MiracleLinux 9 : libX11-1.8.12-1.el9_8.1 (AXSA:2026-2216:03)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-2216:03 advisory. libX11: libX11: Heap-based buffer overflow via malicious X server CVE-2026-88806 Tenable has extracted the preceding description block directly from the...

Linux Distros Unpatched Vulnerability : CVE-2026-119374

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5DoSecureDelete that allows attackers to write past the leaf page buffer via crafted...

openSUSE 16 Security Update : python-Django (openSUSE-SU-2026:22196-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22196-1 advisory. Changes in python-Django: - CVE-2026-87975: an authenticated user permitted to submit a formset to delete rows outside the limiting queryset,...

Linux Distros Unpatched Vulnerability : CVE-2026-120246

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg 4.4 through 9.0.2 contains a use of uninitialized variable vulnerability in the CDXL decoder that leaks stack memory into decoded pixels via unfilled HAM...

Rocky Linux 8.6 [CIQ] Security Update: openssh / openssh-askpass / openssh-cavs / openssh-clients / etc Multiple Vulnerabilities (ciqsa-2026_1742)

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261742 advisory. This advisory aggregates security fixes for the openssh SRPM in CIQ LTS 8.6. It addresses 21 CVEs: CVE-2025-26465, CVE-2026-35388, CVE-2026-59999,...

Fedora 45 : atuin (2026-ab1f2544f2)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-ab1f2544f2 advisory. Rebuilt with updated rustls and webpki dependencies, including updated CA certificates for the eMudhra intermediate CA compromise. Tenable has extracted the...

Rocky Linux 9 [CIQ] Security Update: firefox / firefox-debuginfo / firefox-debugsource / firefox-x11 Multiple Vulnerabilities (crlsa-2026_89757)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202689757 advisory. libexpat: denial of service via crafted XML input CVE-2026-45186 firefox: thunderbird: Privilege escalation in the Application Update component...

Linux Distros Unpatched Vulnerability : CVE-2026-120245

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg 0.10 through 9.0.2 contains a use of uninitialized resource vulnerability in sunrastdecodeframe that leaks heap memory when decoding truncated 1-bit and...

RockyLinux 8 : python-pillow (RLSA-2026:93077)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:93077 advisory. pillow: Pillow: Heap buffer overflow in tiffWriteProc when saving TIFF to BytesIO CVE-2026-112393 pillow: Pillow: Heap buffer overflow in FlashPix FPX...

CentOS Linux 7 [TuxCare] Security Update: libvirt / libvirt-admin / libvirt-bash-completion / libvirt-client / etc (CENTOS7:CLSA-2026:1793178380)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1793178380 advisory. - A flaw was found in libvirt. A local attacker, specifically a process running as the confined swtpm user, could exploit a symlink-following...

Linux Distros Unpatched Vulnerability : CVE-2026-116566

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - socket.getaddrinfo previously accepted null bytes within host and port parameters which can cause the values to be silently truncated. CVE-2026-116566 Note that...

Fedora 44 : rust-gst-plugin-reqwest (2026-857be6ce3c)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-857be6ce3c advisory. Rebuilt with updated rustls and webpki dependencies, including updated CA certificates for the eMudhra intermediate CA compromise. Tenable has extracted the...

Fedora 43 : btrfs-backup-ng (2026-28cd8623c6)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-28cd8623c6 advisory. Update to 0.9.20. This replaces the 0.9.19 update before it reached testing. It carries the 0.9.17 security fix GHSA-5xvm-66c9-p5ph, the 0.9.18 fix for...

openSUSE 16: cifs-utils / cifs-utils-devel / pam_cifscreds / etc (openSUSE-SU-2026:22170-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:22170-1 advisory. This update for cifs-utils fixes the following issue: - CVE-2026-104715: mount options injection via CIFS credentials-file parsing bsc1284932. Tenable h...

Fedora 43 : rust-resctl-bench (2026-1af426cc3c)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-1af426cc3c advisory. Rebuilt with updated webpki dependencies - Fixes RUSTSEC-2026-0381, RUSTSEC-2026-0383, and RUSTSEC-2026-0382. ---- Fix compilation error with recent versions...

MiracleLinux 9 : kernel-5.14.0-687.51.1.el9_8 (AXSA:2026-2209:112)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2209:112 advisory. kernel: block: zero non-PI portion of auto integrity buffer CVE-2026-23007 kernel: afunix: Drop all SCM attributes for SOCKMAP CVE-2026-53005 kerne...

