Linux Distros Unpatched Vulnerability : CVE-2026-121393

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP from 3.0.0 before 3.32.2 contains a denial of service vulnerability that allows malicious RDP servers to abort clients built with verbose WinPR assertio...

Kibana 8.7.x < 8.19.24 / 9.0.x < 9.4.9 / 9.5.x < 9.5.6 Incorrect Authorization (ESA-2026-206)

The version of Kibana installed on the remote host is 8.7.x prior to 8.19.24, or 9.0.x prior to 9.4.9, or 9.5.x prior to 9.5.6. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-206 advisory. - Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead t...

Oracle Linux 9 : kernel (ELSA-2026-93930)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-93930 advisory. - ethtool: cmis: require exact CDB reply length CKI Backport Bot RHEL-229677 CVE-2026-63996 Tenable has extracted the preceding description block...

Linux Distros Unpatched Vulnerability : CVE-2026-114418

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - phodav - None CVE-2026-114418 Note that Nessus relies on the presence of the package as reported by the vendor. %NASLMINLEVEL 80900 C Tenable, In...

Photon OS 5.0: Glib PHSA-2026-5.0-92-0953

An update of the glib package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-92-0953. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Langflow 1.0.x < 1.13.0 Multiple Vulnerabilities

The version of Langflow installed on the remote host is 1.0.x prior to 1.13.0. It is, therefore, affected by multiple vulnerabilities: - IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to bypass security restrictions due to improper authentication. CVE-2026-93680 - IBM Langflo...

AlmaLinux 9.2 [TuxCare] Security Update: lemon / sqlite / sqlite-analyzer / sqlite-devel / sqlite-doc / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1793693567)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1793693567 advisory. - SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists that undersizes the output buffer when...

CentOS Linux 8 [TuxCare] Security Update: lemon / sqlite / sqlite-analyzer / sqlite-devel / sqlite-doc / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1793699740)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1793699740 advisory. - SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITELIMITEXPRDEPTH nesting...

RHEL 9 : pipewire (RHSA-2026:94437)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:94437 advisory. PipeWire is a multimedia server for Linux and other Unix like operating systems. Security Fixes: pipewire: RAOP RTSP NULL Deref...

Fedora 44 : python-pillow (2026-719fffc96a)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-719fffc96a advisory. Backport fix for CVE-2026-112900. ---- Backport fix for CVE-2026-112398 ---- Backport fix for CVE-2026-112393. Tenable has extracted the preceding...

Oracle Linux 10 : podman (ELSA-2025-23295)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-23295 advisory. - rebuild for CVE-2025-58183 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus has not...

AlmaLinux 9.2 [TuxCare] Security Update: log4j / log4j-jcl / log4j-slf4j / log4j-web (ALMALINUX9.2:CLSA-2026:1792633697)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792633697 advisory. - The fix for CVE-2025-68161 https://logging.apache.org/security.htmlCVE-2025-68161 was incomplete: it addressed hostname verification only...

Linux Distros Unpatched Vulnerability : CVE-2026-121425

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nodemailer from 3.0.0 before 10.1.4 contains a parsing flaw in addressparser that ends an RFC 5322 group at a semicolon inside quoted display names or comments...

RHEL 8 : libXtst (RHSA-2026:94482)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:94482 advisory. X.Org X11 libXtst runtime library Security Fixes: libXtst: libXtst: Denial of Service via out-of-bounds read in RECORD reply parser CVE-2026-94286 F...

nginx 0.8.11 < 1.30.4 / 1.31.x < 1.31.3 Use-After-Free Memory Corruption

According to its Server response header, the installed version of nginx is 0.8.11 prior to 1.30.4 or 1.31.x prior to 1.31.3. It is, therefore, affected by the following issue : - NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpssimodule module. This vulnerability may exist whe...

Linux Distros Unpatched Vulnerability : CVE-2026-74846

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier...

Oracle Linux 9 : qemu-kvm (ELSA-2026-88421)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-88421 advisory. 10.1.0-17.el98.9 - kvm-qcow2-Add-keepdatafile-command-line-option.patch RHEL-164549 - kvm-qcow2-Simplify-size-round-up-in-cocreateopts.patch RHEL-164549 -...

