CentOS Linux 7.9 [CIQ] Security Update: gstreamer1-plugins-base / gstreamer1-plugins-base-devel / etc Multiple Vulnerabilities (ciqsa-2026_1754)

The CentOS Linux 7.9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261754 advisory. This advisory aggregates security fixes for the gstreamer1-plugins-base SRPM in CIQ CentOS Bridge 7.9. It addresses 3 CVEs: CVE-2026-2921, CVE-2024-4753...

Unity Linux 20.1060a / 20.1070a Security Update: wireshark (UTSA-2026-150465)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150465 advisory. RRC protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service Tenable has extracted the preceding description block directly from the...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: emacs (UTSA-2026-150486)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150486 advisory. A code execution flaw was found in Emacs, affecting versions prior to 31.2. The Flymake mode using language backends other than Lisp would execute arbitrary code fro...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : Net-SNMP vulnerability (USN-8997-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8997-1 advisory. It was discovered that Net-SNMP incorrectly handled newly accepted connections in the SMUX module. An unauthenticated remote attacker coul...

Linux Distros Unpatched Vulnerability : CVE-2026-121548

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Jarun nnn through 5.3 contains an OS command injection vulnerability in plugins/togglex that allows attackers to execute commands via crafted filenames. Attacke...

Unity Linux 20.1060a / 20.1070a Security Update: nginx (UTSA-2026-150455)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150455 advisory. NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpcoremodule module. When asynchronous file I/O AIO is enabled in certain configurations, processin...

SUSE SLED15 / SLES15 Security Update : curl (SUSE-SU-2026:5068-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:5068-1 advisory. - CVE-2026-8932: incomplete mTLS config matching in conn reuse bsc1268414. - CVE-2026-9546: sending old refere...

Linux Distros Unpatched Vulnerability : CVE-2026-106554

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - One CBOR-parsing issue in jackson-dataformats-binary's CBOR module: an unbounded run of CBOR tags drives quadratic-time TagList growth CPU/GC-exhaustion DoS,...

Debian dla-4882 : chromium - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4882 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4882-1 [email protected]...

Linux Distros Unpatched Vulnerability : CVE-2026-121951

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP 3.0.0 before 3.32.2 server-side RDP peer input parsing skips the six-byte body of a slow-path input event with an unknown message type without checking ...

SUSE SLES15 Security Update : valkey (SUSE-SU-2026:5092-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:5092-1 advisory. - CVE-2026-92925: failure to properly validate string-carrying extensions for null-termination in the cluster bus packet parser can lead to ...

Linux Distros Unpatched Vulnerability : CVE-2026-122054

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Converting crafted BIG-HKSCS input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.18 through 2.31 may...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libsoup (UTSA-2026-150450)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150450 advisory. A flaw was found in libsoup. When max-incoming-payload-size is unlimited 0, SoupWebsocketConnection could grow its incoming GByteArray based on an attacker-controlle...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kafka (UTSA-2026-150461)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150461 advisory. JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the...

openSUSE 16 Security Update : chromium (openSUSE-SU-2026:22215-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22215-1 advisory. Changes in chromium: - Chromium 156.0.8078.79 boo1288840: CVE-2026-76024: Memory corruption in MediaStream CVE-2026-76025: Use after free in...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: nginx (UTSA-2026-150420)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150420 advisory. A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return...

SUSE SLES15 Security Update : rootlesskit (SUSE-SU-2026:5074-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:5074-1 advisory. This update for rootlesskit rebuilds it against the current go security release. Tenable has extracted the preceding description block...

Unity Linux 20.1060a / 20.1070a Security Update: nginx (UTSA-2026-150454)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150454 advisory. A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's...

MiracleLinux 8 : dotnet8.0-8.0.133-1.el8_10.ML.1 (AXSA:2026-2249:22)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2249:22 advisory. brotli: Out-of-Bounds Write in Google Brotli Decoder CVE-2026-111497 dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privile...

CentOS Linux 8.4 [TuxCare] Security Update: expat / expat-devel / expat-static (CENTOS8.4:CLSA-2026:1793864778)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1793864778 advisory. - libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XMLParserReset zeroes the direct byte count but never offse...

Fedora 44 : python3.13 (2026-a85529a028)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a85529a028 advisory. New version of the Python interpreter ---- New version of Python 3.13. There are no significant changes. Tenable has extracted the preceding...

Linux Distros Unpatched Vulnerability : CVE-2026-118515

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Symfony Serializer component DataUriNormalizer handles only the exact types SplFileInfo, SplFileObject, and File, so for a property typed with a subclass su...

Linux Distros Unpatched Vulnerability : CVE-2026-110944

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Resource exhaustion vulnerability in the HTTP request handling of the QHttpServer component of Qt HTTP Server. CVE-2026-110944 Note that Nessus relies on the...

Rocky Linux 9.6 [TuxCare] Security Update: openexr / openexr-devel / openexr-libs (ALMALINUX9.6:CLSA-2026:1793883335)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793883335 advisory. - OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR...

Linux Distros Unpatched Vulnerability : CVE-2026-121957

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.32.2 contains a use-after-free vulnerability that allows malicious RDP servers to corrupt client memory by racing the RDPGFX ResetGraphics...

Rocky Linux 9 [CIQ] Security Update: dpdk / dpdk-debuginfo / dpdk-debugsource / dpdk-devel / dpdk-doc / etc Multiple Vulnerabilities (crlsa-2026_94629)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202694629 advisory. dpdk: dpdk: Missing memory size validation before mmap in vhost memory region setup CVE-2026-86561 dpdk: dpdk: Control-queue descriptor double-fetch...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: ffmpeg (UTSA-2026-150443)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150443 advisory. A memory corruption vulnerability exists in FFmpeg before 8.1. The RTP encoding process. In the nalsend function in libavformat/rtpench264hevc.c, a negative size...

