Oracle Linux 7 : ELSA-2026-61234-0: / xmlrpc-c (ELSA-2026-612340)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-612340 advisory. 1.32.5-1905.0.1.svn2451 - Backport fix for CVE-2026-15928 Orabug: 39957695 Tenable has extracted the preceding description block directly from the Oracle Linu...

RHEL 10 : ruby4.0 (RHSA-2026:72427)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:72427 advisory. Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do...

Linux Distros Unpatched Vulnerability : CVE-2026-97399

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may cras...

Amazon Linux 2 : curl (ALAS-2026-3953)

The version of curl installed on the remote host is prior to 8.3.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3953 advisory. When a user invokes curl using a schemeless URL combined with --proto-default sftp or scp, a disconnect occurs between the to...

Amazon Linux 2023 : nodejs24, nodejs24-devel, nodejs24-full-i18n (ALAS2023-2026-3107)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3107 advisory. undici's retry handler can leave an already-exposed response body pending forever. When a server returns a successful response that declares a Content-Length, sends only part of the body, and...

Amazon Linux 2023 : bind, bind-chroot, bind-devel (ALAS2023-2026-3137)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3137 advisory. For a secondary zone with transfers restricted by TSIG, named may start to serve the data provided in a zone transfer before the final message with the TSIG signature arrives. This could allow...

Amazon Linux 2023 : bubblewrap (ALAS2023-2026-3105)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3105 advisory. A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the host via /oldroot, writing attacker-chosen paths outside the...

Amazon Linux 2 : qt5-qtbase (ALAS-2026-3951)

The version of qt5-qtbase installed on the remote host is prior to 5.15.3-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3951 advisory. Uncontrolled recursion in Qt's QDomDocument serialization QtXml lets deeply nested untrusted XML crash the app via sta...

AlmaLinux 10 : cockpit-image-builder (ALSA-2026:71543)

The remote AlmaLinux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:71543 advisory. fast-uri: fast-uri: Server-Side Request Forgery via repeated hostname percent-decoding CVE-2026-75899 fast-uri: fast-uri: Server-side request forgery vi...

Amazon Linux 2 : rclone (ALAS-2026-3947)

The version of rclone installed on the remote host is prior to 1.55.1-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3947 advisory. The source-address critical option in the Permissions returned by an authentication callback was only enforced for the...

Amazon Linux 2 : libvirt (ALAS-2026-3932)

The version of libvirt installed on the remote host is prior to 4.5.0-36. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3932 advisory. A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost function. The function uses a path-based chown on the...

RHEL 9 : expat (RHSA-2026:72663)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:72663 advisory. Expat is a C library for parsing XML documents. Security Fixes: expat: Expat: Denial of Service via quadratic complexity in attribute...

Debian dsa-6526 : dovecot-auth-lua - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6526 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6526-1 [email protected] https://www.debian.org/securit...

RockyLinux 9 : ruby:4.0 (RLSA-2026:72484)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:72484 advisory. resolv: resolv gem: Denial of Service via uncontrolled memory growth from crafted DNS responses CVE-2026-80212 Tenable has extracted the preceding description...

Oracle Linux 10 : ruby4.0 (ELSA-2026-72427)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-72427 advisory. 4.0.6-37 - Fix resolv: do not register on-demand classes for unknown DNS types and SvcParamKeys to prevent memory exhaustion CVE-2026-80212 Resolves:...

Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : Libwebsockets vulnerabilities (USN-8822-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8822-1 advisory. It was discovered that Libwebsockets incorrectly handled certain SSH protocol messages in its SSH protocol handler. A...

Oracle Linux 8 : ELSA-2026-67148-0: / osbuild-composer (ELSA-2026-671480)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-671480 advisory. 101.5-3.0.1 - go.mod: update github.com/labstack/echo/v4 to v4.15.3 Resolves: RHEL-213908 - go.mod: update go.opentelemetry.io/otel to v1.44.0...

SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:4369-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4369-1 advisory. The SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues: The following security issues were fixed: -...

RHEL 10 : gdb (RHSA-2026:73427)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:73427 advisory. The GNU Debugger GDB allows debugging of programs written in C, C++, and other languages by executing them in a controlled fashion and printing the...

RHEL 9 : cjose (RHSA-2026:73018)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:73018 advisory. CJose is C library implementing the Javascript Object Signing and Encryption JOSE. Security Fixes: cjose: cjose: Heap buffer overflow in AES Key Wra...

Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-3102)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3102 advisory. In the Linux kernel, the following vulnerability has been resolved: xfrm: ah6: validate routing header segmentsleft CVE-2026-80844 In the Linux kernel, the following vulnerability has been...

Amazon Linux 2023 : gdb, gdb-gdbserver, gdb-headless (ALAS2023-2026-3142)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3142 advisory. A flaw was found in GDB's STABS debug format parser. Thereadmemberfunctions function in gdb/stabsread.c contains a linkedlist removal bug in the code that separates destructor and non- destructormember...

Amazon Linux 2023 : freeipmi, freeipmi-bmc-watchdog, freeipmi-devel (ALAS2023-2026-3134)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3134 advisory. FreeIPMI before 1.6.19 has a stack-based buffer overflow in ipmiseloemfujitsugetselentrylongtext in libfreeipmi/sel/ipmi-sel-string-fujitsu-irmc-common.c via malformed Fujitsu SEL long-text...

RHEL 9 : kernel (RHSA-2026:72623)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:72623 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: ext4: fix e4b bitmap...

RHEL 9 : pcp (RHSA-2026:72594)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:72594 advisory. Performance Co-Pilot PCP is a suite of tools, services, and libraries for acquisition, archiving, and analysis of system-level performance...