Linux Distros Unpatched Vulnerability : CVE-2026-120063

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When psqlODBC quotes a schema or table name into a 128-byte stack buffer, its length check lets it write up to two bytes past the end of the buffer for a long...

Mozilla Firefox < 159.0.1

The version of Firefox installed on the remote Windows host is prior to 159.0.1. It is, therefore, affected by a vulnerability as referenced in the mfsa2026-123 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number...

Photon OS 5.0: Glib PHSA-2026-5.0-91-0947

An update of the glib package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-91-0947. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Oracle Linux 8 : ghostscript (ELSA-2026-93978)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-93978 advisory. 9.27-20 - CVE-2026-112177 ghostscript: Reintroduction of .charkeys -dSAFER bypass in RHEL 8 -dSAFER bypass in RHEL 8 Tenable has extracted the preceding...

Logstash 8.12.1 < 8.19.24 / 9.0.x < 9.4.9 / 9.5.x < 9.5.6 Multiple Vulnerabilities (ESA-2026-228)

The version of Logstash installed on the remote host is 8.12.1 or later prior to 8.19.24, or 9.0.x prior to 9.4.9, or 9.5.x prior to 9.5.6. It is, therefore, affected by multiple vulnerabilities as referenced in the ESA-2026-228 advisory. - Vulnerability in the Oracle Java SE, Oracle GraalVM for...

RockyLinux 9 : tomcat (RLSA-2026:93469)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:93469 advisory. tomcat: Apache Tomcat: Security constraint bypass due to improper access control CVE-2026-65182 tomcat: Apache Tomcat: Access control bypass due to...

Google Chrome < 157.0.8103.38 Multiple Vulnerabilities

The version of Google Chrome installed on the remote macOS host is prior to 157.0.8103.38. It is, therefore, affected by multiple vulnerabilities as referenced in the 202611stable-channel-update-for-desktop advisory. - Use after free in TabStrip. CVE-2026-121114, CVE-2026-121257 - Missing...

Google Chrome < 157.0.8103.38 Multiple Vulnerabilities

The version of Google Chrome installed on the remote Windows host is prior to 157.0.8103.38. It is, therefore, affected by multiple vulnerabilities as referenced in the 202611stable-channel-update-for-desktop advisory. - Use after free in TabStrip. CVE-2026-121114, CVE-2026-121257 - Missing...

AlmaLinux 8 : bind (ALSA-2026:93925)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:93925 advisory. bind9: bind: BIND 9: Denial of Service via crafted DNSSEC responses CVE-2026-19662 bind: BIND: Denial of Service via unbounded processing of crafted DNS...

SUSE SLES15 Security Update : kernel RT (Live Patch 12 for SUSE Linux Enterprise 15 SP7) (SUSE-SU-2026:4984-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4984-1 advisory. This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.7.40 fixes various security issues: The following security issues were fixed: -...

SUSE SLES12 Security Update : kernel (Live Patch 82 for SUSE Linux Enterprise 12 SP5) (SUSE-SU-2026:5019-1)

The remote SUSE Linux SLES12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:5019-1 advisory. This update for the SUSE Linux Enterprise Kernel 4.12.14-122.307 fixes various security issues: The following security issues were fixed: -...

RHEL 8 : bind9.16 (RHSA-2026:94011)

"The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:94011 advisory. The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named...

SUSE SLES15 Security Update : kernel RT (Live Patch 19 for SUSE Linux Enterprise 15 SP7) (SUSE-SU-2026:5020-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:5020-1 advisory. This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.7.72 fixes various security issues: The following security issues were fixed: -...

RHEL 9 : kernel (RHSA-2026:94477)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:94477 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: net/sched: ets: Always remove...

RHEL 10 / 8 / 9 : Satellite 6 Client Update (Important) (RHSA-2026:94063)

The remote Redhat Enterprise Linux 10 / 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:94063 advisory. Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the...

RockyLinux 9 : opentelemetry-collector (RLSA-2026:93617)

The remote RockyLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RLSA-2026:93617 advisory. net/http: golang: golang: Denial of Service via crafted HTTP Range headers CVE-2026-78667 crypto/tls: golang: crypto/tls: Denial of Service via multiple...

