MiracleLinux 9 : kernel-5.14.0-687.53.1.el9_8 (AXSA:2026-2240:115)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2240:115 advisory. kernel: ext4: fix e4b bitmap inconsistency reports CVE-2026-45942 kernel: RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGESIZE...

Linux Distros Unpatched Vulnerability : CVE-2026-121207

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uninitialized resource in Dawn in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML...

Linux Distros Unpatched Vulnerability : CVE-2026-121108

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Confused deputy in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML...

MiracleLinux 9 : dotnet8.0-8.0.132-1.el9_8.ML.1 (AXSA:2026-2161:21)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2161:21 advisory. dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability CVE-2026-58280 dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET...

Ubuntu 26.04 LTS : SOGo vulnerability (USN-8993-1)

The remote Ubuntu 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8993-1 advisory. It was discovered that SOGo used the client-supplied Origin header when constructing password reset links. A remote attacker could possibly use this issue to obta...

Linux Distros Unpatched Vulnerability : CVE-2026-121242

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper input validation in WebPackaging in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via crafted network...

Linux Distros Unpatched Vulnerability : CVE-2026-121174

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing authorization in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-121404

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server that allows authenticated RDP clients to spin server threads by sending...

Linux Distros Unpatched Vulnerability : CVE-2026-120434

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a stack-based buffer overflow in picttoppm's scanPoly function in...

Linux Distros Unpatched Vulnerability : CVE-2026-121402

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.32.2 contains a NULL pointer dereference vulnerability that allows malicious RDP servers to crash xfreerdp clients by sending a zero-width RDPG...

Linux Distros Unpatched Vulnerability : CVE-2026-121248

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in API in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted Chrome...

Linux Distros Unpatched Vulnerability : CVE-2026-121136

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access...

Linux Distros Unpatched Vulnerability : CVE-2026-121126

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted...

RHEL 9 : flatpak (RHSA-2026:95063)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:95063 advisory. Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Security Fixes: flatpak: flatpak:...

Linux Distros Unpatched Vulnerability : CVE-2026-121170

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper resource control in WebCodecs in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-121238

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Source in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-121175

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper resource exposure in ORB in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass site isolation via a crafted HTML page. Chromium...

Linux Distros Unpatched Vulnerability : CVE-2026-121159

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in History in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access...

Oracle Linux 8 : glibc (ELSA-2026-80798)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-80798 advisory. - CVE-2026-77117: Non-progress DoS in SHIFTJISX0213 decoding RHEL-248056 - CVE-2026-80489: Non-progress DoS in EUCJISX0213 decoding RHEL-249638 -...

Linux Distros Unpatched Vulnerability : CVE-2026-121043

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - UI misrepresentation in Payments in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a...

TencentOS Server 2: gstreamer1-plugins-good (TSSA-2026:1364)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1364 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities...

Linux Distros Unpatched Vulnerability : CVE-2026-119419

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated collation values to StringExpression...

TencentOS Server 2: libssh2 (TSSA-2026:1355)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1355 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities...

AlmaLinux 9.6 [TuxCare] Security Update: freeipmi / freeipmi-bmc-watchdog / freeipmi-devel / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1793815103)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793815103 advisory. - FreeIPMI before 1.6.19 has a stack-based buffer overflow in ipmiseloemfujitsugetselentrylongtext in...

Linux Distros Unpatched Vulnerability : CVE-2026-121124

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper adherence to coding standards in XML in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : GNOME Shell vulnerability (USN-8971-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8971-1 advisory. It was discovered that GNOME Shell did not properly validate icon dimensions when processing icons from a remote search provider. An...

Linux Distros Unpatched Vulnerability : CVE-2026-109518

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic including a malicious mirror or proxy between an...

Linux Distros Unpatched Vulnerability : CVE-2026-121086

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Buffer overflow in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-121200

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect reference resolution in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execut...

