FreeBSD : py-mkdocs-material -- DOM XSS vulnerability (1976b049-8ccc-11f1-b333-901b0edee044)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 1976b049-8ccc-11f1-b333-901b0edee044 advisory. Martin Donath reports: Material for MkDocs 7.2.0 through 9.7.6 contains a DOM-based cross-site scriptin...

openSUSE 16: libpng16-16 / libpng16-16-x86-64-v3 / libpng16-compat-devel / etc (openSUSE-SU-2026:21479-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21479-1 advisory. Changes in libpng16: Version update to 1.6.58 jscPED-16190 see CHANGES for other upstream changes Tenable has extracted the preceding description block...

Oracle Linux 9 : kernel (ELSA-2026-47040)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-47040 advisory. - blk-mq: reinsert cached request to the list CKI Backport Bot RHEL-213163 CVE-2026-64017 - blk-mq: pop cached request if it is usable CKI Backport Bo...

openSUSE 16: mcphost / mcphost-bash-completion / mcphost-fish-completion / etc (openSUSE-SU-2026:21480-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21480-1 advisory. - CVE-2026-5160: github.com/yuin/goldmark/renderer: Cross-site Scripting due to improper URL validation bsc1272488. - CVE-2026-39821:...

openSUSE 16 Security Update : ignition (openSUSE-SU-2026:21482-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21482-1 advisory. - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege...

Linux Distros Unpatched Vulnerability : CVE-2026-56818

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - netty - None CVE-2026-56818 Note that Nessus relies on the presence of the package as reported by the vendor. %NASLMINLEVEL 80900 C Tenable, Inc...

Oracle Linux 7 : compat-libtiff3 (ELSA-2026-24992)

The remote Oracle Linux 7 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-24992 advisory. - Backport fix for CVE-2026-4775 Orabug: 39535879 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note...

Oracle Linux 7 : python-tornado (ELSA-2026-24342)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-24342 advisory. - Backport fix for CVE-2026-31958 Orabug: 39521310 Tenable has extracted the preceding description block directly from the Oracle Linux security...

openSUSE 16 Security Update : valkey (openSUSE-SU-2026:21485-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21485-1 advisory. Update to version 8.0.10. - CVE-2026-56684: RCE via CLIENT KILL due to use-after-free in TLS connection handling bsc1272443. - CVE-2026-63639: R...

openSUSE 16: tomcat11 / tomcat11-admin-webapps / tomcat11-el-6_0-api / etc (openSUSE-SU-2026:21490-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21490-1 advisory. This update for tomcat11 fixes the following issues - Update to Tomcat 11.0.24 - CVE-2026-59083: Incorrect URL decoding in RewriteValve may allo...

Oracle Linux 10 : nodejs24 (ELSA-2026-35841)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-35841 advisory. 1:24.18.0-1.0.1 - Update upstream references 1:24.18.0-1 - Update to version 24.18.0 1:24.14.1-3 - De-bundle c-ares and libuv Tenable has extracted t...

SUSE SLED15 / SLES15 Security Update : runc (SUSE-SU-2026:3433-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3433-1 advisory. Update to 1.3.6. - CVE-2026-41579: malicious image with a /dev symlink can trigger limited host filesystem...

Linux Distros Unpatched Vulnerability : CVE-2026-64607

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or...

Oracle Linux 8 : openssh (ELSA-2026-47755)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-47755 advisory. - CVE-2026-55653: Fix double free in openssh DH-GEX client path during FIPS known-group validation that leads to client-side denial of service Resolve...

Oracle Linux 10 : nodejs22 (ELSA-2026-35842)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-35842 advisory. - CVE-2026-42338 ip-address HTML escaping fix. Tenable has extracted the preceding description block directly from the Oracle Linux security advisory...

Oracle Linux 8 : javapackages-tools:201801 (ELSA-2026-41948)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-41948 advisory. - Resolves: CVE-2019-10086, CVE-2025-48734 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that...

openSUSE 16 Security Update : s2n (openSUSE-SU-2026:21501-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21501-1 advisory. Changes in s2n: - CVE-2026-16318: Denial of Service due to memory leak in QUIC transport parameters handler bsc1272352 - CVE-2026-16317:...