Rocky Linux 9.2 [CIQ] Security Update: bpftool / kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ciqsa-2026_1744)

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261744 advisory. This advisory aggregates security fixes for the kernel SRPM in CIQ FIPS 9.2 Compliant. It addresses 7 CVEs: CVE-2026-72130, CVE-2026-98725, CVE-2026-9843...

MiracleLinux 9 : cjose-0.6.1-17.el9_8.1 (AXSA:2026-2213:01)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-2213:01 advisory. cjose: cjose: Heap buffer overflow in AES Key Wrap decryption leads to denial of service CVE-2026-53938 Tenable has extracted the preceding description block...

CentOS Linux 7 [TuxCare] Security Update: libxml2 / libxml2-devel / libxml2-python / libxml2-static (CENTOS7:CLSA-2026:1793181967)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1793181967 advisory. - A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted X...

Fedora 43 : rust-gst-plugin-reqwest (2026-9d35d78443)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-9d35d78443 advisory. Rebuilt with updated rustls and webpki dependencies, including updated CA certificates for the eMudhra intermediate CA compromise. Tenable has extracted the...

Fedora 44 : rust-cargo-deny (2026-24a2875e95)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-24a2875e95 advisory. Rebuilt with updated webpki dependencies - Fixes RUSTSEC-2026-0381, RUSTSEC-2026-0383, and RUSTSEC-2026-0382. Tenable has extracted the preceding description...

Fedora 44 : atuin (2026-1515132b5a)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-1515132b5a advisory. Rebuilt with updated rustls and webpki dependencies, including updated CA certificates for the eMudhra intermediate CA compromise. Tenable has extracted the...

Linux Distros Unpatched Vulnerability : CVE-2026-9535

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A out-of-bounds read vulnerability exists in the vtkChacoReader InputGraph2 functionality of vtk versions: 9.6.1. A specially crafted chaco can lead to an...

CentOS Linux 6 [TuxCare] Security Update: unbound / unbound-devel / unbound-libs / unbound-python Multiple Vulnerabilities (CENTOS6:CLSA-2026:1793169702)

The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1793169702 advisory. - Unbound before 1.9.5 allows an integer overflow in the regional allocator via regionalalloc. NOTE: The vendor disputes that this is a...

openSUSE 16: libshadowsocks-libev2 / shadowsocks-libev / etc (openSUSE-SU-2026:22189-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22189-1 advisory. Changes in shadowsocks-rust: - Fix SELinux denial nameconnect when forwarding outbound TCP traffic boo1284975 - Fix: Unable to bind ports below...

Linux Distros Unpatched Vulnerability : CVE-2026-119563

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - phpMyAdmin through 5.2.3 contains a stored cross-site scripting vulnerability that allows database users with CREATE privilege to inject script via unescaped...

Linux Distros Unpatched Vulnerability : CVE-2026-119376

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITELIMITEXPRDEPTH limit by chaining COLLATE postfix...

Fedora 45 : rust-gst-plugin-reqwest (2026-496f06c60b)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-496f06c60b advisory. Rebuilt with updated rustls and webpki dependencies, including updated CA certificates for the eMudhra intermediate CA compromise. Tenable has extracted the...

Rocky Linux 9.2 [CIQ] Security Update: aspnetcore-runtime-7.0 / aspnetcore-targeting-pack-7.0 / etc (ciqsa-2026_1741)

The Rocky Linux 9.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261741 advisory. This advisory aggregates security fixes for the dotnet7.0 SRPM in CIQ LTS 9.2. It addresses 1 CVE: CVE-2026-111497. Tenable has extracted the preceding descriptio...

SUSE SLED15: libpython3_11-1_0 / python311 / python311-base / python311-curses / etc (SUSE-SU-2026:4946-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4946-1 advisory. - CVE-2026-9669: crafted input can cause a stack buffer overflow bsc1267974. - CVE-2026-15310: memory exhausti...

Fedora 45 : rust-rustls-webpki / rust-webpki-root-certs / rust-webpki-roots (2026-ec2ce9d2ef)

The remote Fedora 45 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-ec2ce9d2ef advisory. - Update the rustls-webpki crate to version 0.103.16. - Update the webpki-roots and webpki-root-certs crates to version 1.0.11. This addresses security...

AlmaLinux 9 : firefox (ALSA-2026:89757)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:89757 advisory. libexpat: denial of service via crafted XML input CVE-2026-45186 firefox: thunderbird: Privilege escalation in the Application Update component...

