Alibaba Cloud Linux 3 : 0334: kernel (ALINUX3-SA-2026:0334)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2026:0334 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-98432: In the Linux kernel, the following...

MiracleLinux 9 : nodejs:24 (AXSA:2026-2234:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2234:01 advisory. ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing CVE-2026-101911 brace-expansion: brace-expansion: Denial of Service via...

FreeBSD : chromium -- security fixes (3749ce48-d5ce-11f1-9bfa-a8a1599412c6)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 3749ce48-d5ce-11f1-9bfa-a8a1599412c6 advisory. Chrome Releases reports: This update includes 21 security fixes: Tenable has extracted the...

Oracle Linux 8 : kernel (ELSA-2026-93414)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-93414 advisory. - ipv4: free inetopt and ireqopt after an RCU grace period Davide Caratti RHEL-295615 CVE-2026-98432 - smb: client: bound dirent name against end of SMB respon...

FreeBSD : chromium -- security fixes (60814125-d630-11f1-9bfa-a8a1599412c6)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 60814125-d630-11f1-9bfa-a8a1599412c6 advisory. Chrome Releases reports: This update includes 52 security fixes: Tenable has extracted the...

Photon OS 5.0: Linux PHSA-2026-5.0-90-1034

An update of the linux package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-90-1034. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Linux PHSA-2026-5.0-92-0982

An update of the linux package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-92-0982. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

RHEL 10 : kernel (RHSA-2026:93775)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:93775 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: ipv4: free inetopt and ireqopt after ...

Photon OS 5.0: Rsync PHSA-2026-5.0-91-0991

An update of the rsync package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-91-0991. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Linux PHSA-2026-5.0-91-1014

An update of the linux package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-91-1014. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Oracle Linux 9 : thunderbird (ELSA-2026-93443)

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-93443 advisory. 153.5.0-1.0.1 - Fix prefs for new nss Orabug: 37079813 - Add Oracle prefs 153.5.0-1 - Update to 153.5.0 ESR 140.16.0-1 - Update to 140.16.0 ESR...

Linux Distros Unpatched Vulnerability : CVE-2026-119372

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SQLite before 3.54.0 built with FTS3/FTS4 and SQLITEENABLEFTS3PARENTHESIS contains a use-after-free vulnerability in fts3BestSnippet caused by dangling cached...

Fedora 44 : mingw-expat (2026-86ef30a678)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-86ef30a678 advisory. Update to expat-2.9.0. ---- Update to expat-2.8.5. Tenable has extracted the preceding description block directly from the Fedora security advisory...

CentOS Linux 7 [TuxCare] Security Update: bind / bind-chroot / bind-devel / bind-export-devel / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1793163099)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1793163099 advisory. - BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses...

Rocky Linux 10.2 [CIQ] Security Update: firefox / firefox-debuginfo / firefox-debugsource Multiple Vulnerabilities (crlsa-2026_89758)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202689758 advisory. libexpat: denial of service via crafted XML input CVE-2026-45186 expat: expat: Information disclosure via heap buffer over-read in XMLParseBuffer...

openSUSE 16: rsyslog / rsyslog-devel / rsyslog-diag-tools / rsyslog-module-dtls / etc (openSUSE-SU-2026:22184-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22184-1 advisory. - CVE-2026-19654: imptcp regex-framing remote denial of service bsc1271910. - CVE-2026-61548: crafted RFC 5424 messages to mmpstrucdata can lead...

Fedora 45 : rust-cargo-rpmstatus (2026-90b83e11aa)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-90b83e11aa advisory. Rebuilt with updated rustls and webpki dependencies - Fixes RUSTSEC-2026-0346, RUSTSEC-2026-0347, RUSTSEC-2026-0348, RUSTSEC-2026-0349, RUSTSEC-2026-0381,...

openSUSE 16: gvfs / gvfs-backend-afc / gvfs-backend-goa / gvfs-backend-gphoto / etc (openSUSE-SU-2026:22174-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:22174-1 advisory. This update for gvfs fixes the following issue: - CVE-2026-88924: gvfs-admin socket ownership race condition allows local users to change the ownership ...

