Linux Distros Unpatched Vulnerability : CVE-2026-99251

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Drivers: hv: Avoid infinite retry loop in initvpindex There is a retry loop in initvpindex where the CPUs from a certain node are stripped out if they have...

AlmaLinux 9.6 [TuxCare] Security Update: gimp / gimp-devel / gimp-devel-tools / gimp-libs (ALMALINUX9.6:CLSA-2026:1793718255)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793718255 advisory. - A heap-based buffer overflow was found in GIMP's DirectDraw Surface DDS loader. When loading a crafted DDS image, buffer sizes derived from...

RHEL 9 : dpdk (RHSA-2026:94629)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:94629 advisory. The dpdk packages provide the Data Plane Development Kit, which is a set of libraries and drivers for fast packet processing in the user...

AlmaLinux 9.2 [TuxCare] Security Update: ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1793719329)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1793719329 advisory. - ImageMagick before 7.1.2-33 contains a memory leak vulnerability in PerlMagick that fails to free values returned when reading ima...

Photon OS 5.0: Linux PHSA-2024-5.0-90-0305

An update of the linux package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2024-5.0-90-0305. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

RHEL 8 : python-dns (RHSA-2026:94749)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:94749 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic da...

RHEL 9 : fence-agents (RHSA-2026:94523)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:94523 advisory. The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or...

RHEL 10 : dpdk (RHSA-2026:94630)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:94630 advisory. The dpdk packages provide the Data Plane Development Kit, which is a set of libraries and drivers for fast packet processing in the user...

Fedora 44 : kernel (2026-778424cb43)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-778424cb43 advisory. The 7.2.15 stable kernel update contains a number of important fixes across the tree. Tenable has extracted the preceding description block directly from the...

Linux Distros Unpatched Vulnerability : CVE-2026-121389

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP from 3.27.0 before 3.32.2 contains a denial of service vulnerability in rdpdrdumppacket that allows malicious RDP servers to abort clients by sending...

AlmaLinux 9.2 [TuxCare] Security Update: log4j / log4j-jcl / log4j-slf4j / log4j-web (ALMALINUX9.2:CLSA-2026:1792624679)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792624679 advisory. - The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer...

Kibana 8.x < 8.19.24 / 9.0.x < 9.4.9 / 9.5.x < 9.5.6 Incorrect Authorization (ESA-2026-203)

The version of Kibana installed on the remote host is 8.x prior to 8.19.24, or 9.0.x prior to 9.4.9, or 9.5.x prior to 9.5.6. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-203 advisory. - Authorization Bypass Through User-Controlled Key CWE-639 in Kibana Machine...

Rocky Linux 9.6 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1793725885)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793725885 advisory. - When an FTP wildcard LIST operation fails, libcurl omits the restoration path meant for successful listings, leaving the write...

Photon OS 5.0: Gzip PHSA-2026-5.0-92-0975

An update of the gzip package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-92-0975. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Linux Distros Unpatched Vulnerability : CVE-2026-121395

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP from 3.17.0 before 3.32.2 contains an assertion failure in the RemoteFX differential decoder when verbose WinPR assertions are enabled. A malicious RDP...

RockyLinux 8 : perl-YAML:1.24 (RLSA-2026:93471)

The remote RockyLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RLSA-2026:93471 advisory. perl-yaml: perl-yaml: Arbitrary code execution via unrestricted package variable assignment CVE-2019-25777 perl-yaml: perl-yaml: Arbitrary destructor...

Elasticsearch 8.9.x < 8.19.24 / 9.0.x < 9.4.9 / 9.5.x < 9.5.6 Information Disclosure (ESA-2026-210)

The version of Elasticsearch installed on the remote host is 8.9.x prior to 8.19.24, or 9.0.x prior to 9.4.9, or 9.5.x prior to 9.5.6. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-210 advisory. - Use of Cache Containing Sensitive Information CWE-524 in Elasticsearch...

Linux Distros Unpatched Vulnerability : CVE-2026-99247

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tracing: Do not initialize tracefs work if tracing is disabled If trace buffer allocation fails during early boot e.g. in earlytraceinit - allocatetracebuffers,...

