory. kernel: ipv4: free inetopt and ireqopt after an RCU grace period CVE-2026-98432 CVEs: CVE-2026-98432 In the Linux kernel, the following vulnerability has be...

Linux Distros Unpatched Vulnerability : CVE-2026-115697

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - iwd - None Ubuntu Linux - Unknown description CVE-2026-115697 Note that Nessus relies on the presence of the package as reported by the vendor...

Debian dla-4884 : puppet - security update

The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dla-4884 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4884-1 [email protected] https://www.debian.org/lts/security/...

Unity Linux 20.1060a / 20.1070a Security Update: wireshark (UTSA-2026-150470)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150470 advisory. C12.22 protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service Tenable has extracted the preceding description block directly from th...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kafka (UTSA-2026-150462)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150462 advisory. CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kafka (UTSA-2026-150467)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150467 advisory. A possible security vulnerability has been identified in Apache Kafka. This requires access to a alterConfig to thecluster resource, or Kafka Connect worker, and the...

WordPress 7.1.0 < 7.1.4 / 7.0.0 < 7.0.8 / 6.9.0 < 6.9.11 / 6.8.0 < 6.8.12 / 6.7.0 < 6.7.11 / 6.6.0 < 6.6.11 / 6.5.0 < 6.5.14 / 6.4.0 < 6.4.14 / 6.3.0 < 6.3.14 / 6.2.0 < 6.2.15 / 6.1.0 < 6.1.16 / 6.0.0 < 6.0.18 / 5.9.0 < 5.9.20 / 5.8.0 < 5.8.19 / 5.7.0 < 5.7.21 / 5.6.0 < 5.6.23 / 5.5.0 < 5.5.24 / 5.4.0 < 5.4.25 / 5.3.0 < 5.3.27 / 5.2.0 < 5.2.30 / 5.1.0 < 5.1.28 / 5.0.0 < 5.0.31 / 4.9.0 < 4.9.35 / 4.8.0 < 4.8.34 / 4.7.0 < 4.7.39

WordPress versions 7.1.0 7.1.4 / 7.0.0 7.0.8 / 6.9.0 6.9.11 / 6.8.0 6.8.12 / 6.7.0 6.7.11 / 6.6.0 6.6.11 / 6.5.0 6.5.14 / 6.4.0 6.4.14 / 6.3.0 6.3.14 / 6.2.0 6.2.15 / 6.1.0 6.1.16 / 6.0.0 6.0.18 / 5.9.0 5.9.20 / 5.8.0 5.8.19 / 5.7.0 5.7.21 / 5.6.0 5.6.23 / 5.5.0 5.5.24 / 5.4.0 5.4.25 / 5.3.0 5.3....

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python3 (UTSA-2026-150441)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150441 advisory. ssl.SSLContext.wrapbio didn't require the serverhostname argument to not be None if ssl.SSLContext.checkhostname was set. Due to a missing parameter check in...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libsoup (UTSA-2026-150437)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150437 advisory. A flaw was found in libsoup. An unsigned integer underflow in the soupfilterinputstreamreaduntil function causes a heap buffer over-read when parsing multipart HTTP...

Linux Distros Unpatched Vulnerability : CVE-2026-121959

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.32.2 contains an infinite loop vulnerability in websocketcontextread that fails to handle a zero BIO result with payload outstanding. A malicio...

AlmaLinux 9.6 [TuxCare] Security Update: openexr / openexr-devel / openexr-libs (ALMALINUX9.6:CLSA-2026:1793883335)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793883335 advisory. - OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR...

MiracleLinux 8 : raptor2-2.0.15-18.el8_10 (AXSA:2026-2254:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-2254:01 advisory. raptor2: raptor2: arbitrary code execution via heap-based buffer overflow in language tag handling CVE-2025-71436 Tenable has extracted the preceding...

Linux Distros Unpatched Vulnerability : CVE-2026-121626

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GNU Gatekeeper gnugk before 5.16 contains an out-of-bounds read vulnerability in H46024Socket::ReceivedProbePacket that allows remote attackers to cause a heap...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libsoup (UTSA-2026-150425)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150425 advisory. A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong signal with a GByteArray pointer even though...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: ffmpeg (UTSA-2026-150418)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150418 advisory. FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parseplaylist accepts...