Debian dla-4874 : eog - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4874 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4874-1 [email protected]...

Fedora 43 : ruby (2026-8e3e7af1cb)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-8e3e7af1cb advisory. New version 3.4.12 is released. This new rpm contains several bug fixes in Onigumo regular expression compilation. Tenable has extracted the preceding...

AlmaLinux 9.2 [TuxCare] Security Update: cpp / cross-gcc-aarch64 / cross-gcc-c++-aarch64 / gcc / gcc-c++ / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1793573947)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1793573947 advisory. - A flaw was found in GCC. When an application calls the eraseif function on a binary heap priority queue in libstdc++, the library...

Fedora 45 : clevis (2026-b86561a89a)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-b86561a89a advisory. Add new sources release 24 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has no...

MiracleLinux 9 : cjose-0.6.1-17.el9_8.2 (AXSA:2026-2222:02)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-2222:02 advisory. cjose: OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption CVE-2026-53939 Tenable has extracted the preceding description bloc...

Rocky Linux 8 [CIQ] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc Multiple Vulnerabilities (crlsa-2026_92869)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202692869 advisory. tomcat: Apache Tomcat: Security constraint bypass due to improper access control CVE-2026-65182 tomcat: Apache Tomcat: Access control bypass due to...

SUSE SLED15: flatpak / flatpak-devel / flatpak-remote-flathub / etc (SUSE-SU-2026:4944-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4944-1 advisory. - CVE-2026-90616: missing symlink protection allows a malicious sandboxed app to obtain arbitrary read and wri...

FreeBSD : uriparser -- Denial of Service through Unbound Recursion (65abbad5-da78-11f0-b6d5-843a4b343614)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 65abbad5-da78-11f0-b6d5-843a4b343614 advisory. The URIparser project reports: uriparser through 0.9.9 allows unbounded recursion and stack consumption...

Linux Distros Unpatched Vulnerability : CVE-2026-111426

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - kdeconnect - None CVE-2026-111426 Note that Nessus relies on the presence of the package as reported by the vendor. %NASLMINLEVEL 80900 C Tenable...

Linux Distros Unpatched Vulnerability : CVE-2026-120208

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libheif 1.18.0 before 1.23.3 contains a heap-based buffer overflow vulnerability in uncdecodermixedinterleave::processTile that allows attackers to write out of...

MiracleLinux 9 : libXtst-1.2.3-16.el9_8.1 (AXSA:2026-2220:02)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-2220:02 advisory. libXtst: libXtst: Denial of Service via out-of-bounds read in RECORD reply parser CVE-2026-94286 Tenable has extracted the preceding description block direct...

FreeBSD : amule -- multiple vulnerabilities (ac97113e-d514-11f1-b2f0-002b67dfc673)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the ac97113e-d514-11f1-b2f0-002b67dfc673 advisory. aMule developers report: A security release first: it fixes 15 vulnerabilities reported through GitHub...

openSUSE 16: stgit / stgit-bash-completion / stgit-emacs / stgit-fish-completion / etc (openSUSE-SU-2026:22204-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22204-1 advisory. Changes in stgit: - Update to version 2.7.0: Allow unambiguous command shorthands, opt-in with stgit.infer-commands. Accept git approxidate...

Linux Distros Unpatched Vulnerability : CVE-2026-104843

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - uv is a Python package and project manager written in Rust. From 0.12.7 until 0.12.18, uv wheel extraction on Windows can process a malicious wheel in a way tha...

CentOS Linux 7 [TuxCare] Security Update: sudo / sudo-devel (CENTOS7:CLSA-2026:1793183073)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1793183073 advisory. - A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z...

openSUSE 16: epiphany / epiphany-branding-upstream / epiphany-lang / etc (openSUSE-SU-2026:22199-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22199-1 advisory. Changes in epiphany: - CVE-2026-77679: path traversal in WebExtension XPI extraction ZIP slip bsc1276758 - CVE-2026-77682: JavaScript code...

