Linux Distros Unpatched Vulnerability : CVE-2026-97764

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - django-allauth before 65.19.4 does not have the expected limits on failed login attempts because, in some common configurations, an attacker can leverage the...

Linux Distros Unpatched Vulnerability : CVE-2026-98148

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/gud: validate GUDROTATION0 is present in supported rotations The rotation argument to drmplanecreaterotationproperty is set to DRMMODEROTATE0, and the devic...

Linux Distros Unpatched Vulnerability : CVE-2026-97990

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - vdpasimnet: check TX pull result before RX copy vringhiovpulliotlb returns a signed byte count. A failed TX pull is currently added to the unsigned byte counter...

Linux Distros Unpatched Vulnerability : CVE-2026-98070

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/rds: acquire RDSINXMIT in rdstcpresetcallbacks rdstcpresetcallbacks quiesces the transmit path by setting the path state to RDSCONNRESETTING and then waitin...

Linux Distros Unpatched Vulnerability : CVE-2026-97995

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - virtioconsole: do not free control-out buffers on remove sendcontrolmsg publishes &portdev-cpkt as the control-out virtqueue cookie. removevqs walks every...

Linux Distros Unpatched Vulnerability : CVE-2026-93230

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier Gigantic bootmem HugeTLB pages are currently initialized from hugetlbinit, but...

Linux Distros Unpatched Vulnerability : CVE-2026-98047

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Check ancestor frames for rbtree callbacks bpfrbtreeadd invokes its comparator while the caller holds the root lock. The native insertion code retains raw...

Linux Distros Unpatched Vulnerability : CVE-2026-88840

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - BusyBox TLS getclienthello reads past the end of the input buffer when parsing a truncated ClientHello message. CVE-2026-88840 Note that Nessus relies on the...

Linux Distros Unpatched Vulnerability : CVE-2026-97527

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock The fcport-unsolctxhead list is modified from several contexts without a common lock. Entrie...

Linux Distros Unpatched Vulnerability : CVE-2026-98028

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - eth: nfp: drop the replaced rule from the list when reprogramming fails nfpnetfsadd replaces an existing rule by deleting it from the hardware, decrementing...

AlmaLinux 9 : thunderbird (ALSA-2026:70642)

The remote AlmaLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:70642 advisory. firefox: thunderbird: Privilege escalation in the DOM: Workers component CVE-2026-16365 firefox: thunderbird: Sandbox escape in the Remote Settings Clien...

Linux Distros Unpatched Vulnerability : CVE-2026-88837

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - BusyBox httpd treats yescrypt $y$ password hashes as plaintext during Basic Authentication, inverting the authentication check. CVE-2026-88837 Note that Nessus...

Fedora 44 : mingw-gdk-pixbuf (2026-16f1152378)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-16f1152378 advisory. Backport fixes for CVE-2026-16768 and CVE-2026-81893. Tenable has extracted the preceding description block directly from the Fedora security...

Linux Distros Unpatched Vulnerability : CVE-2026-97916

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - accel/ivpu: Validate firmware log buffer metadata The tracing log headers parsed by fwlogprintbuffer reside in DMA-shared BOs that the NPU firmware can write to...

Linux Distros Unpatched Vulnerability : CVE-2026-97908

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hcidev The command and ACL RPMsg endpoints store struct btqcomsmd as their callback private data. T...

Linux Distros Unpatched Vulnerability : CVE-2026-98154

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nvme-rdma: fix -EIO cleanup order in queuerq On -EIO, the RDMA queuerq path reports a host path error and then still cleans up the command and unmaps the SQE DM...

RHEL 8 : unbound (RHSA-2026:72110)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:72110 advisory. The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fixes: unbound: Unbound: Heap buffer overflow and...

Linux Distros Unpatched Vulnerability : CVE-2026-100071

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: hsr: free learned nodes on device setup failure hsrdevfinalize can fail after a lower-device RX handler has already been registered slave A is added before...

Linux Distros Unpatched Vulnerability : CVE-2026-98121

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - watchdog: msc313e: Fix NULL pointer dereference in PM callbacks msc313ewdtprobe doesn't set the driver data for the platform device. As a result, devgetdrvdata ...

Linux Distros Unpatched Vulnerability : CVE-2026-98130

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sctp: fix a TOCTOU race in SCTPCMDTIMERSTART The SCTPCMDTIMERSTART handler checks timerpending before calling timerreduce. The timer can expire and detach betwe...

Linux Distros Unpatched Vulnerability : CVE-2026-98038

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Keep refcountacquire nullable for borrowed RCU kptrs bpfrefcountacquire is fallible for a borrowed reference because the object may have reached a zero...

Linux Distros Unpatched Vulnerability : CVE-2026-98116

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF sndpcmhwparams and sndpcmhwfree guard buffer reallocation with an mmapcount check perform...

Linux Distros Unpatched Vulnerability : CVE-2026-88385

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mini-XML 4.0.5 contains a memory leak vulnerability in mxmlloaddata during malformed XML parsing. Specially crafted XML input can cause text nodes allocated by...

Linux Distros Unpatched Vulnerability : CVE-2026-97612

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: mpls: clear innerprotocol when the last label is popped skbmplspush records the pre- encapsulation network header once, gated on !skb-innerprotocol...

Linux Distros Unpatched Vulnerability : CVE-2026-93209

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: hcicore: use skbget instead of skbclone for reqskb BT enable fails intermittently with -ETIMEDOUT -110. The kernel log shows the HCI Read Local Versi...

