Rocky Linux 8 [CIQ] Security Update: ghostscript / ghostscript-debuginfo / ghostscript-debugsource / etc (crlsa-2026_93978)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202693978 advisory. ghostscript: Reintroduction of .charkeys -dSAFER bypass in Rocky Linux 8 CVE-2026-112177 Tenable has extracted the preceding description block directly from the CI...

Linux Distros Unpatched Vulnerability : CVE-2026-120954

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A weakness in the BSON library's handling of a specialized binary vector data type allows an arithmetic wraparound when computing the number of elements describ...

Linux Distros Unpatched Vulnerability : CVE-2026-121541

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Docker Buildx versions v0.19.0 through v0.38.0, an untrusted Bake definition that builds multiple targets together may expose files accessible to the Buildx...

Fedora 43 : python3.15 (2026-5e4931d206)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-5e4931d206 advisory. - Update to Python 3.15.2 - CVE 2026-114583: tar filter allows writing outside destination via empty-named symlink - CVE 2026-115557: Distrust compromised...

Rocky Linux 9 [CIQ] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc Multiple Vulnerabilities (crlsa-2026_93469)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202693469 advisory. tomcat: Apache Tomcat: Security constraint bypass due to improper access control CVE-2026-65182 tomcat: Apache Tomcat: Access control bypass due to...

AlmaLinux 9.6 [TuxCare] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1793866396)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793866396 advisory. - In the Linux kernel, the following vulnerability has been resolved: rv: Use strings in da monitors tracepoints Using DA monitors...

FreeBSD : openvox -- Flawed Hostname Check allows Puppet Client Impersonation (6cd47e21-d8db-11f1-8d43-18cf5efc6bb4)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 6cd47e21-d8db-11f1-8d43-18cf5efc6bb4 advisory. The OpenVoxProject reports: Trapperkeeper is the framework we use for running our Clojure based...

Linux Distros Unpatched Vulnerability : CVE-2026-119555

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 contain an information disclosure vulnerability in the...

Linux Distros Unpatched Vulnerability : CVE-2026-121172

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in Isolated in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to spoof UI elements via a crafted HTML page. Chromium...

Linux Distros Unpatched Vulnerability : CVE-2026-121438

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mistune before 3.3.3 contains a denial of service vulnerability in InlineParser.parselink that allows attackers to cause quadratic CPU growth by supplying...

RHEL 10 : opentelemetry-collector (RHSA-2026:95016)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:95016 advisory. Collector with the supported components for a Red Hat build of OpenTelemetry Security Fixes: net/http: golang: golang: Denial of Service v...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : GVfs vulnerabilities (USN-8970-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8970-1 advisory. It was discovered that GVfs did not properly validate data returned by an SFTP server. A remote attacker could possibly use this...

Linux Distros Unpatched Vulnerability : CVE-2026-120754

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HDF5 through 2.2.0 contains an uninitialized memory read vulnerability in H5Zfilterscaleoffset in src/H5Zscaleoffset.c. The decode path validates reads against...

Linux Distros Unpatched Vulnerability : CVE-2026-121408

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.32.2 contains a use-after-free in the urbdrc USB redirection channel because FindChannelById returns a channel pointer without a reference and...

Linux Distros Unpatched Vulnerability : CVE-2026-118447

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A use of uninitialized memory vulnerability in the pybddisasm Python bindings may disclose process memory when instruction decoding fails. The nddecode,...

Linux Distros Unpatched Vulnerability : CVE-2026-121218

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-121212

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium...

FreeBSD : Krill -- multiple vulnerabilities (07fc222f-d798-11f1-934c-3c7c3fba4204)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 07fc222f-d798-11f1-934c-3c7c3fba4204 advisory. NLnet Labs reports: Tenable has extracted the preceding description block directly from the...

Ubuntu 16.04 LTS : Deluge vulnerabilities (USN-8979-1)

The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8979-1 advisory. It was discovered that the web UI in Deluge did not protect against cross- site request forgery. A remote attacker could possibly use this issue to trick...

Linux Distros Unpatched Vulnerability : CVE-2026-121194

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing authorization in SiteIsolation in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to obtain...

Linux Distros Unpatched Vulnerability : CVE-2026-121225

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access...

Rocky Linux 9 [CIQ] Security Update: libXi / libXi-debuginfo / libXi-debugsource / libXi-devel Multiple Vulnerabilities (crlsa-2026_93439)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202693439 advisory. libXi: libXi: Arbitrary code execution via oversized DEVICEENABLE reply CVE-2026-109090 libXi: libXi: Arbitrary code execution via DEVICERESOLUTION...