CentOS Linux 6 [TuxCare] Security Update: icu / libicu / libicu-devel / libicu-doc (CENTOS6:CLSA-2026:1793167763)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1793167763 advisory. - A stack buffer overflow was found in Internationl components for unicode ICU . While running the genrb binary, the 'subtag' struct overflowed a...

Fedora 43 : openscap (2026-03caed4282)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-03caed4282 advisory. Update to the latest upstream release Vulnerability fix - CVE-2026-85518: Fix path traversal when dumping SDS components Maintenance, bug fix - Lock testfile...

Linux Distros Unpatched Vulnerability : CVE-2026-119562

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - phpMyAdmin through 5.2.3 contains an sql injection vulnerability that allows authenticated users to inject SQL by supplying unescaped colextra and colattribute...

Linux Distros Unpatched Vulnerability : CVE-2026-112816

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15, 5.0.11, 5.21.9, 6.10.1 allows an unauthenticat...

openSUSE 16 Security Update : perl-Dancer2-Plugin-Auth-Extensible (openSUSE-SU-2026:22190-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:22190-1 advisory. Changes in perl-Dancer2-Plugin-Auth-Extensible: - updated to 0.714.0 0.714 Fix failing tests when sendmail binary not present on system. - updated to...

Linux Distros Unpatched Vulnerability : CVE-2026-119371

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITELIMITEXPRDEPTH nesting limit because common table...

openSUSE 16 Security Update : cadvisor (openSUSE-SU-2026:22200-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22200-1 advisory. Changes in cadvisor: CVE-2026-78669: golang.org/x/net/http2: excessive CPU consumption from repeated initial window changes bsc1285500...

openSUSE 16 Security Update : expat (openSUSE-SU-2026:22177-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22177-1 advisory. - CVE-2026-77214: out-of-bounds read due to insufficient checks in XMLParseBuffer bsc1284334. - CVE-2026-93990: fails to validate low surrogates...

Fedora 43 : rust-cargo-rpmstatus (2026-dcc4b9337f)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-dcc4b9337f advisory. Rebuilt with updated rustls and webpki dependencies - Fixes RUSTSEC-2026-0346, RUSTSEC-2026-0347, RUSTSEC-2026-0348, RUSTSEC-2026-0349, RUSTSEC-2026-0381,...

Fedora 45 : nicotine+ (2026-4b6e8bed0f)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-4b6e8bed0f advisory. Version 3.3.11 September 16, 2026 Changes Added menu items for moving column headers due to broken drag-and-drop in GTK Enabled fixed number of upload slots ...

Rocky Linux 8 [CIQ] Security Update: firefox / firefox-debuginfo / firefox-debugsource Multiple Vulnerabilities (crlsa-2026_89756)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202689756 advisory. libexpat: denial of service via crafted XML input CVE-2026-45186 firefox: thunderbird: Privilege escalation in the Application Update component...

Fedora 45 : libreswan (2026-d06ae7ecc2)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-d06ae7ecc2 advisory. Fix automated passwordless ipsec import support for PKCS12 files ---- Fixes CVE-2026-77205, CVE-2026-77206, CVE-2026-77207 and CVE-2026-94453 Tenabl...

Rocky Linux 8 [CIQ] Security Update: hplip / hplip-common / hplip-debuginfo / hplip-debugsource / etc Multiple Vulnerabilities (crlsa-2026_82295)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202682295 advisory. hplip: potential memory buffer overflow CVE-2020-6923 hplip: HP Linux Imaging and Printing Software - Use of DSA Key CVE-2025-43023 hplip: HPLIP: Multiple...

MiracleLinux 9 : libX11-1.8.12-1.el9_8.1 (AXSA:2026-2216:03)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-2216:03 advisory. libX11: libX11: Heap-based buffer overflow via malicious X server CVE-2026-88806 Tenable has extracted the preceding description block directly from the...

Linux Distros Unpatched Vulnerability : CVE-2026-119374

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5DoSecureDelete that allows attackers to write past the leaf page buffer via crafted...

openSUSE 16 Security Update : python-Django (openSUSE-SU-2026:22196-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22196-1 advisory. Changes in python-Django: - CVE-2026-87975: an authenticated user permitted to submit a formset to delete rows outside the limiting queryset,...