RHEL 8 : expat (RHSA-2026:72448)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:72448 advisory. Expat is a C library for parsing XML documents. Security Fixes: expat: Expat: Denial of Service via quadratic complexity in attribute...

RHEL 8 : kpatch-patch-4_18_0-477_107_1, kpatch-patch-4_18_0-477_120_1, kpatch-patch-4_18_0-477_130_1, kpatch-patch-4_18_0-477_143_1, and kpatch-patch-4_18_0-477_161_1 (RHSA-2026:72627)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:72627 advisory. This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the code of a running kernel. This patc...

MiracleLinux 9 : ruby-3.0.7-168.el9_8 (AXSA:2026-1936:05)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1936:05 advisory. resolv: resolv gem: Denial of Service via uncontrolled memory growth from crafted DNS responses CVE-2026-80212 Bug Fixes and Enhancements: ruby %check fails ...

Amazon Linux 2 : 389-ds-base (ALAS-2026-3956)

The version of 389-ds-base installed on the remote host is prior to 1.3.10.2-17. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3956 advisory. A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's...

Amazon Linux 2 : corosync (ALAS-2026-3955)

The version of corosync installed on the remote host is prior to 2.4.3-6. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3955 advisory. A heap-based buffer overflow was found in Corosync's Totem Process Group totempg message reassembly. When processing fragmented...

RHCOS 4 : OpenShift Container Platform 4.21.35 (RHSA-2026:71443)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:71443 advisory. - net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGSMAXFRAMESIZE frame...

Amazon Linux 2 : ipa (ALAS-2026-3950)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3950 advisory. A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting XSS vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to...

RHEL 9 : freerdp (RHSA-2026:72479)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:72479 advisory. FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to RDP serve...

MiracleLinux 9 : ipa-4.13.4-1.el9_8 (AXSA:2026-1928:05)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1928:05 advisory. ipa: FreeIPA: Unauthenticated DoS in /ipa/i18nmessages via Unbounded Request Body Read CVE-2026-73198 ipa: FreeIPA: Unauthenticated DoS in...

Amazon Linux 2 : rsync (ALAS-2026-3945)

The version of rsync installed on the remote host is prior to 3.1.2-11. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3945 advisory. rsync before 3.5.0 contains an algorithmic complexity vulnerability in the hashsearch function that allows a remote attacke...

Amazon Linux 2 : squid (ALAS-2026-3961)

The version of squid installed on the remote host is prior to 3.5.20-17. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3961 advisory. Due to a CWE-841 Improper Enforcement of Behavioral Workflowbug Squid is vulnerable to a Request Smuggling attack againstHTTP/1.1...

Amazon Linux 2 : amazon-efs-utils (ALAS-2026-3948)

The version of amazon-efs-utils installed on the remote host is prior to 3.3.2-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3948 advisory. RustCrypto CMOV provides conditional move CPU intrinsics which are guaranteed on major platforms to execute in constant-ti...

RockyLinux 9 : ruby (RLSA-2026:72286)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:72286 advisory. resolv: resolv gem: Denial of Service via uncontrolled memory growth from crafted DNS responses CVE-2026-80212 Bug Fixes and Enhancements: ruby %check fails in...

RHEL 9 : ruby:3.3 (RHSA-2026:72485)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:72485 advisory. Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management task...

Amazon Linux 2 : perl-Authen-SASL (ALAS-2026-3923)

The version of perl-Authen-SASL installed on the remote host is prior to 2.15-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3923 advisory. Authen::SASL::Perl::DIGESTMD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonc...

Fedora 44 : NetworkManager-l2tp (2026-3a264a1bb3)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-3a264a1bb3 advisory. Updated to 1.52.6 Includes fixes for CVE-2026-75131 & CVE-2026-93337 Tenable has extracted the preceding description block directly from the Fedora...

Amazon Linux 2 : resteasy-base (ALAS-2026-3936)

The version of resteasy-base installed on the remote host is prior to 3.0.6-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3936 advisory. A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an...

MiracleLinux 9 : resteasy-3.0.26-20.el9_8 (AXSA:2026-1935:01)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1935:01 advisory. resteasy-core: RESTeasy SourceProvider remote unauthenticated file read CVE-2026-17615 Tenable has extracted the preceding description block directly from th...

RHEL 9 : cjose (RHSA-2026:73017)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:73017 advisory. CJose is C library implementing the Javascript Object Signing and Encryption JOSE. Security Fixes: cjose: cjose: Heap buffer overflow in AES Key Wra...

Linux Distros Unpatched Vulnerability : CVE-2026-51773

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in the VMware datastore driver of OpenStack glancestore. When an authenticated attacker provides a maliciously crafted image location URI pointing to a...

Amazon Linux 2023 : cjose, cjose-devel (ALAS2023-2026-3130)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3130 advisory. OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption JOSE. Prior to version 0.6.2.5, cjose's JWE decryption path for the AES Key Wrap key-management algorithm...

RHEL 8 : freerdp (RHSA-2026:73026)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:73026 advisory. FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to RDP serve...

RHEL 9 : kpatch-patch-5_14_0-570_116_1, kpatch-patch-5_14_0-570_135_1, kpatch-patch-5_14_0-570_39_1, kpatch-patch-5_14_0-570_66_1, and kpatch-patch-5_14_0-570_94_1 (RHSA-2026:72830)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:72830 advisory. This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the code of a running kernel. This patc...

Amazon Linux 2 : dovecot (ALAS-2026-3935)

The version of dovecot installed on the remote host is prior to 2.2.36-6. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3935 advisory. An attacker that can send mail to a user can craft a message whose headers contain a very large number of email addresses...

Amazon Linux 2023 : bluez, bluez-cups, bluez-deprecated (ALAS2023-2026-3141)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3141 advisory. BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. An attacke...