Linux Distros Unpatched Vulnerability : CVE-2026-64286

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: arm64: Clear hyprunningvcpu when flushing the pKVM hyp vCPU flushhypvcpu copies the host vCPU context into the hyp's private vCPU on every run. ctxttovcpu...

Linux Distros Unpatched Vulnerability : CVE-2026-64382

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb: client: fix double-free in SMB2open replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2openinit fails...

Linux Distros Unpatched Vulnerability : CVE-2026-16407

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. CVE-2026-16407 Note that Nessus relies...

Linux Distros Unpatched Vulnerability : CVE-2026-64600

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xfs: resample the data fork mapping after cycling ILOCK xfsreflinkfillcowhole,delalloc are both presented with an inode, a data fork mapping, and a cow fork...

Linux Distros Unpatched Vulnerability : CVE-2026-64502

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iio: adc: adsigmadelta: fix clearpendingevent for registerless devices adsigmadeltaclearpendingevent falls through to the status register read path for devices...

Linux Distros Unpatched Vulnerability : CVE-2026-16396

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Privilege escalation in WebExtensions. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. CVE-2026-16396...

Linux Distros Unpatched Vulnerability : CVE-2026-64396

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ksmbd: fix UAF of struct filelock in SMB2LOCK deferred-lock cancellation When a blocking byte-range lock request is deferred in the FILELOCKDEFERRED path, ksmbd...

Linux Distros Unpatched Vulnerability : CVE-2026-64293

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iommufd: Use sizeofhdr instead of sizeofhdr in veventq read The bound-check in iommufdveventqfopsread for the normal vEVENT path uses sizeofhdr where the...

Fedora 44 : netatalk (2026-d085110cf3)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-d085110cf3 advisory. 4.5.1 Release Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for...

openSUSE 16 Security Update : joe (openSUSE-SU-2026:21408-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21408-1 advisory. This update for joe fixes the following issue - CVE-2026-13412: improper validation in tag-file parser can lead to arbitrary command execution bsc126937...

Linux Distros Unpatched Vulnerability : CVE-2026-16420

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Type Confusion in WebAudio in Google Chrome prior to 150.0.7871.182 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-59851

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is...

Linux Distros Unpatched Vulnerability : CVE-2026-64417

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mm: shrinker: fix NULL pointer dereference in debugfs shrinkerdebugfsadd creates both count and scan debugfs files unconditionally. That assumes every shrinker...

Linux Distros Unpatched Vulnerability : CVE-2026-16417

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uninitialized Use in Skia in Google Chrome prior to 150.0.7871.182 allowed a remote attacker who had compromised the renderer process to leak cross-origin data...

Linux Distros Unpatched Vulnerability : CVE-2026-64275

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Input: elani2c - prevent division by zero and arithmetic underflow The Elan I2C touchpad driver queries the device for its physical dimensions and trace counts ...

Linux Distros Unpatched Vulnerability : CVE-2026-64346

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: gadget: udc: Fix use-after-free in gadgetmatchdriver The udc structure acts as the management structure for the gadget, but their lifecycles are decoupled....

Linux Distros Unpatched Vulnerability : CVE-2026-65705

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vffloodfill video filter that allows attackers to corrupt heap memory by...

Linux Distros Unpatched Vulnerability : CVE-2026-63771

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Adminer before 5.4.3 contains a cookie injection vulnerability that allows attackers to manipulate cookie attributes by injecting arbitrary values through the...

Linux Distros Unpatched Vulnerability : CVE-2026-47023

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Replication. Supported versions that are affected are MySQL Server:...

Linux Distros Unpatched Vulnerability : CVE-2026-64369

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - s390: Revert support for DCACHEWORDACCESS loadunalignedzeropad reads eight bytes from unaligned addresses and may cross page boundaries. It handles exceptions...

Linux Distros Unpatched Vulnerability : CVE-2026-16362

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13...

Linux Distros Unpatched Vulnerability : CVE-2026-64529

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - crypto: qat - remove unused character device and IOCTLs The QAT driver exposes a character device qatadfctl with IOCTLs for device configuration, start, stop,...

Linux Distros Unpatched Vulnerability : CVE-2026-44228

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3, contain a stored Cross-Site Scripting XSS...

Linux Distros Unpatched Vulnerability : CVE-2026-55717

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In NLnet Labs Unbound 1.10.0 up to and including 1.25.1, when 'serve-expired: yes' is set together with a 'response-ip: redirect' /'response-ip-data: CNAME ' ru...

Linux Distros Unpatched Vulnerability : CVE-2026-64296

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - exfat: bound uniname advance in exfatfinddirentry In exfatfinddirentry, each TYPEEXTEND file name entry advances the output pointer by a fixed amount while the...