Linux Distros Unpatched Vulnerability : CVE-2026-115696

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - iwd - None Ubuntu Linux - Unknown description CVE-2026-115696 Note that Nessus relies on the presence of the package as reported by the vendor...

Oracle Linux 10 : gcc-toolset-15-gcc (ELSA-2026-89891)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-89891 advisory. 15.2.1-7.1 - fix CVE-2026-102010, PR libstdc++/127656 RHEL-272094 Tenable has extracted the preceding description block directly from the Oracle Linux securit...

RockyLinux 8 : raptor2 (RLSA-2026:94519)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:94519 advisory. raptor2: raptor2: arbitrary code execution via heap-based buffer overflow in language tag handling CVE-2025-71436 Tenable has extracted the preceding description...

Linux Distros Unpatched Vulnerability : CVE-2026-121069

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Track in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-121105

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Information leak in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium...

Fedora 44 : mingw-qt6-qt5compat (2026-053b48bab1)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-053b48bab1 advisory. Backport fix for CVE-2026-101201. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

Linux Distros Unpatched Vulnerability : CVE-2026-119416

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CakePHP through 5.4.3 contains an improper cookie domain validation vulnerability in the Http Client CookieCollection that allows malicious servers to receive a...

Linux Distros Unpatched Vulnerability : CVE-2026-121036

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in CSS in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-121071

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute...

Linux Distros Unpatched Vulnerability : CVE-2026-104895

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The asynchronous Smile parser NonBlockingByteArrayParser uses a raw-binary length prefix taken from untrusted input to allocate a byte before the body is read,...

RockyLinux 10 : fence-agents (RLSA-2026:94501)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:94501 advisory. pyjwt: pyjwt: Authentication bypass via empty HMAC key acceptance CVE-2026-102266 pyjwt: PyJWT: Authentication bypass via improper public key validatio...

Linux Distros Unpatched Vulnerability : CVE-2026-121073

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via crafte...

Linux Distros Unpatched Vulnerability : CVE-2026-121091

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to obtain...

Linux Distros Unpatched Vulnerability : CVE-2026-121077

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Mobile in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code...

Linux Distros Unpatched Vulnerability : CVE-2026-121169

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy vi...

Linux Distros Unpatched Vulnerability : CVE-2026-120678

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A memory management flaw in the MongoDB C Driver's handling of compressed responses may cause the client library to hold on to memory that is never released. An...

MiracleLinux 8 : ghostscript-9.27-20.el8_10 (AXSA:2026-2241:05)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-2241:05 advisory. ghostscript: Reintroduction of .charkeys -dSAFER bypass in RHEL 8 CVE-2026-112177 Tenable has extracted the preceding description block directly from the...

Linux Distros Unpatched Vulnerability : CVE-2026-121093

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Out of bounds read in Animation in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HT...

Fedora 45 : ags (2026-3535e20761)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-3535e20761 advisory. Latest upstream bugfix release from 3.6.2 branch. Changes: https://github.com/adventuregamestudio/ags/releases/tag/v3.6.2.22 . Also fixes CVE-2026-95512 in...

Linux Distros Unpatched Vulnerability : CVE-2026-121186

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - UI misrepresentation in Passwords in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements...

RHEL 9 : webkit2gtk3 (RHSA-2026:95194)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:95194 advisory. WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fixes: chromium-browser: skia:...

Linux Distros Unpatched Vulnerability : CVE-2026-121102

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing authorization in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-120955

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The GridFS file download API in the MongoDB C Driver does not check the result of an internal operation under certain error conditions during file retrieval. Th...

RHEL 8 : pki-core:10.6 (RHSA-2026:95181)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:95181 advisory. The public key infrastructure PKI core rpm contains fundamental packages required by Red Hat Certificate System. Security Fixes: pki-core: Dogtag/PK...

Linux Distros Unpatched Vulnerability : CVE-2026-121256

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use of released resource in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execut...

Linux Distros Unpatched Vulnerability : CVE-2026-121179

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in PDFium in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-120641

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CGI versions before 5.00 for Perl return upload filenames with any client-supplied path, including ../ and Windows paths. The name returned for an uploaded file...

Linux Distros Unpatched Vulnerability : CVE-2026-121090

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper privilege management in Navigation in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process...