Oracle Linux 8 : freerdp (ELSA-2026-94510)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-94510 advisory. 2:2.11.7-15 - Backport several CVE fixes CVE-2026-109242, CVE-2026-110837, CVE-2026-111880 Resolves: RHEL-282289, RHEL-283715, RHEL-286595 Tenable has...

Linux Distros Unpatched Vulnerability : CVE-2026-121173

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uninitialized resource in WebGL in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page...

RHEL 8 : kernel (RHSA-2026:94996)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:94996 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: net/sched: ets: Always remove...

RHEL 8 : bind9.16 (RHSA-2026:95017)

"The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:95017 advisory. The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named...

TencentOS Server 3: kernel (TSSA-2026:1340)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1340 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 : PCRE2 vulnerabilities (USN-8974-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8974-1 advisory. It was discovered that PCRE2 did not correctly manage memory when processing certain...

Rocky Linux 8 [CIQ] Security Update: python3-jwt (crlsa-2026_93440)

The Rocky Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-202693440 advisory. pyjwt: PyJWT accepts unknown crit header extensions RFC 7515 ?4.1.11 MUST violation CVE-2026-32597 Tenable has extracted the preceding description block directly...

Oracle Linux 9 : brotli (ELSA-2026-90495)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-90495 advisory. 1.0.9-10.0.1 - Fix out-of-bounds write in the Brotli decoder CVE-2026-111497 Tenable has extracted the preceding description block directly from the Oracle Lin...

RHEL 9 : opentelemetry-collector (RHSA-2026:95015)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:95015 advisory. Collector with the supported components for a Red Hat build of OpenTelemetry Security Fixes: net/http: golang: golang: Denial of Service vi...

RHEL 9 : opentelemetry-collector (RHSA-2026:95014)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:95014 advisory. Collector with the supported components for a Red Hat build of OpenTelemetry Security Fixes: net/http: golang: golang: Denial of Service vi...

Fedora 44 : mingw-qt5-qtwebkit (2026-a336a99528)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a336a99528 advisory. Backport fix for CVE-2026-111497. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus...

TencentOS Server 2: kernel (TSSA-2026:1339)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1339 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 : Bind vulnerabilities (USN-8969-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8969-1 advisory. It was discovered that Bind incorrectly handled certain DNS messages with repeated singleton records such as SOA, CNAME, ...

Fedora 44 : mingw-harfbuzz (2026-cb54091d9d)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-cb54091d9d advisory. Update to 14.6.0 and backport fix for CVE-2026-113679. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Brotli vulnerability (USN-8956-2)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8956-2 advisory. USN-8956-1 fixed a vulnerability in Brotli. This update provides the corresponding fixes for Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubunt...

Linux Distros Unpatched Vulnerability : CVE-2026-120758

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HDF5 through 2.2.0 contains a NULL pointer dereference vulnerability in H5HLunprotect in src/H5HL.c. H5HLprotect pins a single metadata cache entry for a local...

Linux Distros Unpatched Vulnerability : CVE-2026-114627

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Web::Simple versions before 0.036 for Perl do not escape values interpolated into double-quoted strings in HTML::Tags output. Under use HTML::Tags or use...

Linux Distros Unpatched Vulnerability : CVE-2026-108147

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Django 6.1 before 6.1.3, 6.0.4 before 6.0.10, and 5.2.13 before 5.2.19. django.http.multipartparser.MultiPartParser is subject to...

Linux Distros Unpatched Vulnerability : CVE-2026-99262

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iouring/timeout: don't lose a cancel as io-wq arms a timeout An IORINGOPTIMEOUT run by io-wq, because of IOSQEASYNC, has the same problem as poll, futex and...

Linux Distros Unpatched Vulnerability : CVE-2026-121440

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 fails to check forwarded trailers against the WasiHttpHooks::isforbiddenheader hook in wasi-http p3. WASI...

Photon OS 5.0: Python3 PHSA-2026-5.0-92-0994

An update of the python3 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-92-0994. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...