Linux Distros Unpatched Vulnerability : CVE-2026-62867

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - incus - None CVE-2026-62867 Note that Nessus relies on the presence of the package as reported by the vendor. %NASLMINLEVEL 80900 C Tenable, Inc...

Linux Distros Unpatched Vulnerability : CVE-2026-62941

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - incus - None CVE-2026-62941 Note that Nessus relies on the presence of the package as reported by the vendor. %NASLMINLEVEL 80900 C Tenable, Inc...

openSUSE 16 Security Update : keybase-client (openSUSE-SU-2026:21492-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21492-1 advisory. Changes in keybase-client: - CVE-2026-39824: failure to reject ASCII-only Punycode-encoded labels Tenable has extracted the preceding description block...

openSUSE 16 Security Update : chromium (openSUSE-SU-2026:21498-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21498-1 advisory. Changes in chromium: - Chromium 150.0.7871.186 boo1272460: CVE-2026-16807: Out of bounds write in Codecs CVE-2026-16806: Use after free in WebMC...

Debian dla-4710 : chromium - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4710 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4710-1 [email protected]...

Linux Distros Unpatched Vulnerability : CVE-2026-62940

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - incus - None CVE-2026-62940 Note that Nessus relies on the presence of the package as reported by the vendor. %NASLMINLEVEL 80900 C Tenable, Inc...

openSUSE 16 Security Update : apptainer (openSUSE-SU-2026:21499-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21499-1 advisory. Changes in apptainer: - Update to version 1.5.3: If the ptrace system call does not work while building an image as an unprivileged user, skip...

Debian dsa-6408 : chromium - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6408 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6408-1 [email protected] https://www.debian.org/securit...

openSUSE 16 Security Update : google-guest-agent (openSUSE-SU-2026:21476-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21476-1 advisory. - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege...

openSUSE 16 Security Update : yq (openSUSE-SU-2026:21500-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21500-1 advisory. Changes in yq: - Update the golang.org/x/net dependency to version v0.57.0 to fix CVE-2026-39821 for good bsc1267199. - update to v4.53.3 Add...

Linux Distros Unpatched Vulnerability : CVE-2026-62313

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - incus - None CVE-2026-62313 Note that Nessus relies on the presence of the package as reported by the vendor. %NASLMINLEVEL 80900 C Tenable, Inc...

Oracle Linux 9 : nodejs:24 (ELSA-2026-47057)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-47057 advisory. - Fix CVE-2026-59873, CVE-2026-59874 node-tar in npm's bundled tar - Fix CVE-2026-13149 brace-expansion in npm's bundled brace-expansion Tenable has...

Oracle Linux 8 : nodejs:22 (ELSA-2026-47059)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-47059 advisory. - Backport patches for various CVEs Fixes: CVE-2026-59873 CVE-2026-59874 CVE-2026-13149 Resolves: RHEL-193842 RHEL-193874 RHEL-208661 - Update to...

openSUSE 16: openvpn / openvpn-auth-pam-plugin / openvpn-devel / etc (openSUSE-SU-2026:21488-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21488-1 advisory. - CVE-2026-13122: denial of service via a malformed authentication token that triggers a reachable assertion when external-auth is enabled...

Linux Distros Unpatched Vulnerability : CVE-2026-65981

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, a server using --mobility authenticates a resumed REFRESH request with the...

openSUSE 16 Security Update : nsd (openSUSE-SU-2026:21502-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21502-1 advisory. Changes in nsd: - Update nsd.keyring - update to 4.14.3: https://github.com/NLnetLabs/nsd/blob/NSD4143REL/doc/ChangeLog CVE-2026-12490: Bypass o...

SUSE SLES15 Security Update : google-osconfig-agent (SUSE-SU-2026:3432-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3432-1 advisory. This update for google-osconfig-agent fixes the following issues - CVE-2026-39821: golang.org/x/net/idna: failure to reject...

