Oracle Linux 10 : rest (ELSA-2026-47085)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-47085 advisory. 0.9.1-11.1 - Add patch for CVE-2026-16615 Weak random number generation in PKCE implementation Resolves: RHEL-213749 Tenable has extracted the preceding...

SUSE SLES12 Security Update : kernel (Live Patch 76 for SUSE Linux Enterprise 12 SP5) (SUSE-SU-2026:3388-1)

The remote SUSE Linux SLES12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3388-1 advisory. This update for the SUSE Linux Enterprise Kernel 4.12.14-122.290 fixes various security issues: The following security issues were fixed: -...

SUSE SLES16 Security Update : runc (SUSE-SU-2026:22942-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:22942-1 advisory. Update to 1.3.6. - CVE-2026-41579: malicious image with a /dev symlink can trigger limited host filesystem integrity violations...

Oracle Linux 8 : libXfont2 (ELSA-2026-47103)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-47103 advisory. 2.0.3-2.1 - CVE fix for: CVE-2026-56001, CVE-2026-56002, CVE-2026-56003 Resolves: https://redhat.atlassian.net/browse/RHEL-191877 Resolves:...

NewStart CGSL MAIN 6.06 : edk2 Multiple Vulnerabilities (NS-SA-2026-0057)

The remote NewStart CGSL host, running version MAIN 6.06, has edk2 packages installed that are affected by multiple vulnerabilities: - Existing CommBuffer checks in SmmEntryPoint will not catch underflow when computing BufferSize. CVE-2021-38578 - EDK2 is susceptible to a vulnerability in the...

NewStart CGSL MAIN 6.06 : glibc Vulnerability (NS-SA-2026-0058)

The remote NewStart CGSL host, running version MAIN 6.06, has glibc packages installed that are affected by a vulnerability: - The iconv function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EX...

Linux Distros Unpatched Vulnerability : CVE-2026-59920

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.136.Final and 4.2.16.Final, Netty's STOMP encoder...

TencentOS Server 4: java-8-konajdk (TSSA-2026:0744)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0744 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

F5 Networks BIG-IP : BIND vulnerability (K000162286)

The version of F5 Networks BIG-IP installed on the remote host is prior to 21.1.0. It is, therefore, affected by a vulnerability as referenced in the K000162286 advisory. If a BIND resolver is performing DNSSEC validation and encounters a maliciously crafted zone, the resolver may consume excessi...

SUSE SLES15: kernel-livepatch-5_14_21-150400_24_222-default / etc (SUSE-SU-2026:3350-1)

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3350-1 advisory. This update for the SUSE Linux Enterprise Kernel 5.14.21-150400.24.222 fixes various security issues: The following security issues were fixed:...

SUSE SLED15 / SLES15 Security Update : wget (SUSE-SU-2026:3337-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3337-1 advisory. This update for wget fixes the following issue - Fix metalink regression from CVE-2026-58469 fix bsc1272219, bsc1271033...

Linux Distros Unpatched Vulnerability : CVE-2026-24033

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server:...

TencentOS Server 3: freerdp (TSSA-2026:0774)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0774 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

Linux Distros Unpatched Vulnerability : CVE-2026-6949

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - To calculate the size of a DNS packet region signed by a TSIG record, Samba's internal DNS server subtracted the presumed size of the TSIG record. In cases wher...

Fedora 45 : goss (2026-68c59bf226)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-68c59bf226 advisory. Automatic update for goss-0.4.10-1.fc45. Changelog Wed Jul 29 2026 Carlos Rodriguez-Fernandez - 0.4.10-1 - Update to 0.4.10...

SUSE SLED15 / SLES15 Security Update : apache-sshd (SUSE-SU-2026:3339-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3339-1 advisory. Update to upstream version 2.19.0. Security issues fixed: - CVE-2026-56452: remote users can use SCP to send...

