Fedora 45 : rust-resctl-bench (2026-6809b4143f)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-6809b4143f advisory. Rebuilt with updated webpki dependencies - Fixes RUSTSEC-2026-0381, RUSTSEC-2026-0383, and RUSTSEC-2026-0382. ---- Fix compilation error with recent versions...

Fedora 45 : vhs (2026-ff352aea5d)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-ff352aea5d advisory. Update to version 0.12.1. https://github.com/charmbracelet/vhs/releases/tag/v0.12.1 Tenable has extracted the preceding description block directly...

CentOS Linux 6 [TuxCare] Security Update: sendmail / sendmail-cf / sendmail-devel / sendmail-doc / etc (CENTOS6:CLSA-2026:1793168965)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1793168965 advisory. - ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible...

FreeBSD : Weechat -- Multiple vulnerabilities (91ea9062-d50a-11f1-8135-8447094a420f)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 91ea9062-d50a-11f1-8135-8447094a420f advisory. The Weechat project reports: Tenable has extracted the preceding description block directly from the...

Linux Distros Unpatched Vulnerability : CVE-2026-119299

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gopacket provides packet processing capabilities for Go. Prior to 1.7.2, the SCTP chunk chain in layers/sctp.go passes attacker-controlled declared lengths and...

Linux Distros Unpatched Vulnerability : CVE-2026-120243

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg 2.0 through 9.0.2 contains a use of uninitialized variable vulnerability in the Go2Meeting decoder that allows attackers to leak stack memory through...

Fedora 45 : perl-DBI (2026-ea9d9f0e38)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-ea9d9f0e38 advisory. Changes for version 1.656 Remove lock file on end of scope Prevent dbiprofile crash CVE-2026-108518 Henrik Teichmann Memory corruption via...

openSUSE 16 Security Update : roundcubemail (openSUSE-SU-2026:22195-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22195-1 advisory. Changes in roundcubemail: Update to 1.6.20: This is a security update to the version 1.6 of Roundcube Webmail. It provides fixes to recently...

CentOS Linux 6 [TuxCare] Security Update: libgcrypt / libgcrypt-devel (CENTOS6:CLSA-2026:1793168366)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1793168366 advisory. - Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack...

openSUSE 16: libvlc5 / libvlccore9 / vlc / vlc-codec-fluidsynth / etc (openSUSE-SU-2026:22198-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:22198-1 advisory. Changes in vlc: - Add conditional for pkgconfigvpl BuildRequires and plugin, exclude %arm ppc64le %ppc s390x. - Add conditional for pkgconfiglibnfs...

Fedora 43 : atuin (2026-ebf485c756)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-ebf485c756 advisory. Rebuilt with updated rustls and webpki dependencies, including updated CA certificates for the eMudhra intermediate CA compromise. Tenable has extracted the...

FreeBSD : py-django -- Multiple vulnerabilities (1a0c64ff-5f9f-11f1-8ea1-fb4f92e650aa)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 1a0c64ff-5f9f-11f1-8ea1-fb4f92e650aa advisory. django reports: In accordance with our security release policy, the Django team is issuing...

openSUSE 16 Security Update : hauler (openSUSE-SU-2026:22201-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22201-1 advisory. Changes in hauler: - update vendor: CVE-2026-114437: github.com/go-chi/chi/v5: client IP spoofing in ClientIPFromXFF via X-Forwarded-For...

Linux Distros Unpatched Vulnerability : CVE-2026-119566

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Prometheus through 3.15.1 contains a credential leak vulnerability that allows attackers to capture Azure AD or Google IAM bearer tokens by redirecting...

openSUSE 16 Security Update : libmikmod (openSUSE-SU-2026:22192-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22192-1 advisory. Changes in libmikmod: - CVE-2026-105839: make sure that numtrk calculation fits into an UWORD bsc1284366 - CVE-2026-105838: bump itpat allocatio...

Fedora 45 : rust-gst-plugin-reqwest (2026-496f06c60b)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-496f06c60b advisory. Rebuilt with updated rustls and webpki dependencies, including updated CA certificates for the eMudhra intermediate CA compromise. Tenable has extracted the...

SUSE SLED15: libpython3_11-1_0 / python311 / python311-base / python311-curses / etc (SUSE-SU-2026:4946-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4946-1 advisory. - CVE-2026-9669: crafted input can cause a stack buffer overflow bsc1267974. - CVE-2026-15310: memory exhausti...