Linux Distros Unpatched Vulnerability : CVE-2026-16361

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory safety bugs present in Thunderbird ESR 140.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of the...

Linux Distros Unpatched Vulnerability : CVE-2026-64381

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb: client: Fix next buffer leak in receiveencryptedstandard receiveencryptedstandard allocates nextbuffer before checking whether the number of compound PDUs...

Linux Distros Unpatched Vulnerability : CVE-2026-50640

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - mbedtls - None Ubuntu Linux - Unknown description CVE-2026-50640 Note that Nessus relies on the presence of the package as reported by the vendor...

Linux Distros Unpatched Vulnerability : CVE-2026-64335

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - USB: serial: digiacceleport: fix broken rx after throttle If the port is closed while throttled, the read urb is never resubmitted and the port will not receive...

Linux Distros Unpatched Vulnerability : CVE-2026-64442

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - staging: rtl8723bs: fix OOB reads in IE loops in issueassocreq and joincmdhdl Two IE parsing loops are missing the header bounds checks before they dereference...

Linux Distros Unpatched Vulnerability : CVE-2026-64284

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: x86: Ensure vendor's exit handler runs before fastpath userspace exits Move the handling of fastpath userspace exits into vendor code to ensure KVM runs...

Linux Distros Unpatched Vulnerability : CVE-2026-64453

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: misc: usbio: fix disconnect UAF in client teardown usbiodisconnect walks usbio-clilist in reverse and uninitializes each auxiliary device...

Linux Distros Unpatched Vulnerability : CVE-2026-64309

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - crypto: ccp - Do not initialize SNP for ioctlSNPCOMMIT Sashiko notes: if SEV initialization fails and KVM is actively running normal VMs, could a userspace...

Linux Distros Unpatched Vulnerability : CVE-2026-47052

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: InnoDB. Supported versions that are affected are MySQL Server: 8.4.0-8.4.10,...

Linux Distros Unpatched Vulnerability : CVE-2026-50587

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - mbedtls - None Ubuntu Linux - Unknown description CVE-2026-50587 Note that Nessus relies on the presence of the package as reported by the vendor...

Linux Distros Unpatched Vulnerability : CVE-2026-63729

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The SyncTeX parser synctexparser.c shipped with TeX Live and embedded by downstream consumers such as GNOME Evince contains a heap use-after-free vulnerability...

Linux Distros Unpatched Vulnerability : CVE-2026-64497

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iio: chemical: scd30: Cleanup initializations and fix sign-extension bug Include linux/bitfield.h for FIELDGET. Create new macros for bit manipulation in...

Linux Distros Unpatched Vulnerability : CVE-2026-47010

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: ImageIO. Supported versions...

Linux Distros Unpatched Vulnerability : CVE-2026-47021

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: 2D. Supported versions that...

Linux Distros Unpatched Vulnerability : CVE-2026-47057

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in Oracle Java SE component: Scripting. Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf and 11.0.31. Easily exploitable...

Linux Distros Unpatched Vulnerability : CVE-2026-60147

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Security. Supported versions...

Linux Distros Unpatched Vulnerability : CVE-2026-47063

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Libraries. Supported version...

Linux Distros Unpatched Vulnerability : CVE-2026-47027

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in Oracle Java SE component: Libraries. Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11,...

Linux Distros Unpatched Vulnerability : CVE-2026-66032

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftpopen function in src/sftp.c that allows a malicious SSH server ...

Linux Distros Unpatched Vulnerability : CVE-2026-56852

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes. CVE-2026-56852 Note that Nessus relies on the presence of the package...

openSUSE 16: helm / helm-bash-completion / helm-fish-completion / etc (openSUSE-SU-2026:21422-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21422-1 advisory. This update for helm fixes the following issues - Update to version 3.21.3 - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only...

Linux Distros Unpatched Vulnerability : CVE-2026-64263

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fuse-uring: fix moving cancelled entry to entinuserspace list fuseuringcancel moves entries that are available these have no reqs attached to the entinuserspace...

Linux Distros Unpatched Vulnerability : CVE-2026-16412

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory safety bugs present in Firefox ESR 140.12 and Firefox 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort...

Linux Distros Unpatched Vulnerability : CVE-2026-64510

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ACPI: NFIT: core: Fix acpinfitinit error cleanup If acpinfitinit fails after adding the acpidesc object to the acpidescs list, that object is never removed from...

Linux Distros Unpatched Vulnerability : CVE-2026-13321

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The BIND resolver accepts validly-signed NSEC records where the Next Domain Name field points outside the signer's zone. This issue affects BIND 9 versions 9.11...