SUSE SLES12 Security Update : perl-HTTP-Date (SUSE-SU-2026:3334-1)

The remote SUSE Linux SLES12 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2026:3334-1 advisory. This update for perl-HTTP-Date fixes the following issue: - CVE-2026-14741: CPU exhaustion due to polynomial regex backtracking in parsedate when...

Linux Distros Unpatched Vulnerability : CVE-2026-64644

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Next.js is a React framework for building full-stack web applications. In versions 15.5.0 through 15.5.20 and 16.0.0 through 16.2.10, when self-hosting Next.js...

Linux Distros Unpatched Vulnerability : CVE-2026-44944

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An Incorrect Authorization vulnerability in open-iscsi allows unprivilidged local users to use the isscsiuio control socket. This issue affects open-iscsi: from...

Check Point Gaia Operating System (sk185153)

The remote host is missing a hotfix for the Gaia Operating System. It is, therefore, affected by a vulnerability as referenced in the sk185153 advisory. - A vulnerability in Check Point Gaia Portal allows an authenticated attacker with read-only Gaia Portal privileges to execute commands with roo...

TencentOS Server 4: nodejs20 (TSSA-2026:0665)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0665 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

SUSE SLES15: helm / helm-bash-completion / helm-fish-completion / etc (SUSE-SU-2026:3342-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3342-1 advisory. Update to version 3.21.3. - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for...

Fedora 43 : perl-HTTP-Date (2026-b1bdb7c518)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-b1bdb7c518 advisory. Changes: 6.08 2026-07-09 02:04:21Z - SECURITY Reject input longer than 64 characters in parsedate to prevent quadratic regex backtracking a denial of service...

Rockwell Automation CompactLogix Exposure of Sensitive System Information to an Unauthorized Control Sphere (CVE-2026-9307)

A sensitive information disclosure security issue exists within the affected CompactLogix 5370 controllers. The controller's web server exposes CIP Connection IDs on the diagnostics webpage, which are accessible to any unauthenticated user on the network. This information can be leveraged by an...

SUSE SLES16 Security Update : nginx (SUSE-SU-2026:22943-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:22943-1 advisory. This update for nginx fixes the following issues - CVE-2026-40460: bypass of authorization and bypass of rate limiting when NGINX ...

Linux Distros Unpatched Vulnerability : CVE-2026-62427

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. To manage the system, sysctl and...

RockyLinux 9 : nginx (RLSA-2026:36331)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:36331 advisory. nginx: NGINX: Arbitrary code execution or Denial of Service via heap-based buffer overflow with crafted HTTP/2 headers CVE-2026-42055 Bug Fixes and Enhancements:...

Linux Distros Unpatched Vulnerability : CVE-2026-64557

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: L2CAP: Fix use-after-free in l2capsocknewconnectioncb l2capsocknewconnectioncb returned l2cappisk-chan after releasesockparent. Once the parent lock ...

Linux Distros Unpatched Vulnerability : CVE-2026-59899

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, HttpContentEncoder the superclass of the...

SUSE SLES16: libopenssl-3-devel / libopenssl-3-fips-provider / etc (SUSE-SU-2026:22947-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:22947-1 advisory. This update for openssl-3 fixes the following issue: - HollowByte DoS via attacker-controlled memory allocation bsc1271712. Tenable has...

Microsoft Edge (Chromium) < 150.0.4078.65 Multiple Vulnerabilities

The version of Microsoft Edge installed on the remote Windows host is prior to 150.0.4078.65. It is, therefore, affected by multiple vulnerabilities as referenced in the July 28, 2026 advisory. - Use after free in InterestGroups in Google Chrome prior to 150.0.7871.115 allowed a remote attacker t...

Rockwell Automation CompactLogix Improper Validation of Integrity Check Value (CVE-2025-11694)

A security issue exists within the affected CompactLogix 5370 controllers due to missing validation of sequence numbers and source IP addresses in the CIP protocol. An attacker can abuse the exposed Connection IDs visible on the controller's web interface to send forged CIP packets, resulting in ...

