Linux Distros Unpatched Vulnerability : CVE-2026-68499

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2's String.prototype.match implementation with a global RE2 pattern...

MiracleLinux 9 : python3.14-3.14.5-1.el9_8 (AXSA:2026-1397:02)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1397:02 advisory. python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open API CVE-2026-4786 python: Python: Cross-Site Scripting XS...

RHEL 8 : python-pillow (RHSA-2026:48759)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:48759 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level...

Fedora 44 : nextcloud (2026-df06189438)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-df06189438 advisory. 34.0.2 Release Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for...

Oracle Linux 8 : fence-agents (ELSA-2026-47736)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-47736 advisory. - bundled httplib2: fix CVE-2026-59939 Resolves: RHEL-193803 Tenable has extracted the preceding description block directly from the Oracle Linux security...

AlmaLinux 10 : pipewire (ALSA-2026:47083)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:47083 advisory. pipewire: PipeWire: Sandbox escape and arbitrary code execution via malicious library loading CVE-2026-5674 Tenable has extracted the preceding description block...

AlmaLinux 9 : unbound (ALSA-2026:36777)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:36777 advisory. unbound: Unbound: Denial of Service via excessive EDNS options CVE-2026-41292 unbound: Unbound: Cache manipulation via 'ghost domain names' attack...

openSUSE 16: libpython3_13-1_0 / libpython3_13-1_0-x86-64-v3 / libpython3_13t1_0 / etc (openSUSE-SU-2026:21459-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21459-1 advisory. Changes in python313: Update to 3.13.14: - Security - gh-151159: Bumps the OpenSSL version to 3.0.21 on Android. - gh-150599: Fix a possible sta...

Fedora 43 : pack (2026-e6e0368149)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-e6e0368149 advisory. Security update to pack 0.40.8 Fixes CVE-2024-25621: containerd - local privilege escalation Fixes CVE-2025-47913: golang.org/x/crypto/ssh/agent - S...

GitLab 18.4 < 19.0.5 / 19.1 < 19.1.3 / 19.2 < 19.2.1 (CVE-2026-4672)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an...

SUSE SLES12: libipa_hbac-devel / libipa_hbac0 / libsss_certmap0 / etc (SUSE-SU-2026:3394-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:3394-1 advisory. This update for sssd fixes the following issue: - CVE-2026-12610: cancelled or completed PAM request while the asynchronous child process is still...

SUSE SLES12: PackageKit / PackageKit-backend-zypp / PackageKit-devel / etc (SUSE-SU-2026:3405-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:3405-1 advisory. This update for PackageKit fixes the following issue: - CVE-2026-10294: manipulation of the argument frontend-socket can lead to improper authorization...

Fedora 44 : postgresql16 (2026-f8ee1fd482)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-f8ee1fd482 advisory. Automatic update for postgresql16-16.14-1.fc44. Changelog for postgresql16 Thu May 14 2026 Packit - 16.14-1 - Update to version 16.14 - Resolves:...

Redis < 8.8.0 RCE via RESTORE Double Free (CVE-2026-66373)

The version of Redis installed on the remote host is prior to 8.8.0. It is, therefore, affected by a remote code execution vulnerability. - Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the sam...

openSUSE 16: java-21-openjdk / java-21-openjdk-demo / java-21-openjdk-devel / etc (openSUSE-SU-2026:21470-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21470-1 advisory. - CVE-2026-41254: Information disclosure or denial of service via integer overflow in CubeSize bsc1264994. - CVE-2026-46917: partial denial of...

SUSE SLES15: java-17-openjdk / java-17-openjdk-demo / java-17-openjdk-devel / etc (SUSE-SU-2026:3406-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3406-1 advisory. Upgrade to upstream tag jdk-17.0.20+8 July 2026 CPU. Security issues fixed: - CVE-2026-41254: lcms: information disclosure and deni...

ManageEngine ADAudit Plus < Build 8606 Unauthenticated RCE

The ManageEngine ADAudit Plus running on the remote host is prior to build 8606. It is, therefore, affected by an unauthenticated remote code execution vulnerability: - Zohocorp ManageEngine ADAudit Plus versions before 8606 are affected by unauthenticated remote code execution due to the...