Fedora 45 : rust-rustls-webpki / rust-webpki-root-certs / rust-webpki-roots (2026-ec2ce9d2ef)

The remote Fedora 45 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-ec2ce9d2ef advisory. - Update the rustls-webpki crate to version 0.103.16. - Update the webpki-roots and webpki-root-certs crates to version 1.0.11. This addresses security...

openSUSE 16 Security Update : ghostscript (openSUSE-SU-2026:22176-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22176-1 advisory. - CVE-2026-101258: -dSAFER sandbox bypass via Type 5 shading OOB write and procedure-stream use-after-free bsc1284397. - CVE-2026-103226:...

Fedora 45 : btrfs-backup-ng (2026-a44f471fef)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-a44f471fef advisory. Update to 0.9.20. This replaces the 0.9.19 update before it reached testing. It carries the 0.9.17 security fix GHSA-5xvm-66c9-p5ph, the 0.9.18 fix for...

MiracleLinux 9 : kernel-5.14.0-687.51.1.el9_8 (AXSA:2026-2209:112)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2209:112 advisory. kernel: block: zero non-PI portion of auto integrity buffer CVE-2026-23007 kernel: afunix: Drop all SCM attributes for SOCKMAP CVE-2026-53005 kerne...

openSUSE 16 Security Update : chromium (openSUSE-SU-2026:22185-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22185-1 advisory. Changes in chromium: Chromium 156 156.0.8078.47 promoted to stable boo1286350: CVE-2026-113341: Memory corruption in Skia CVE-2026-113279: Memor...

openSUSE 16 Security Update : chromium (openSUSE-SU-2026:22202-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22202-1 advisory. Changes in chromium: - Chromium 156.0.8078.73 boo1288218: CVE-2026-118306: Memory corruption in FileSystem CVE-2026-118331: Improper input...

RHEL 10 : kernel (RHSA-2026:93413)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:93413 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: Kernel: Denial of Service in...

Rocky Linux 9.2 [CIQ] Security Update: bpftool / kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ciqsa-2026_1744)

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261744 advisory. This advisory aggregates security fixes for the kernel SRPM in CIQ FIPS 9.2 Compliant. It addresses 7 CVEs: CVE-2026-72130, CVE-2026-98725, CVE-2026-9843...

SUSE SLED15: libbrotli-devel / libbrotlicommon1 / libbrotlicommon1-32bit / etc (SUSE-SU-2026:4945-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4945-1 advisory. This update for brotli fixes the following issue: - CVE-2026-111497: Brotli decoder out-of-bounds write permits remote...

Linux Distros Unpatched Vulnerability : CVE-2026-120247

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability in the Huffyuv decoder that allows attackers to leak heap memory into decoded...

Rocky Linux 9.2 [CIQ] Security Update: aspnetcore-runtime-7.0 / aspnetcore-targeting-pack-7.0 / etc (ciqsa-2026_1741)

The Rocky Linux 9.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261741 advisory. This advisory aggregates security fixes for the dotnet7.0 SRPM in CIQ LTS 9.2. It addresses 1 CVE: CVE-2026-111497. Tenable has extracted the preceding descriptio...

CentOS Linux 7 [TuxCare] Security Update: cyrus-sasl / cyrus-sasl-devel / cyrus-sasl-gs2 / cyrus-sasl-gssapi / etc (CENTOS7:CLSA-2026:1793184437)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1793184437 advisory. - A heap-based buffer overflow flaw was found in Cyrus SASL. The addtochallenge function in the DIGEST- MD5 plugin computes the size of the buffe...

openSUSE 16 Security Update : coredns (openSUSE-SU-2026:22194-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22194-1 advisory. Changes in coredns: - Update to 1.15.0: Fixes VUL-0: CVE-2026-78669: excessive CPU consumption in HTTP/2 boo1285501 and CVE-2026-97032: HTTP/2...

CentOS Linux 7 [TuxCare] Security Update: curl / libcurl / libcurl-devel Multiple Vulnerabilities (CENTOS7:CLSA-2026:1793163761)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1793163761 advisory. - An HTTP proxy can trick libcurl into sending the origin's credentials Basic password, or a Negotiate/Kerberos ticket to the proxy...

RockyLinux 9 : bind9.18 (RLSA-2026:93072)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:93072 advisory. bind: BIND: Denial of Service via unbounded processing of crafted DNS messages CVE-2026-19630 bind: bind: Arbitrary code execution via GSS-TSIG UDP...

Fedora 44 : rust-cargo-rpmstatus (2026-be40dae83d)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-be40dae83d advisory. Rebuilt with updated rustls and webpki dependencies - Fixes RUSTSEC-2026-0346, RUSTSEC-2026-0347, RUSTSEC-2026-0348, RUSTSEC-2026-0349, RUSTSEC-2026-0381,...

openSUSE 16: bouncycastle / bouncycastle-javadoc / bouncycastle-jmail / etc (openSUSE-SU-2026:22169-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22169-1 advisory. Update to 1.86: - CVE-2026-17507: negative signed leafindex values from unsigned wire encodings can cause heap exhaustion bsc1284075. -...