Linux Distros Unpatched Vulnerability : CVE-2026-97059

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - DCMTK through 3.7.0 contains a heap over-read vulnerability in ConcatenationLoader that copies pixel data frames without validating the PixelData buffer length...

Linux Distros Unpatched Vulnerability : CVE-2026-98155

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - accel/qaic: Address potential out-of-bounds read in respworker Although 'commit 2feec5ae5df7 accel/qaic: Handle DBC deactivation if the owner went away' fixes t...

Linux Distros Unpatched Vulnerability : CVE-2026-97997

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - virtioring: fix stale descriptor flags after a failed packed add In a packed ring the AVAIL and USED bits sit in the descriptor itself, so writing them makes th...

Linux Distros Unpatched Vulnerability : CVE-2026-98040

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Mark the zero register precise for a register-form NULL check checkcondjmpop accepts if rA rB as a NULL check for a nullable pointer rA when rB is a scala...

Linux Distros Unpatched Vulnerability : CVE-2026-97562

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb: client: pin DFS superblock in iterator callback tconsupercb stores a raw superblock pointer, but cifsgetsuper takes its active reference only after...

Linux Distros Unpatched Vulnerability : CVE-2026-98096

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipv6: sr: restore network header before routing and forwarding ipv6srhrcv runs with skb-data at the Segment Routing Header SRH while skbnetworkheader points at...

Linux Distros Unpatched Vulnerability : CVE-2026-97983

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - vduse: return compat ioctl results directly The compat handler handles VDUSEIOTLBGETFD and VDUSEVQGETINFO, but then calls the native handler. Their different...

Linux Distros Unpatched Vulnerability : CVE-2026-88369

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - zserge jsmn commit 25647e6 is vulnerable to Buffer Overflow in example/jsondump.c dump. CVE-2026-88369 Note that Nessus relies on the presence of the package as...

Linux Distros Unpatched Vulnerability : CVE-2026-98139

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ntfs: only count successfully cleared runs when freeing clusters ntfsclusterfreefromrlnolock adds a run's length to nrfreed whenever the error bookkeeping...

Ubuntu 22.04 LTS / 24.04 LTS : Linux kernel vulnerabilities (USN-8817-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8817-1 advisory. It was discovered that some Arm processors could complete a broadcast translation lookaside buffer TLB invalidation before memory writes made...

RockyLinux 9 : libxml2 (RLSA-2026:71585)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:71585 advisory. libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow CVE-2026-86138 libxml2: libxml2: Data integrity issues due to integer overflow...

Linux Distros Unpatched Vulnerability : CVE-2026-98007

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Reject non-scalar bpfloop iteration counts bpfloop declares its nrloops argument as ARGANYTHING. Privileged programs may pass pointer values to such...

Linux Distros Unpatched Vulnerability : CVE-2026-97993

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - vhost-vdpa: don't install the eventfdctxfdget error in configctx vhostvdpasetconfigcall swaps the eventfdctxfdget return value into v-configctx before checking...

Debian dla-4796 : evolution-data-server - security update

The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dla-4796 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4796-1 [email protected] https://www.debian.org/lts/security/...

Linux Distros Unpatched Vulnerability : CVE-2026-97537

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scsi: qla2xxx: Fix queue teardown NULL dmafree and bitmap locking qla25xxfreereqque and qla25xxfreerspque have two pre-existing bugs exposed on the error path o...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : rsyslog vulnerability (USN-8786-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8786-1 advisory. It was discovered that rsyslog incorrectly calculated buffer sizes when replacing strings. A remote...

RockyLinux 9 : perl-DBI (RLSA-2026:71422)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:71422 advisory. perl-DBI: DBI for Perl: Heap out-of-bounds write via unvalidated numeric placeholder CVE-2026-73194 Tenable has extracted the preceding description block directl...

Linux Distros Unpatched Vulnerability : CVE-2026-97546

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xfs: don't spin forever on zero-length dirents when salvaging them LOLLM noticed that xrepdirrecoverdata can spin forever if it encounters an unused dirent that...

Linux Distros Unpatched Vulnerability : CVE-2026-98046

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Mark bpfbtffindbynamekind as sleepable When bpfbtffindbynamekind finds a type in module BTF, it returns a new BTF object fd through btfnewfd. This reaches...

Linux Distros Unpatched Vulnerability : CVE-2026-97620

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/xe: Flush LSC untyped L1 dataport cache after rcs/ccs batches emitrendercacheflush sets PIPECONTROL0HDCPIPELINEFLUSH to flush the L2/HDC data cache before...

Linux Distros Unpatched Vulnerability : CVE-2026-95519

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using rpm -q -p or similar...

Linux Distros Unpatched Vulnerability : CVE-2026-98019

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: mark a NULL call argument precise checkfuncarg allows bpfregisterisnull for nullable arguments w/o marking the underlying scalar register precise. Hence a...

SUSE SLES16 Security Update : liboqs (SUSE-SU-2026:23313-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:23313-1 advisory. Changes in liboqs: Updated to 0.16.0: Deprecation notice: - SPHINCS+ was removed in 0.16.0. Security issues: - Fixed uninitialized...

Linux Distros Unpatched Vulnerability : CVE-2026-97605

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - erofs: preserve LZMA decoders on resize failure The pool-resize path frees each stream's old decoder before allocating its replacement. If an allocation fails...

Linux Distros Unpatched Vulnerability : CVE-2026-93221

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nfsd: convert nfsdnet boolean flags to unsigned long flags word nfsdnet contains several boolean fields that are accessed from concurrent contexts without...