JFrog Artifactory < 7.133.6 SSRF

According to its self-reported version number, the version of JFrog Artifactory installed on the remote host is prior to 7.133.6. It is, therefore, affected by a server-side request forgery SSRF vulnerability. - Improper URL validation when handling specific URLs, allows an attacker, under certai...

Oracle PeopleSoft PeopleTools Multiple Vulnerabilities (CSPU Jun 2026)

The version of Oracle PeopleSoft PeopleTools installed on the remote host is 8.61.x prior to 8.61.20 or 8.62.x prior to 8.62.10. It is, therefore, affected by multiple vulnerabilities as noted in the June 2026 Critical Security Patch Update advisory, whose patches also resolve Oracle Security Ale...

Brother MFC-9970CDW Printers Cross-site Scripting (CVE-2013-2670)

Cross-site scripting XSS vulnerability in the Brother MFC-9970CDW printer with firmware G 1.03 and L 1.10 allows remote attackers to inject arbitrary web script or HTML via an arbitrary parameter name QUERYSTRING to admin/adminmain.html, a different vulnerability than CVE-2013-2507 and...

SUSE SLES15: WebKitGTK-4.0-lang / WebKitGTK-4.1-lang / WebKitGTK-6.0-lang / etc (SUSE-SU-2026:3396-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3396-1 advisory. - CVE-2024-4367: missing type check when handling fonts in PDF.js can allow arbitrary JavaScript execution bsc1271638. -...

RHEL 8 : osbuild-composer (RHSA-2026:48790)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:48790 advisory. A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building...

SUSE SLED15 / SLES15 Security Update : bind (SUSE-SU-2026:3426-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3426-1 advisory. Upgrade to release 9.20.26. Security issues fixed: - CVE-2026-10723: incorrect acceptance of NSEC3 records...

Alt-N MDaemon 20.0.x < 20.0.9 / 21.0.x < 21.0.8 / 21.5.x < 21.5.6 / 22.0.x < 22.0.7 / 23.0.x < 23.0.4 / 23.5.x < 23.5.5 / 24.0.x < 24.0.4 / 24.5.x < 24.5.3 / 25.0.x < 25.0.3 Stored XSS

The remote Windows host is running a version of MDaemon Email Server that is affected by a stored cross-site scripting XSS vulnerability. An attacker can send a specially crafted HTML e-mail message with JavaScript in an img tag. This could allow a remote attacker to load arbitrary JavaScript cod...

Linux Distros Unpatched Vulnerability : CVE-2026-54715

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in nix systems or through the browser. In version 1.10.2, parsebrowser...

AlmaLinux 9 : kernel (ALSA-2026:45192)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:45192 advisory. kernel: KVM: x86: Don't recheck L1 intercepts when completing userspace I/O CVE-2025-40026 kernel: dm log: fix out-of-bounds write due to regioncount...

Mitsubishi Electric MELSEC iQ-F Series EtherNet/IP module and Ethernet module Improper Resource Shutdown or Release (CVE-2026-1876)

Improper Resource Shutdown or Release vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series FX5-ENET/IP Ethernet Module FX5-ENET/IP all versions allows a remote attacker to cause a denial- of-service DoS condition on the products by continuously sending UDP packets to the products. ...

Qnap QTS and QuTS hero OS Command Injection (CVE-2026-22893)

A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS...

Qnap QTS and QuTS hero OS Command Injection (CVE-2025-66273)

A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS...

Autodesk Multiple Vulnerabilities (AutoCAD) (adsk-sa-2026-0009)

The 2027 version of Autodesk AutoCAD installed on the remote Windows host may be affected by multiple vulnerabilities: - A maliciously crafted DXF file, when parsed through Autodesk AutoCAD, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause ...

JetBrains PhpStorm < 2026.2 Multiple Vulnerabilities

According to its self-reported version, the JetBrains PhpStorm installation on the remote host is prior to 2026.2. It is, therefore, affected by a multiple vulnerabilities. - In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via project toolin...