Linux Distros Unpatched Vulnerability : CVE-2026-99268

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iouring: wake ring pollers for local taskwork With IORINGSETUPDEFERTASKRUN completions are queued as local work, and only become CQEs when the submitter enters...

AlmaLinux 9.2 [TuxCare] Security Update: bind / bind-chroot / bind-devel / bind-dnssec-doc / etc (ALMALINUX9.2:CLSA-2026:1793710996)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1793710996 advisory. - Querying for records within a specially crafted zone containing certain malformed DNSKEY records can lead to CPU exhaustion. This issue...

AlmaLinux 9 : libXi (ALSA-2026:93439)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:93439 advisory. libXi: libXi: Arbitrary code execution via oversized DEVICEENABLE reply CVE-2026-109090 libXi: libXi: Arbitrary code execution via DEVICERESOLUTION...

RockyLinux 10 : libXi (RLSA-2026:93441)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:93441 advisory. libXi: libXi: Arbitrary code execution via oversized DEVICEENABLE reply CVE-2026-109090 libXi: libXi: Arbitrary code execution via DEVICERESOLUTION...

RHEL 9 : RHEL AI 3.5 RPM runtime CVE fix - ffmpeg (Important) (RHSA-2026:94488)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:94488 advisory. RPM packages are internal build artifacts and not supported on their own. They are only supported as part of the Red Hat AI application...

RHCOS 4 : OpenShift Container Platform 4.21.41 (RHSA-2026:92286)

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:92286 advisory. - crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates CVE-2026-111943 Note that Nessus has n...

Fedora 45 : erlang-hex_core (2026-b514ab4cac)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-b514ab4cac advisory. hexcore ver. 0.21.1 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not teste...

Linux Distros Unpatched Vulnerability : CVE-2026-99255

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iouring/io-wq: don't hide a link from cancellations A task that exits cancels its tracked requests and waits until they are gone. iouringcancelgeneric looks...

RHEL 9 : pipewire (RHSA-2026:94436)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:94436 advisory. PipeWire is a multimedia server for Linux and other Unix like operating systems. Security Fixes: pipewire: RAOP RTSP NULL Deref...

AlmaLinux 8 : firefox (ALSA-2026:89756)

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:89756 advisory. libexpat: denial of service via crafted XML input CVE-2026-45186 firefox: thunderbird: Privilege escalation in the Application Update component...

Elasticsearch 8.10.x < 8.19.24 / 9.0.x < 9.4.9 / 9.5.x < 9.5.6 DoS (ESA-2026-201)

The version of Elasticsearch installed on the remote host is 8.10.x prior to 8.19.24, or 9.0.x prior to 9.4.9, or 9.5.x prior to 9.5.6. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-201 advisory. - Uncontrolled Recursion CWE-674 in Elasticsearch can lead to denial of...

RHEL 8 : libXtst (RHSA-2026:94449)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:94449 advisory. X.Org X11 libXtst runtime library Security Fixes: libXtst: libXtst: Denial of Service via out-of-bounds read in RECORD reply parser CVE-2026-94286 F...

Photon OS 5.0: Mysql PHSA-2026-5.0-90-1056

An update of the mysql package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-90-1056. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

RockyLinux 10 : podman (RLSA-2026:93464)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:93464 advisory. podman: Arbitrary file write when importing OCI archive CVE-2025-11395 Tenable has extracted the preceding description block directly from the RockyLinux securi...

Oracle Linux 9 : gimp (ELSA-2026-93975)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-93975 advisory. - fix CVE-2026-106062 - fix CVE-2026-112257 - fix CVE-2026-112258 - fix CVE-2026-112260 Tenable has extracted the preceding description block directly...

FreeBSD : freenginx -- TLS session ticket key left uninitialized (4784aba5-d6a9-11f1-8a93-a0369f6e85b8)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 4784aba5-d6a9-11f1-8a93-a0369f6e85b8 advisory. The freenginx project reports: One of the keys was left uninitialized when using automatic rotation of...

