Linux Distros Unpatched Vulnerability : CVE-2026-67413

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.23, 4.1.14, 4.2.9, and 4.3.3, the optional rabbitmqjmstopicexchange plugin's x-jms-topic...

Linux Distros Unpatched Vulnerability : CVE-2026-88351

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An integer overflow vulnerability exists in the MPack Node API in MPack 1.1.1 on 32-bit platforms. When parsing a specially crafted MessagePack array32 or map32...

Linux Distros Unpatched Vulnerability : CVE-2026-88832

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata, causing a heap buffer overflow when processing crafted filesystem images...

Linux Distros Unpatched Vulnerability : CVE-2026-88837

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - BusyBox httpd treats yescrypt $y$ password hashes as plaintext during Basic Authentication, inverting the authentication check. CVE-2026-88837 Note that Nessus...

Linux Distros Unpatched Vulnerability : CVE-2026-91187

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Verification of Cryptographic Signature vulnerability in dashbit nimblezta allows an unauthenticated remote attacker to authenticate as an arbitrary...

Linux Distros Unpatched Vulnerability : CVE-2026-93209

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: hcicore: use skbget instead of skbclone for reqskb BT enable fails intermittently with -ETIMEDOUT -110. The kernel log shows the HCI Read Local Versi...

Linux Distros Unpatched Vulnerability : CVE-2026-93221

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nfsd: convert nfsdnet boolean flags to unsigned long flags word nfsdnet contains several boolean fields that are accessed from concurrent contexts without...

Linux Distros Unpatched Vulnerability : CVE-2026-93222

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - signal: avoid shared siginfo namespace rewrites sendsignallocked rewrites sender ids for the target namespace. Group sends reuse the same siginfo, so one...

Linux Distros Unpatched Vulnerability : CVE-2026-93230

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier Gigantic bootmem HugeTLB pages are currently initialized from hugetlbinit, but...

Linux Distros Unpatched Vulnerability : CVE-2026-95519

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using rpm -q -p or similar...

Linux Distros Unpatched Vulnerability : CVE-2026-67223

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RabbitMQ is a messaging and streaming broker. The advisory establishes affected 3.13, 4.0, 4.1, 4.2, and 4.3 maintenance lines but contains conflicting...

Linux Distros Unpatched Vulnerability : CVE-2026-67239

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.18 and 4.0.23 and 4.1.14 and 4.2.9 and 4.3.3, Stored XSS via TLS peer-certificate DN in...

Linux Distros Unpatched Vulnerability : CVE-2026-97528

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error qlanvmexmtlsrsp obtains uctx, which was linked into fcport-unsolctxhead by...

Linux Distros Unpatched Vulnerability : CVE-2026-97562

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb: client: pin DFS superblock in iterator callback tconsupercb stores a raw superblock pointer, but cifsgetsuper takes its active reference only after...

Linux Distros Unpatched Vulnerability : CVE-2026-97574

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bnxten: Don't free the live ring's TPA state on queue restart failure bnxtqueuememalloc shallow copies the live RX ring into the clone: memcpyclone, rxr,...

Linux Distros Unpatched Vulnerability : CVE-2026-97579

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - media: mediatek: vcodec: bound AV1 tile-start copy to the array capacity vdecav1slicesetuptile copies tilecols + 1 / tilerows + 1 entries into micolstarts /...

Linux Distros Unpatched Vulnerability : CVE-2026-97585

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - afs: Fix double-unmap of directory block Fix afseditdirremove to use a cleanup function to unmap the block pointed to by afsdiriter::block if it's left pointing...

Linux Distros Unpatched Vulnerability : CVE-2026-97590

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - s390/crypto: Fix missing scrub of temp buffers with PAES algorithm In function ctrpaesdocrypt there is a buffer used to process remaining bytes AESBLOCKSIZE. Th...

Linux Distros Unpatched Vulnerability : CVE-2026-97989

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - vduse: validate virtqueue alignment vdusevalidateconfig only checks the upper bound of vqalign. Invalid values can therefore reach vringcreatevirtqueuemap. The...

Linux Distros Unpatched Vulnerability : CVE-2026-98007

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Reject non-scalar bpfloop iteration counts bpfloop declares its nrloops argument as ARGANYTHING. Privileged programs may pass pointer values to such...

Linux Distros Unpatched Vulnerability : CVE-2026-98020

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pdscore: fix cmdregs access racing BAR unmap on reset pdscresetprepare and pdscresetdone's pdscmapbars error path clear/iounmap cmdregs without devcmdlock, and...

Linux Distros Unpatched Vulnerability : CVE-2026-98047

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Check ancestor frames for rbtree callbacks bpfrbtreeadd invokes its comparator while the caller holds the root lock. The native insertion code retains raw...

Linux Distros Unpatched Vulnerability : CVE-2026-98058

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Mark syscall helpers as sleepable bpfsysbpf executes the bpf2 syscall body, which can take mutexes, allocate with GFPKERNEL, and wait for an RCU grace...

Linux Distros Unpatched Vulnerability : CVE-2026-98080

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - btrfs: do not force reloc root creation during qgroupaccountsnapshot BUG When running btrfs/252 with quota enabled through MKFSOPTIONS=-O quota, it has a high...

Linux Distros Unpatched Vulnerability : CVE-2026-98093

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ASoC: fslmicfil: balance mclk enable/disable hwparams enables mclk unconditionally and hwfree disables it unconditionally, but the PCM core does not guarantee 1...

Linux Distros Unpatched Vulnerability : CVE-2026-98094

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - staging: fbtft: make dirtylock IRQ-safe fbtftmkdirty can be reached from the fbcon rendering path while processing printk in hardirq context. Meanwhile,...

