Linux Distros Unpatched Vulnerability : CVE-2026-82251

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gitoxide before 0.52.1 fails to validate submodule names from .gitmodules configuration, allowing path traversal when deriving submodule git directories...

Linux Distros Unpatched Vulnerability : CVE-2026-47893

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception...

Linux Distros Unpatched Vulnerability : CVE-2026-80674

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: ntfs: validate resident attribute lists and harden the validator A base inode's...

Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-11.2.0.2)

The version of AHV installed on the remote host is prior to 11.2.0.2. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-11.2.0.2 advisory. - A flaw was found in gnutls. Servers configured with RSA-PSK RivestShamirAdleman Pre-Shared Key wrongfully matched usernam...

MiracleLinux 8 : kernel-4.18.0-553.155.1.el8_10 (AXSA:2026-1705:70)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1705:70 advisory. kernel: udf: fix partition descriptor append bookkeeping CVE-2026-45991 kernel: ice: fix double-free of txbuf skb CVE-2026-53009 Tenable has extract...

Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-2106)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2106 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: nftcounter: serialize reset with spinlock CVE-2026-45897 In the Linux kernel, the following vulnerability has bee...

Amazon Linux 2 : thunderbird, --advisory ALAS2-2026-3880 (ALAS-2026-3880)

The version of thunderbird installed on the remote host is prior to 140.14.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3880 advisory. Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the...

Linux Distros Unpatched Vulnerability : CVE-2026-82608

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was determined in Kamailio up to 5.5.0/6.0.7. This affects the function get4bytes of the file src/modules/imsregistrarscscf/cxdxavp.c of the...

Linux Distros Unpatched Vulnerability : CVE-2026-82249

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gitoxide before 0.38.2 fails to validate carriage return characters in URL values passed to credential helpers. Attackers can supply URLs containing bare carria...

Linux Distros Unpatched Vulnerability : CVE-2026-47887

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an open...

Debian dla-4763 : amqp-tools - security update

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4763 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4763-1 [email protected]...

Linux Distros Unpatched Vulnerability : CVE-2026-80656

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: hfsplus: Add a sanity check for btree node size Syzbot reported an uninit-value bug in 1 wit...

RHEL 8 : libxml2 (RHSA-2026:61248)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:61248 advisory. The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fixes: libxml2: libxml2: Arbitrary code...

SUSE SLED15: docker / docker-bash-completion / docker-buildx / etc (SUSE-SU-2026:3818-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3818-1 advisory. This update for docker rebuilds it against the current go security release. Tenable has extracted the preceding...

Fedora 43 : opkssh (2026-8d9ba295e0)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-8d9ba295e0 advisory. Update the bundled github.com/go-chi/chi/v5 to v5.3.1, which is outside the range affected by CVE-2026-72815, CVE-2026-72816 and CVE-2026-72817 IP...

Linux Distros Unpatched Vulnerability : CVE-2026-39275

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cross Site Scripting vulnerability in Cockpit CMS v.2.13.5 and before allows a remote attacker to execute arbitrary code via the item.php, field-select.js and...

Amazon Linux 2023 : libsoup, libsoup-devel (ALAS2023-2026-2086)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2086 advisory. A vulnerability was found in libsoup's WebSocket frame parsing implementation. The library fails to validate length rules specified in RFC 6455 SS5.5, which mandates that all WebSocket control frames...

RHEL 9 : NetworkManager (RHSA-2026:61341)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:61341 advisory. NetworkManager is a system network service that manages network devices and connections, attempting to keep active network connectivity when...

Amazon Linux 2 : perl-DBI, --advisory ALAS2-2026-3871 (ALAS-2026-3871)

The version of perl-DBI installed on the remote host is prior to 1.627-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3871 advisory. DBI versions before 1.652 for Perl allow a heap out-of-bounds write via an unvalidated numeric placeholder that sets the binder...

F5 Networks BIG-IP : NLnet Labs Unbound vulnerability (K000163141)

The version of F5 Networks BIG-IP installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the K000163141 advisory. NLnet Labs Unbound up to and including version 1.25.0 has a denial of service vulnerability in the DNSSEC validator th...

Linux Distros Unpatched Vulnerability : CVE-2026-18702

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in MongoDB Server could allow an authenticated user with limited, database-scoped privileges to modify diagnostic logging settings that affect the enti...

Linux Distros Unpatched Vulnerability : CVE-2026-80601

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - batman-adv: gw: acquire ethernet header only after skb realloc The pskbmaypull called by batadvgetvid could reallocate the buffer behind the skb. Variables whic...

RHEL 8 : NetworkManager (RHSA-2026:61580)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:61580 advisory. NetworkManager is a system network service that manages network devices and connections, attempting to keep active network connectivity when...

Linux Distros Unpatched Vulnerability : CVE-2026-80696

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - hwmon: ltc4282 Fix reading the minimum alarm voltage Coverity reports an out-of-bounds access when reading the minimum alarm voltage for the VGPIO channel. Add...

Amazon Linux 2023 : log4j, log4j-jcl, log4j-slf4j (ALAS2023-2026-2072)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2072 advisory. Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache Log4j API versions 2.13....

Linux Distros Unpatched Vulnerability : CVE-2026-77310

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1,...

Linux Distros Unpatched Vulnerability : CVE-2026-59283

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Applications that evaluate Spring Expression Language SpEL expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL...