Fedora 43 : libheif (2026-b36391d93c)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-b36391d93c advisory. Latest upstream security bugfix release. Changes: https://github.com/strukturag/libheif/releases/tag/v1.23.7 . Tenable has extracted the preceding descriptio...

FreeBSD : uriparser -- Integer overflow vulnerability (d6aba3d5-d549-11f1-95a4-3c7c3fba4204)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the d6aba3d5-d549-11f1-95a4-3c7c3fba4204 advisory. The URIparser project reports: Tenable has extracted the preceding description block directly from the...

MiracleLinux 8 : python3.12-urllib3-1.26.19-5.el8_10 (AXSA:2026-2211:06)

The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-2211:06 advisory. urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser CVE-2026-97689 urllib3: urllib3: Traffic interception via HTTPS...

openSUSE 16 Security Update : perl-Mozilla-CA (openSUSE-SU-2026:22207-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:22207-1 advisory. Changes in perl-Mozilla-CA: - updated to 20261020.0.0 20261020 20261020 - Update from Mozilla repository to 2026-10-20 - Denylisted certificates:...

Rocky Linux 9 [CIQ] Security Update: aspnetcore-runtime-10.0 / aspnetcore-runtime-dbg-10.0 / etc (crlsa-2026_92432)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202692432 advisory. dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnerability CVE-2026-114148 Bug Fixes and Enhancements: Update .NET 10.0 to SDK...

Rocky Linux 9 [CIQ] Security Update: curl / curl-debuginfo / curl-debugsource / curl-minimal / etc (crlsa-2026_92907)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202692907 advisory. libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse CVE-2026-8932 Tenable has extracted the preceding description block directly from t...

Rocky Linux 9 [CIQ] Security Update: aspnetcore-runtime-9.0 / aspnetcore-runtime-dbg-9.0 / etc (crlsa-2026_92429)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202692429 advisory. dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnerability CVE-2026-114148 Bug Fixes and Enhancements: Update .NET 9.0 to SDK...

CentOS Linux 7 [TuxCare] Security Update: glib2 / glib2-devel / glib2-doc / glib2-fam / glib2-static / etc (CENTOS7:CLSA-2026:1793180638)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1793180638 advisory. - A flaw was found in xdgmime. A heap-based buffer overflow can be triggered in xdgmimemagicparsemagicline in the xdgmimemagic.c file on...

FreeBSD : phpmyfaq -- multiple vulnerabilities (5cd347f3-d573-11f1-a2bb-50ebf6bdf8e9)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 5cd347f3-d573-11f1-a2bb-50ebf6bdf8e9 advisory. phpMyFAQ team reports: The WebAuthn prepare-login endpoint returns stable credential IDs for existing...

openSUSE 16 Security Update : perl-Cpanel-JSON-XS (openSUSE-SU-2026:22187-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22187-1 advisory. Changes in perl-Cpanel-JSON-XS: - updated to 4.800.0 4.80 + Security fixes, reported by Stig Palmquist CPANSec: CVE-2026-110672 decode: free the...

Fedora 44 : rust-resctl-bench (2026-7327b9945e)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-7327b9945e advisory. Rebuilt with updated webpki dependencies - Fixes RUSTSEC-2026-0381, RUSTSEC-2026-0383, and RUSTSEC-2026-0382. ---- Fix compilation error with recent versions...

Fedora 44 : python3.12 (2026-5b3be6a58a)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-5b3be6a58a advisory. Fixup for CVE-2026-19553 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested fo...

Linux Distros Unpatched Vulnerability : CVE-2026-119601

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - AFFLIB through 3.7.22 contains a heap out-of-bounds write vulnerability in afgetpage that allows attackers to corrupt heap memory by supplying crafted AFF image...

Linux Distros Unpatched Vulnerability : CVE-2026-119375

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SQLite before 3.54.0 contains an information disclosure vulnerability that allows attackers to read uninitialized page-cache memory by supplying a WAL file with...

Linux Distros Unpatched Vulnerability : CVE-2026-54659

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Pagy is agnostic pagination in plain Ruby. From 43.0.0 until 43.5.6, Pagy::I18n.locale= in gem/lib/pagy/modules/i18n/i18n.rb stored locale values verbatim and...

Linux Distros Unpatched Vulnerability : CVE-2026-120244

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg 2.1 through 9.0.2 contains a use of uninitialized resource vulnerability in the PCX decoder that allows attackers to leak heap memory through truncated R...