MiracleLinux 9 : fence-agents-4.10.0-110.el9_8.8 (AXSA:2026-2264:18)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2264:18 advisory. pyjwt: pyjwt: Authentication bypass via empty HMAC key acceptance CVE-2026-102266 pyjwt: PyJWT: Authentication bypass via improper public key...

Fedora 43 : rust-qemu-rdp (2026-d4e37b0053)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-d4e37b0053 advisory. Rebuilt with rustls-webpki 0.103.16 for RUSTSEC-2026-0382. This provides added protection against trusting the eMudhra intermediate CA certificates, which...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 : APT vulnerability (USN-8996-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 host has packages installed that are affected by a vulnerability as referenced in the USN-8996-1 advisory. Max Justicz discovered that APT incorrectly handled hard links when encountering...

Fedora 43 : mongo-c-driver (2026-e5badbbedc)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-e5badbbedc advisory. libmongoc 1.30.14 Fixes - Fix handling of large usernames for GSSAPI on Windows. CVE-2026-114645 Tenable has extracted the preceding description block direct...

openSUSE 16: brotli / libbrotli-devel / libbrotlicommon1 / etc (openSUSE-SU-2026:22213-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:22213-1 advisory. This update for brotli fixes the following issue: - CVE-2026-111497: Brotli decoder out-of-bounds write permits remote code execution bsc1287778. Tenabl...

SUSE SLES15: apache2 / apache2-devel / apache2-doc / apache2-prefork / etc (SUSE-SU-2026:5076-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:5076-1 advisory. - CVE-2026-42356: deployment of wrong handler allows target of internal redirects from CGI programs to also be treated as CGI and...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: redis (UTSA-2026-150453)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150453 advisory. A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate string-carrying...

SUSE SLED15 / SLES15 Security Update : python-PyJWT (SUSE-SU-2026:5064-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:5064-1 advisory. - CVE-2026-101917: attacker traffic can amplify outbound requests to the configured JWKS endpoint bsc1283060. ...

Linux Distros Unpatched Vulnerability : CVE-2026-121549

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nnn through 5.3 contains an insecure temporary file vulnerability in the pdfread and nuke plugins that allows local attackers to overwrite files by exploiting...

Linux Distros Unpatched Vulnerability : CVE-2026-118516

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Symfony Routing components CompiledUrlMatcher and UrlMatcher interpret the host and path information differently, allowing path-based authorization rules to...

SUSE SLES15 Security Update : libsoup (SUSE-SU-2026:5063-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:5063-1 advisory. This update for libsoup fixes the following issue: - CVE-2026-103399: incomplete request body draining in HTTP/1.x early responses can allow...

SUSE SLES15: GraphicsMagick / GraphicsMagick-devel / libGraphicsMagick++-Q16-12 / etc (SUSE-SU-2026:5095-1)

The remote SUSE Linux SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:5095-1 advisory. This update for GraphicsMagick fixes the following issue: - CVE-2026-109964: heap buffer overwrite in PICT decoder on 32-bit systems bsc1285423. Tenabl...

CentOS Linux 7.9 [CIQ] Security Update: openssh / openssh-askpass / openssh-cavs / openssh-clients / etc Multiple Vulnerabilities (ciqsa-2026_1752)

The CentOS Linux 7.9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261752 advisory. This advisory aggregates security fixes for the openssh SRPM in CIQ CentOS Bridge 7.9. It addresses 23 CVEs: CVE-2025-26465, CVE-2016-1908, CVE-2006-492...

SUSE SLED15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:5091-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:5091-1 advisory. The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues: The following security...

Linux Distros Unpatched Vulnerability : CVE-2026-121950

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.32.2 does not check the product of surface dimensions in gdiCreateSurface when handling an RDPGFX CREATESURFACE PDU, causing an integer wrap an...

Linux Distros Unpatched Vulnerability : CVE-2026-121958

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP through 3.32.1 has a heap out-of-bounds write in the RDPGFX client because the deletesurface callback truncates surface hash keys to 16 bits, leaving th...