Oracle Linux 9 : kernel (ELSA-2026-93412)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-93412 advisory. - ipv4: free inetopt and ireqopt after an RCU grace period CKI Backport Bot RHEL-295635 CVE-2026-98432 - nvmet-auth: fix out-of-bounds write in...

SUSE SLES15 Security Update : nodejs22 (SUSE-SU-2026:4957-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4957-1 advisory. - CVE-2026-105481: Keep-alive socket process a response that was written before the request was sent bsc1286565. - CVE-2026-105482:...

Rocky Linux 8.10 [CIQ] Security Update: bpftool / kernel / kernel-abi-stablelists / kernel-core / etc (ciqsa-2026_1747)

The Rocky Linux 8.10 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261747 advisory. This advisory aggregates security fixes for the kernel SRPM in CIQ Core 8.10. It addresses 1 CVE: CVE-2026-98432. Tenable has extracted the preceding description...

RHEL 10 : bind (RHSA-2026:94115)

"The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:94115 advisory. The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named...

RHEL 8 : kernel (RHSA-2026:94623)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:94623 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: ipv4: free inetopt and ireqopt after a...

RockyLinux 9 : bind (RLSA-2026:93610)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:93610 advisory. bind: BIND: Denial of Service via unbounded processing of crafted DNS messages CVE-2026-19630 bind: bind: Arbitrary code execution via GSS-TSIG UDP...

SUSE SLES15: Multiple Vulnerabilities (SUSE-RU-2026:5018-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-RU-2026:5018-1 advisory. - Allow to bypass the strict tag initialization and length enforcement added in the fix for CVE-2026-34182 when the env variable...

SUSE SLES15 Security Update : kernel (Live Patch 33 for SUSE Linux Enterprise 15 SP5) (SUSE-SU-2026:4983-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4983-1 advisory. This update for the SUSE Linux Enterprise Kernel 5.14.21-150500.55.130 fixes various security issues: The following security issues were fixed:...

SUSE SLES15 Security Update : kernel (Live Patch 32 for SUSE Linux Enterprise 15 SP5) (SUSE-SU-2026:5012-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:5012-1 advisory. This update for the SUSE Linux Enterprise Kernel 5.14.21-150500.55.127 fixes various security issues: The following security issues were fixed:...

SUSE SLES15 Security Update : kernel (Live Patch 27 for SUSE Linux Enterprise 15 SP6) (SUSE-SU-2026:5016-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:5016-1 advisory. This update for the SUSE Linux Enterprise Kernel 6.4.0-150600.23.115 fixes various security issues: The following security issues were fixed: -...

RHEL 9 : bind9.18 (RHSA-2026:94278)

"The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:94278 advisory. BIND Berkeley Internet Name Domain is an implementation of the DNS Domain Name System protocols. BIND includes a DNS server named, which...

Rocky Linux 8.6 [CIQ] Security Update: aspnetcore-runtime-6.0 / aspnetcore-targeting-pack-6.0 / dotnet / etc (ciqsa-2026_1750)

The Rocky Linux 8.6 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261750 advisory. This advisory aggregates security fixes for the dotnet6.0 SRPM in CIQ LTS 8.6. It addresses 1 CVE: CVE-2026-111497. Tenable has extracted the preceding descriptio...

Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500572)

The remote Oracle Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-500572 advisory. - NFSD: Define actions for the new timedeleg FATTR4 attributes Chuck Lever Orabug: 39004166 CVE-2025-40326 - ipv4: free inetopt and ireqopt afte...

Linux Distros Unpatched Vulnerability : CVE-2026-102703

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. A common access pattern is a batc...

Fedora 45 : mingw-cfitsio (2026-5bfcad5462)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-5bfcad5462 advisory. Backport fix for CVE-2026-115504. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus...

Fedora 44 : glib-networking (2026-f9c9c98abe)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-f9c9c98abe advisory. Fixes CVE-2026-103963 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for...

SUSE SLES12: cpp48 / gcc48 / gcc48-32bit / gcc48-c++ / gcc48-info / gcc48-locale / etc (SUSE-SU-2026:4637-2)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4637-2 advisory. This update for gcc48 fixes the following issue: - CVE-2026-102010: UAF due to improper pointer update when an application calls the eraseif...