Linux Distros Unpatched Vulnerability : CVE-2026-119379

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in sqlite3changesetapply that allows attackers to corrupt he...

Linux Distros Unpatched Vulnerability : CVE-2026-119568

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - vsftpd through 3.0.5 contains an authentication bypass vulnerability in ssldataaccept that allows unauthenticated attackers to hijack FTPS data connections by...

MiracleLinux 9 : libXrender-0.9.10-16.el9_8.2 (AXSA:2026-2219:02)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-2219:02 advisory. libXrender: libXrender: Code injection via heap overflow in RenderQueryPictFormats CVE-2026-88807 Tenable has extracted the preceding description block...

Linux Distros Unpatched Vulnerability : CVE-2026-105924

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A NULL pointer dereference vulnerability in the Qt QCborValue to JSON conversion of the Qt Core module. CVE-2026-105924 Note that Nessus relies on the presence ...

Linux Distros Unpatched Vulnerability : CVE-2026-120210

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg 5.0 through 9.0.2 contains a path traversal vulnerability in the IMF demuxer that allows attackers to open files outside the package via unvalidated...

Fedora 43 : rust-cargo-deny (2026-3e3bd89bd2)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-3e3bd89bd2 advisory. Rebuilt with updated webpki dependencies - Fixes RUSTSEC-2026-0381, RUSTSEC-2026-0383, and RUSTSEC-2026-0382. Tenable has extracted the preceding description...

Fedora 45 : mupdf (2026-dd418bdfde)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-dd418bdfde advisory. fix CVE-2026-112036 rhbz2558213 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

openSUSE 16 Security Update : ansible-core (openSUSE-SU-2026:22172-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:22172-1 advisory. - CVE-2026-89091: an attacker can get a victim to install a malicious collection to overwrite arbitrary files with the privileges of the user running...

Fedora 44 : rust-webpki-root-certs / rust-webpki-roots (2026-6ceed7409a)

The remote Fedora 44 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-6ceed7409a advisory. Update webpki-roots / webpki-root-certs to version 1.0.11. These releases contain a followup fix for the eMudhra Intermediate CA Compromise. Tenable has...

openSUSE 16: aws-nitro-enclaves-binaryblobs-upstream / aws-nitro-enclaves-cli / etc (openSUSE-SU-2026:22175-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22175-1 advisory. - CVE-2026-93599: rustls-webpki: panic in BorrowedCertRevocationList::fromder via empty BIT STRING in IssuingDistributionPoint bsc1282250. -...

Fedora 45 : rust-resctl-bench (2026-6809b4143f)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-6809b4143f advisory. Rebuilt with updated webpki dependencies - Fixes RUSTSEC-2026-0381, RUSTSEC-2026-0383, and RUSTSEC-2026-0382. ---- Fix compilation error with recent versions...

Fedora 45 : vhs (2026-ff352aea5d)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-ff352aea5d advisory. Update to version 0.12.1. https://github.com/charmbracelet/vhs/releases/tag/v0.12.1 Tenable has extracted the preceding description block directly...

CentOS Linux 6 [TuxCare] Security Update: sendmail / sendmail-cf / sendmail-devel / sendmail-doc / etc (CENTOS6:CLSA-2026:1793168965)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1793168965 advisory. - ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible...

FreeBSD : Weechat -- Multiple vulnerabilities (91ea9062-d50a-11f1-8135-8447094a420f)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 91ea9062-d50a-11f1-8135-8447094a420f advisory. The Weechat project reports: Tenable has extracted the preceding description block directly from the...

Linux Distros Unpatched Vulnerability : CVE-2026-119299

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gopacket provides packet processing capabilities for Go. Prior to 1.7.2, the SCTP chunk chain in layers/sctp.go passes attacker-controlled declared lengths and...

Linux Distros Unpatched Vulnerability : CVE-2026-120243

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg 2.0 through 9.0.2 contains a use of uninitialized variable vulnerability in the Go2Meeting decoder that allows attackers to leak stack memory through...

Fedora 45 : perl-DBI (2026-ea9d9f0e38)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-ea9d9f0e38 advisory. Changes for version 1.656 Remove lock file on end of scope Prevent dbiprofile crash CVE-2026-108518 Henrik Teichmann Memory corruption via...

openSUSE 16 Security Update : roundcubemail (openSUSE-SU-2026:22195-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22195-1 advisory. Changes in roundcubemail: Update to 1.6.20: This is a security update to the version 1.6 of Roundcube Webmail. It provides fixes to recently...