Amazon Linux 2023 : java-26-amazon-corretto, java-26-amazon-corretto-devel, java-26-amazon-corretto-headless (ALAS2023-2026-2101)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2101 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Security. Supported versions that are affected are Oracle Ja...

Oracle Linux 10 : ELSA-2026-60306-0: / golang (ELSA-2026-603060)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-603060 advisory. 1.26.7-1.0.1 - EXPERIMENTAL: Introduce fipsnoenforceems GODEBUG var 1.26.7-1 - Update to Go 1.26.7 fips-1 Tenable has extracted the preceding...

Fedora 43 : bluez (2026-d4eec45564)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-d4eec45564 advisory. BlueZ sdp-xml.c type confusion via RegisterProfileServiceRecord can crash bluetoothd local DoS: a crafted nested ServiceRecord can corrupt the SDP X...

Linux Distros Unpatched Vulnerability : CVE-2026-59314

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file...

Linux Distros Unpatched Vulnerability : CVE-2026-81495

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Ubuntu Linux - security update CVE-2026-81495 Note that Nessus relies on the presence of the package as reported by the vendor. %NASLMINLEVEL 80900 C Tenable,...

Linux Distros Unpatched Vulnerability : CVE-2026-80702

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/vmwgfx: fix guestmemorydirty bitfield clobbered as size Two sites in vmwgfxresource.c assign boolean literals to res-guestmemorysize, which is an unsigned...

Linux Distros Unpatched Vulnerability : CVE-2026-80605

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HID: picolcd: prevent NULL pointer dereference in picolcdsendandwait In picolcdsendandwait, an integer overflow of the signed loop counter 'k' can theoretically...

Linux Distros Unpatched Vulnerability : CVE-2026-47883

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue applies to the filter variants in both...

Linux Distros Unpatched Vulnerability : CVE-2026-59683

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The OpenRGB network protocol allows to write attacker controlled strings into arbitrary file system paths extension of CVE-2026-59682. This allows either a full...

Linux Distros Unpatched Vulnerability : CVE-2026-80723

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - of: reservedmem: prevent OOB when too many dynamic regions are defined On boot, fdtscanreservedmem saves each dynamically-placed /reserved-memory subnode into a...

Linux Distros Unpatched Vulnerability : CVE-2026-82660

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nodemailer before 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during message normalization in jsonTransport. Attackers can read local...

Linux Distros Unpatched Vulnerability : CVE-2026-82631

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A security flaw has been discovered in valkey-io valkey 9.1.0. The affected element is the function handleClientsBlockedOnKey of the file src/blocked.c of the...

Amazon Linux 2 : gd, --advisory ALAS2-2026-3870 (ALAS-2026-3870)

The version of gd installed on the remote host is prior to 2.0.35-27. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3870 advisory. NOTE: Fixed by: https://github.com/php/php-src/commit/b590f0380fda26ed180874a0255f0be078434315 php-8.4.24DEBIANBUG: 1143152...

Linux Distros Unpatched Vulnerability : CVE-2026-42211

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - React Router is a router for React. In versions 7.0.0 through 7.14.1, when using Framework Mode, a combination of steps could potentially allow unauthorized...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.4-2026-129 (ALASKERNEL-5.4-2026-129)

The version of kernel installed on the remote host is prior to 5.4.302-226.486. It is, therefore, affected by a vulnerability as referenced in the ALAS2KERNEL-5.4-2026-129 advisory. In the Linux kernel, the following vulnerability has been resolved: vhost: reset the vring metadata cache on vring...

RHEL 7 : xmlrpc-c (RHSA-2026:61234)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:61234 advisory. XML-RPC is a remote procedure call RPC protocol that uses XML to encode its calls and HTTP as a transport mechanism. The xmlrpc-c packages provide a...

Amazon Linux 2 : gstreamer-plugins-bad-free, --advisory ALAS2-2026-3896 (ALAS-2026-3896)

The version of gstreamer-plugins-bad-free installed on the remote host is prior to 0.10.23-42. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3896 advisory. A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when...

Amazon Linux 2023 : postgresql17, postgresql17-contrib, postgresql17-llvmjit (ALAS2023-2026-2076)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2076 advisory. Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds, via craft...

Amazon Linux 2023 : clamav1.4, clamav1.4-data, clamav1.4-devel (ALAS2023-2026-2084)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2084 advisory. A vulnerability in the PESpin file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory...

Amazon Linux 2 : vim, --advisory ALAS2-2026-3882 (ALAS-2026-3882)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3882 advisory. Vim is an open source, command line text editor. Prior to 9.2.0846, setsofo in src/spellfile.c reuses slsalfirst without resetting values left by setsalfirst, so a crafted spell file containing a...

RHEL 9 : libreswan (RHSA-2026:61779)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:61779 advisory. Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide...

SUSE SLES15 Security Update : kernel (Live Patch 57 for SUSE Linux Enterprise 15 SP4) (SUSE-SU-2026:3829-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3829-1 advisory. This update for the SUSE Linux Enterprise Kernel 5.14.21-150400.24.228 fixes various security issues: The following security issues were fixed:...

Linux Distros Unpatched Vulnerability : CVE-2026-80644

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ocfs2: don't BUGON an invalid journal dinode BUG A fuzzed OCFS2 image can corrupt the current slot journal dinode while mount is still in progress. The mount pa...