Oracle Linux 8 : compat-libtiff3 (ELSA-2026-47183)

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-47183 advisory. 3.9.4-16 - fix CVE-2026-12912: heap-buffer-overflow in PixarLog ABGR decoding RHEL-189375 Tenable has extracted the preceding description block directly from t...

MiracleLinux 9 : postgresql:15 (AXSA:2026-1374:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1374:01 advisory. postgresql: PostgreSQL: Operating system account hijack via symlink following in pgbasebackup and pgrewind CVE-2026-6475 postgresql: PostgreSQL libp...

Linux Distros Unpatched Vulnerability : CVE-2026-62425

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. The directory and Rock Ridge / SU...

Linux Distros Unpatched Vulnerability : CVE-2026-33267

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.14, from 10.1.0 through 10.1....

TencentOS Server 4: nginx (TSSA-2026:0673)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0673 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

Fedora 43 : proftpd (2026-d314ce6051)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-d314ce6051 advisory. This update adds a new module, modprocfs, which is enabled by default. It addressses CVE-2026-35025 ACL bypass via /proc/self/root path prefix, by disallowin...

Linux Distros Unpatched Vulnerability : CVE-2026-64647

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a...

NewStart CGSL MAIN 6.06 : harfbuzz Vulnerability (NS-SA-2026-0052)

The remote NewStart CGSL host, running version MAIN 6.06, has harfbuzz packages installed that are affected by a vulnerability: - hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger On^2 growth via consecutive marks during the process of looking back for base glyphs whe...

FreeBSD : mailpit -- WebSocket origin check bypass via percent-encoded path (52a3f202-8a77-11f1-ac5d-0897988a1c07)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 52a3f202-8a77-11f1-ac5d-0897988a1c07 advisory. Mailpit author reports: The cross-site WebSocket hijacking fix was reimplemented as an origin check gat...

NewStart CGSL MAIN 6.06 : docker-ce Vulnerability (NS-SA-2026-0054)

The remote NewStart CGSL host, running version MAIN 6.06, has docker-ce packages installed that are affected by a vulnerability: - Moby is an open-source project created by Docker to enable software containerization. The classic builder cache system is prone to cache poisoning if the image is bui...

openSUSE 16 Security Update : agama-web-ui (openSUSE-SU-2026:21448-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21448-1 advisory. - CVE-2025-7783: form-data: unsafe Math.random function is used to select a boundary value for multipart form-encoded data bsc1246822. -...

MiracleLinux 9 : python-urllib3-1.26.5-8.el9_8 (AXSA:2026-1379:04)

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-1379:04 advisory. urllib3: urllib3: Denial of Service due to excessive HTTP response decompression CVE-2026-44432 urllib3: urllib3: Information disclosure via...

TencentOS Server 4: kernel (TSSA-2026:0708)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0708 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

NewStart CGSL MAIN 6.06 : emacs Vulnerability (NS-SA-2026-0059)

The remote NewStart CGSL host, running version MAIN 6.06, has emacs packages installed that are affected by a vulnerability: - In Emacs before 29.3, LaTeX preview is enabled by default for e-mail attachments. CVE-2024-30204 Note that Nessus has not tested for these issues but has instead relied...

Linux Distros Unpatched Vulnerability : CVE-2026-59901

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the Bzip2Decoder handler in Netty's...

SUSE SLED15: glib2-devel / glib2-lang / glib2-tools / libgio-2_0-0 / etc (SUSE-SU-2026:3341-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3341-1 advisory. - CVE-2026-58010: error during gvstupleisnormal alignment validation could cause a 1-byte out-of-bounds read...

Linux Distros Unpatched Vulnerability : CVE-2026-54332

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the sFlow ExtendedGatewayFlow decoder in layers/sflow.go reads an...

RockyLinux 8 : nodejs:22 (RLSA-2026:47059)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:47059 advisory. brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity CVE-2026-13149 tar: Node-tar: Denial of Service via malformed tar...