Oracle Linux 9 : nodejs:22 (ELSA-2026-47058)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-47058 advisory. - Fix CVE-2026-59873, CVE-2026-59874 node-tar by rebasing npm's bundled tar to 7.5.19 - Fix CVE-2026-13149 brace-expansion in npm's bundled...

Linux Distros Unpatched Vulnerability : CVE-2026-54787

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity...

Oracle Linux 10 : java-25-openjdk (ELSA-2026-42899)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-42899 advisory. 25.0.4.0.7-1.1.0.1 - Add Oracle vendor bug URL Orabug: 34340155 1:25.0.4.0.7-1.0 - Update to jdk-25.0.4+7 GA - Update release notes to 25.0.4+7 - Bum...

openSUSE 16 Security Update : perl-YAML-Syck (openSUSE-SU-2026:21497-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21497-1 advisory. Changes in perl-YAML-Syck: - updated to 1.470.0 1.47 Security - Fix four libsyck memory-safety CVEs reachable from the default YAML::Syck::Load...

Linux Distros Unpatched Vulnerability : CVE-2026-54909

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pion/stun is a Go implementation of STUN. Prior to 3.1.3, XORMappedAddress.GetFromAs can panic while parsing a malformed short XOR-MAPPED-ADDRESS attribute in...

openSUSE 16: bind / bind-modules-bdbhpt / bind-modules-generic / etc (openSUSE-SU-2026:21489-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21489-1 advisory. This update for bind fixes the following issues - Upgrade to release 9.20.26 - CVE-2026-10723: Incorrect acceptance of NSEC3 records bsc1271982....

Microsoft Edge (Chromium) < 151.0.4129.59 Multiple Vulnerabilities

The version of Microsoft Edge installed on the remote Windows host is prior to 151.0.4129.59. It is, therefore, affected by multiple vulnerabilities as referenced in the July 31, 2026 advisory. - Use after free in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute...

Linux Distros Unpatched Vulnerability : CVE-2026-63343

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - incus - None CVE-2026-63343 Note that Nessus relies on the presence of the package as reported by the vendor. %NASLMINLEVEL 80900 C Tenable, Inc...

Linux Distros Unpatched Vulnerability : CVE-2026-63125

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - incus - None CVE-2026-63125 Note that Nessus relies on the presence of the package as reported by the vendor. %NASLMINLEVEL 80900 C Tenable, Inc...

Oracle Linux 8 : kernel (ELSA-2026-47011)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-47011 advisory. 4.18.0-553.148.1 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to t...

SUSE SLES12 Security Update : perl-Net-DNS (SUSE-SU-2026:3431-1)

The remote SUSE Linux SLES12 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2026:3431-1 advisory. This update for perl-Net-DNS fixes the following issue - CVE-2026-64194: RFC 1035 compression pointers are followed via recursion with no depth limit...

Oracle Linux 10 : kernel (ELSA-2026-47017)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-47017 advisory. - ipv6: fix possible UAF in icmpv6rcv CKI Backport Bot RHEL-192215 CVE-2026-53006 - tipc: fix double-free in tipcbufappend CKI Backport Bot RHEL-1921...

Photon OS 5.0: Libsolv PHSA-2026-5.0-0935

An update of the libsolv package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-0935. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

openSUSE 16: tomcat10 / tomcat10-admin-webapps / tomcat10-el-5_0-api / etc (openSUSE-SU-2026:21487-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21487-1 advisory. Update to Tomcat 10.1.57. Security issues fixed: - CVE-2026-59083: incorrect URL decoding in RewriteValve may allow security control bypass...

openSUSE 16: tomcat / tomcat-admin-webapps / tomcat-el-3_0-api / tomcat-embed / etc (openSUSE-SU-2026:21486-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21486-1 advisory. Update to Tomcat 9.0.120. Security issues fixed: - CVE-2026-59083: incorrect URL decoding in RewriteValve may allow security control bypass...

FreeBSD : ejabberd -- Multiple security vulnerabilities (ca42379d-8d45-11f1-a129-901b0e9408dc)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the ca42379d-8d45-11f1-a129-901b0e9408dc advisory. ejabberd team reports: Tenable has extracted the preceding description block directly from the FreeBSD...