Elasticsearch 8.12.1 < 8.19.24 / 9.0.x < 9.4.9 / 9.5.x < 9.5.6 Multiple Vulnerabilities (ESA-2026-227)

The version of Elasticsearch installed on the remote host is 8.12.1 or later prior to 8.19.24, or 9.0.x prior to 9.4.9, or 9.5.x prior to 9.5.6. It is, therefore, affected by multiple vulnerabilities as referenced in the ESA-2026-227 advisory. - Vulnerability in the Oracle Java SE, Oracle GraalVM...

RockyLinux 9 : freerdp (RLSA-2026:93592)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:93592 advisory. freerdp: FreeRDP: Denial of Service via uninitialized progressive tile handling CVE-2026-109242 freerdp: freerdp: Denial of Service via heap-based buffe...

AlmaLinux 8 : perl-YAML:1.24 (ALSA-2026:93471)

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:93471 advisory. perl-yaml: perl-yaml: Arbitrary code execution via unrestricted package variable assignment CVE-2019-25777 perl-yaml: perl-yaml: Arbitrary destructor...

Linux Distros Unpatched Vulnerability : CVE-2026-121386

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.32.2 contains a denial of service vulnerability in WinPR's winprreadpngfrombuffer and winprconvertfromjpeg, which lack libpng/libjpeg error...

RHEL 8 : libXtst (RHSA-2026:94567)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:94567 advisory. X.Org X11 libXtst runtime library Security Fixes: libXtst: libXtst: Denial of Service via out-of-bounds read in RECORD reply parser CVE-2026-94286 F...

Oracle Linux 8 : firefox (ELSA-2026-94405)

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-94405 advisory. 153.6.0-1.0.1 - Fix firefox-oracle-default-prefs.js for new nss Orabug: 37079789 - diable wasisdk to prevent build failure with newer llvm 153.6.0 - A...

RHEL 9 : RHEL AI 3.4 RPM runtime CVE fix - thrift (Important) (RHSA-2026:94503)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:94503 advisory. RPM packages are internal build artifacts and not supported on their own. They are only supported as part of the Red Hat AI application...

EulerOS Virtualization 2.13.0 : grub2 (EulerOS-SA-2026-1628)

According to the versions of the grub2 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A vulnerability has been identified in the GRUB Grand Unified Bootloader component. This flaw occurs because the bootloader mishandl...

Linux Distros Unpatched Vulnerability : CVE-2026-99265

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iouring/openclose: keep the lock in iopipefixed iopipefixed installs both ends of the pipe in the fixed file table, drops -uringlock, and copies the slot number...

SUSE SLED15: docker / docker-bash-completion / docker-buildx / etc (SUSE-SU-2026:4956-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4956-1 advisory. This update for docker rebuilds it against the current go security release. Tenable has extracted the preceding...

RHEL 9 : pipewire (RHSA-2026:94490)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:94490 advisory. PipeWire is a multimedia server for Linux and other Unix like operating systems. Security Fixes: pipewire: Pulse Server alloca Stack Overflow...

SUSE SLES12 Security Update : gnutls (SUSE-SU-2026:4953-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4953-1 advisory. This update for gnutls fixes the following issue: - CVE-2025-14831: excessive resource consumption when verifying specially crafted maliciou...

AlmaLinux 9.6 [TuxCare] Security Update: ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1793719568)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793719568 advisory. - ImageMagick before 7.1.2-33 contains a memory leak vulnerability in PerlMagick that fails to free values returned when reading ima...

EulerOS Virtualization 2.13.0 : brotli (EulerOS-SA-2026-1626)

According to the versions of the brotli package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Scrapy versions up to 2.13.2 are vulnerable to a denial of service DoS attack due to a flaw in its brotli decompression...

EulerOS Virtualization 2.13.0 : curl (EulerOS-SA-2026-1627)

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification...

Photon OS 5.0: Gnuplot PHSA-2026-5.0-91-0947

An update of the gnuplot package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-91-0947. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...