Linux Distros Unpatched Vulnerability : CVE-2026-98119

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfs: break unbuffered write when netfsallocsubrequest fails syzbot reported a null-ptr-deref below 1 following a fault injection in netfsallocsubrequest. 0 Wh...

Linux Distros Unpatched Vulnerability : CVE-2026-97543

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xfs: destroy seen inode bitmap when we fail to add a dirpath LOLLM observes a memory leak in xchkdirtreecreatepath if we create the directory path object but...

Linux Distros Unpatched Vulnerability : CVE-2026-97554

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb: client: avoid using uninitialized SIDs in cifsposixtofattr cifsposixtofattr ignores the return value of posixinfoparse. When a malformed POSIX directory...

Linux Distros Unpatched Vulnerability : CVE-2026-97621

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/rockchip: analogixdp: fix unchecked bound endpoint name length rockchipdpdrmencoderenable uses sprintf to format a device tree path into a 32-byte stack...

Linux Distros Unpatched Vulnerability : CVE-2026-97900

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/drmexec: fix up contended obj when numobjects is 0 drmexecpreparearray silently returns success without calling drmexeclockcontended when numobjects is zero...

Linux Distros Unpatched Vulnerability : CVE-2026-97908

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hcidev The command and ACL RPMsg endpoints store struct btqcomsmd as their callback private data. T...

Linux Distros Unpatched Vulnerability : CVE-2026-97916

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - accel/ivpu: Validate firmware log buffer metadata The tracing log headers parsed by fwlogprintbuffer reside in DMA-shared BOs that the NPU firmware can write to...

Linux Distros Unpatched Vulnerability : CVE-2026-97919

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tracing: Take the reference before publishing the named histogram trigger eventhisttriggernamedinit puts the trigger on the global namedtriggers list and only...

Linux Distros Unpatched Vulnerability : CVE-2026-97932

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tracing: Don't dereference traceeventfile in deferred trigger free The enableevent trigger defers traceeventputref to the trigger free kthread, but the...

Linux Distros Unpatched Vulnerability : CVE-2026-97935

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tracing: Set the trace clock before registering the histogram trigger histregistertrigger puts the trigger on the global namedtriggers list in cmdops-init, and...

Linux Distros Unpatched Vulnerability : CVE-2026-97950

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - configfs: pin the symlink target's dirent instead of chasing -cidentry createlink reads the target's configfsdirent from item-cidentry-dfsdata, relying on the...

Linux Distros Unpatched Vulnerability : CVE-2026-97966

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - octeontx2-pf: reset HTB scheduler topology before freeing queues HTB offload programs NIXAFTLxXTOPOLOGY on QoS-allocated scheduler queues via...

Linux Distros Unpatched Vulnerability : CVE-2026-97967

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - hwmon: corsair-cpro Remove debugfs entries when probe fails ccpdebugfsinit registers debugfs files whose private data is the devm allocated ccp. If...

Linux Distros Unpatched Vulnerability : CVE-2026-97980

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - s390/debug: Fix NULL pointer dereference in debugsetlevel Commit a2cec6863709 s390/debug: Add s390dbf kernel parameter incorrectly removed a null-id check from...

Linux Distros Unpatched Vulnerability : CVE-2026-97983

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - vduse: return compat ioctl results directly The compat handler handles VDUSEIOTLBGETFD and VDUSEVQGETINFO, but then calls the native handler. Their different...

Linux Distros Unpatched Vulnerability : CVE-2026-97985

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - afunix: Update last skb marker in manageoob. Fahad Alharbi reported that blocking recvMSGPEEK could hog CPU due to OOB skb. In the following cases, manageoob...

Linux Distros Unpatched Vulnerability : CVE-2026-97993

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - vhost-vdpa: don't install the eventfdctxfdget error in configctx vhostvdpasetconfigcall swaps the eventfdctxfdget return value into v-configctx before checking...

openSUSE 16 Security Update : jsoup, re2j (openSUSE-SU-2026:21900-1)

"The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21900-1 advisory. This update for jsoup, re2j fixes the following issue: - CVE-2026-75140: The builder copies the entire inherited namespace map on every start element,...

openSUSE 16 Security Update : apptainer (openSUSE-SU-2026:21927-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21927-1 advisory. Changes in apptainer: - Fix potential authentication bypass and deadlocks in the crypto/ssh library by updating golang.org/x/crypto to v0.56.0...

Linux Distros Unpatched Vulnerability : CVE-2026-93241

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - memcg: bypass the reclaim and oom killer for dying tasks once oomreaper is done At Meta, we are seeing instances where an OOM killed job is stuck in the exit pa...

openSUSE 16 Security Update : google-osconfig-agent (openSUSE-SU-2026:21882-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21882-1 advisory. - CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs...

Oracle Linux 9 : buildah (ELSA-2026-70640)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-70640 advisory. - rebuild for CVE-2026-56853 CVE-2026-56858 CVE-2026-33818 CVE-2026-56860 CVE-2026-56862 - Ensures golang.org/x/crypto v0.53.0 for CVE-2026-46597 fix...

openSUSE 16 Security Update : amazon-ssm-agent (openSUSE-SU-2026:21884-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21884-1 advisory. - CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library bsc127868...

Ubuntu 26.04 LTS : NetworkManager vulnerability (USN-8806-1)

The remote Ubuntu 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8806-1 advisory. It was discovered that NetworkManager did not properly restrict the ca-path and phase2-ca-path certificate authority settings for private single-user 802.1X netwo...