FreeBSD : chromium -- security fixes (380c9ad2-d81f-11f1-a214-a0369f7f7be0)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 380c9ad2-d81f-11f1-a214-a0369f7f7be0 advisory. Chrome Releases reports: This update includes 213 security fixes: Tenable has extracted the...

Unity Linux 20.1070a Security Update: python3.11 (UTSA-2026-150503)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150503 advisory. Use-after-free UAF was possible in the lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile when a memory allocation fails with a MemoryError and the...

AlmaLinux 9.2 [TuxCare] Security Update: grafana-pcp (ALMALINUX9.2:CLSA-2026:1793887169)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1793887169 advisory. - On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated...

Rocky Linux 8 [CIQ] Security Update: libXi / libXi-debuginfo / libXi-debugsource / libXi-devel Multiple Vulnerabilities (crlsa-2026_93438)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202693438 advisory. libXi: libXi: Arbitrary code execution via oversized DEVICEENABLE reply CVE-2026-109090 libXi: libXi: Arbitrary code execution via DEVICERESOLUTION...

Linux Distros Unpatched Vulnerability : CVE-2026-121727

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Kore before 4.3.0 contains an integer underflow vulnerability in HTTP request body handling that allows unauthenticated attackers to bypass httpbodymax by sendi...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: perl-XML-LibXML (UTSA-2026-150504)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150504 advisory. XML::LibXML versions through 2.0210 for Perl read out-of-bounds heap memory when parsing XML node names containing truncated UTF-8 byte sequences. A node name ending...

Fedora 44 : pipx (2026-a1c8629ff7)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-a1c8629ff7 advisory. Update to 1.18.12 upstream release, addressing 24 security problems. Tenable has extracted the preceding description block directly from the Fedora security...

Fedora 43 : rust-redlib (2026-b6daefd0fc)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-b6daefd0fc advisory. Rebuilt with rustls-webpki 0.103.16 for RUSTSEC-2026-0382. This provides added protection against trusting the eMudhra intermediate CA certificates, which...

Fedora 45 : pipx (2026-d521258d12)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-d521258d12 advisory. Update to 1.18.12 upstream release, fixing GHSA-jpqf-qh96-2pqf. Tenable has extracted the preceding description block directly from the Fedora security...

TencentOS Server 4: java-17-konajdk (TSSA-2026:1329)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1329 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

Linux Distros Unpatched Vulnerability : CVE-2026-117666

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Validation of Certificate with Host Mismatch vulnerability in deadtrickster sslverifyfun allows an adversary in the middle to impersonate a TLS peer vi...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: ffmpeg (UTSA-2026-150426)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150426 advisory. FFmpeg before 8.1.3 contains a protection mechanism failure in the HLS demuxer that allows attackers to bypass protocol and allowedextensions restrictions when openi...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: nginx (UTSA-2026-150429)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150429 advisory. A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's...

Oracle Linux 8 : gimp:2.8 (ELSA-2026-95482)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-95482 advisory. - fix CVE-2026-112257 - modify fix for CVE-2026-4154 - fix CVE-2026-90947 - fix CVE-2026-90948 - fix CVE-2026-92248 - fix CVE-2026-97185 - fix CVE-2026-59090 -...

Linux Distros Unpatched Vulnerability : CVE-2026-18376

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Ubuntu Linux - Unknown description CVE-2026-18376 Note that Nessus relies on the presence of the package as reported by the vendor. %NASLMINLEVEL 80900 C Tenabl...

Unity Linux 20.1060a / 20.1070a Security Update: nginx (UTSA-2026-150428)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150428 advisory. NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpcoremodule module. When asynchronous file I/O AIO is enabled in certain configurations, processin...

Linux Distros Unpatched Vulnerability : CVE-2026-122032

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SPIP before 4.4.29 contains a SQL injection vulnerability that allows authenticated attackers with back- office access to inject arbitrary SQL by submitting a...

Oracle Linux 9 : webkit2gtk3 (ELSA-2026-95194)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-95194 advisory. 2.54.2-0.el98.2 - Update bundled Skia to aa789d9bd566 Tenable has extracted the preceding description block directly from the Oracle Linux security...

Unity Linux 20.1060a / 20.1070a Security Update: nginx (UTSA-2026-150446)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150446 advisory. A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's...

Oracle Linux 9 : dpdk (ELSA-2026-94629)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-94629 advisory. 25.11-2 - Backport fixes for CVE-2026-86846 CVE-2026-86848 CVE-2026-86561 CVE-2026-86562 CVE-2026-86563 CVE-2026-86567 CVE-2026-86566 CVE-2026-86849...

SUSE SLES15 Security Update : curl (SUSE-SU-2026:5069-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:5069-1 advisory. - CVE-2026-8932: incomplete mTLS config matching in conn reuse bsc1268414. - CVE-2026-9546: sending old referer bsc1268419. -...

Unity Linux 20.1070a Security Update: python3.11 (UTSA-2026-150483)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150483 advisory. Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata. You are...

Fedora 43 : valkey (2026-1fd9c58e29)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-1fd9c58e29 advisory. Valkey 8.1.11 - Released Mon 26 October 2026 Upgrade urgency SECURITY: This release includes security fixes we recommend you apply as soon as possible...