SUSE SLED15: ImageMagick / ImageMagick-config-7-SUSE / etc (SUSE-SU-2026:3414-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3414-1 advisory. - CVE-2026-62343: heap buffer overwrite in morphology operation when an invalid kernel is provided bsc1272575....

SUSE SLED15 / SLES15 Security Update : ImageMagick (SUSE-SU-2026:3413-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3413-1 advisory. - CVE-2026-62343: heap buffer overwrite in morphology operation when an invalid kernel is provided bsc1272575....

SUSE SLED15: openvpn / openvpn-auth-pam-plugin / openvpn-dco / openvpn-dco-devel / etc (SUSE-SU-2026:3407-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3407-1 advisory. - CVE-2026-13122: denial of service via a malformed authentication token that triggers a reachable assertion...

RHEL 10 : kernel (RHSA-2026:49211)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:49211 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: ksm: use range-walk function...

RHEL 8 : abrt (RHSA-2026:48819)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:48819 advisory. The Automatic Bug Reporting Tool ABRT recognizes defects in applications and creates bug reports that help maintainers fix the defects. ABR...

Linux Distros Unpatched Vulnerability : CVE-2026-55768

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in nix systems or through the browser. Prior to version 1.11, the built-...

Linux Distros Unpatched Vulnerability : CVE-2026-63222

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, calling UploadedFile::move without a second argument uses the client-provided filename without...

RHEL 10 : kernel (RHSA-2026:49030)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:49030 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: KVM: x86: Don't recheck L1...

MiracleLinux 9 : python3.14-urllib3-2.6.3-2.el9_8 (AXSA:2026-1406:01)

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-1406:01 advisory. urllib3: urllib3: Denial of Service due to excessive HTTP response decompression CVE-2026-44432 urllib3: urllib3: Information disclosure via...

Oracle Linux 8 : kernel (ELSA-2026-45115)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-45115 advisory. - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level Aidan Wallace RHEL-213341 CVE-2026-63807 - KVM: x86: Don't recheck L1...

Linux Distros Unpatched Vulnerability : CVE-2026-13379

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Windows interactive service in OpenVPN 2.7alpha1 through 2.7.4 allows remote attackers to cause persistent DNS state pollution or a service crash via a...

Oracle Linux 8 : sssd (ELSA-2026-46990)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-46990 advisory. - Resolves: RHEL-192053 - CVE-2026-14474: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege...

Linux Distros Unpatched Vulnerability : CVE-2026-65423

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An integer overflow in the UAVariant arrayDimensions product computation in open62541 may allow a remote attacker to trigger an out-of-bounds write...

RockyLinux 10 : nodejs22 (RLSA-2026:48033)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:48033 advisory. brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity CVE-2026-13149 tar: Node-tar: Denial of Service via malformed ta...

RHEL 8 : abrt (RHSA-2026:48865)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:48865 advisory. The Automatic Bug Reporting Tool ABRT recognizes defects in applications and creates bug reports that help maintainers fix the defects. ABR...

SUSE SLES15: tomcat11 / tomcat11-admin-webapps / tomcat11-el-6_0-api / etc (SUSE-SU-2026:3430-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3430-1 advisory. Update to Tomcat 11.0.24. Security issues fixed: - CVE-2026-59083: incorrect URL decoding in RewriteValve may allow security contro...

SUSE SLES15: tomcat / tomcat-admin-webapps / tomcat-el-3_0-api / etc (SUSE-SU-2026:3419-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3419-1 advisory. Update to Tomcat 9.0.120. Security issues fixed: - CVE-2026-59083: incorrect URL decoding in RewriteValve may allow security contro...

RHEL 8 : libsolv (RHSA-2026:48815)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:48815 advisory. The libsolv packages provide a library for resolving package dependencies using a satisfiability algorithm. Security Fixes: libsolv: Heap buffer...

RHEL 9 : libsolv (RHSA-2026:48813)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:48813 advisory. The libsolv packages provide a library for resolving package dependencies using a satisfiability algorithm. Security Fixes: libsolv: Heap buffer...