Rocky Linux 8 [CIQ] Security Update: python-pillow-debuginfo / python-pillow-debugsource / etc Multiple Vulnerabilities (crlsa-2026_92639)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202692639 advisory. pillow: Pillow: Denial of Service via unbounded recursion in PDF parser CVE-2026-112391 pillow: pillow: Denial of service via double free during image...

Fedora 45 : syncthing (2026-773e644d9d)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-773e644d9d advisory. Update to version 2.1.6. Release notes: - https://github.com/syncthing/syncthing/releases/tag/v2.1.4 -...

Fedora 45 : wordpress (2026-3c05ab9fa4)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-3c05ab9fa4 advisory. WordPress 7.1.3 Maintenance and Security Release Security updates included in this release - A stored XSS on the Comments administration page, exploitable vi...

RockyLinux 8 : tomcat (RLSA-2026:92869)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:92869 advisory. tomcat: Apache Tomcat: Security constraint bypass due to improper access control CVE-2026-65182 tomcat: Apache Tomcat: Access control bypass due to...

Linux Distros Unpatched Vulnerability : CVE-2026-118779

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used pem.decode,...

Fedora 45 : radicale (2026-63128ed82f)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-63128ed82f advisory. Update to 3.9.0 ---- Update to 3.8.3 ---- Update to 3.8.2 Tenable has extracted the preceding description block directly from the Fedora security advisory...

Fedora 45 : xorg-x11-server (2026-8604653718)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-8604653718 advisory. xorg-server-21.1.25 fixups ---- Update to xserver 21.1.24, Security fixes for CVE-2026-88812, CVE-2026-93515, CVE-2026-93516, CVE-2026-93517,...

Linux Distros Unpatched Vulnerability : CVE-2026-107279

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. In 3.0.12, a peer offering...

Fedora 45 : libindi (2026-50d453a849)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-50d453a849 advisory. Update to 2.2.5 and fix CVE-2026-71979. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus ha...

Linux Distros Unpatched Vulnerability : CVE-2026-8824

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A memory corruption vulnerability exists in the vtkBMPReader ExecuteDataWithInformation functionality of vtk versions: 9.6.1. A specially crafted .bmp file can...

RockyLinux 10 : .NET 9.0 (RLSA-2026:92430)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:92430 advisory. dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnerability CVE-2026-114148 Bug Fixes and Enhancements: Update .NET 9.0 to S...

Rocky Linux 8 [CIQ] Security Update: httpd / httpd-debuginfo / httpd-debugsource / httpd-devel / etc Multiple Vulnerabilities (crlsa-2026_92616)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202692616 advisory. httpd: modauthdigest: timing attack allows a bypass of digest authentication CVE-2026-33006 httpd: httpd: HTTP response smuggling via crafted...

Fedora 45 : httpd (2026-b6d445cd3e)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-b6d445cd3e advisory. This update includes httpd version 2.4.69 addressing various security issues, see https://downloads.apache.org/httpd/CHANGES2.4.69 for more...

Oracle Linux 8 : httpd:2.4 (ELSA-2026-92616)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-92616 advisory. - Resolves: RHEL-173558 - httpd:2.4/httpd: Apache HTTP Server modproxyajp: Arbitrary code execution via heap-based buffer overflow CVE-2026-28780 -...

Fedora 45 : libheif (2026-d28ea22f26)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-d28ea22f26 advisory. Latest upstream security bugfix release. Changes: https://github.com/strukturag/libheif/releases/tag/v1.23.7 . ---- Update libheif to 1.23.6 Yet another...

Linux Distros Unpatched Vulnerability : CVE-2026-118765

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Botan is a C++ cryptography library. From 3.7.0 until 3.13.0, an application that calls AutoSeededRNG::clear and then calls randomize with an empty output buffe...

Linux Distros Unpatched Vulnerability : CVE-2026-120194

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in json-glib. The JSONPath slice evaluator used by jsonpathquery can enter an infinite loop when given a slice expression with a negative step...

Fedora 45 : qt5-qtbase (2026-2ae512a6d5)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-2ae512a6d5 advisory. Fix CVE-2026-19248, denial of Service vulnerability in XML parsing Tenable has extracted the preceding description block directly from the Fedora security...

FreeBSD : sqlite3 -- multiple vulnerabilities (84cd82e1-d49f-11f1-bae2-3497f65b111b)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 84cd82e1-d49f-11f1-bae2-3497f65b111b advisory. VulnCheck reports: Ten vulnerabilities fixed in SQLite 3.54.0 were published on 2026-10-30. Fo...

Amazon Linux 2023 : python3.11, python3.11-devel, python3.11-idle (ALAS2023-2026-3356)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3356 advisory. tarfile.tarfilter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction...

Linux Distros Unpatched Vulnerability : CVE-2026-108351

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - request-tracker5 - None CVE-2026-108351 Note that Nessus relies on the presence of the package as reported by the vendor. %NASLMINLEVEL 80900 C...

Linux Distros Unpatched Vulnerability : CVE-2026-108272

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - request-tracker5 - None CVE-2026-108272 Note that Nessus relies on the presence of the package as reported by the vendor. %NASLMINLEVEL 80900 C...

Linux Distros Unpatched Vulnerability : CVE-2026-76025

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML...

Linux Distros Unpatched Vulnerability : CVE-2026-119052

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - llama.cpp b2877 before b11935 contains an uncaught exception vulnerability in the ggml-rpc server that allows unauthenticated remote attackers to crash the...

RockyLinux 8 : kernel (RLSA-2026:92209)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:92209 advisory. kernel: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling CVE-2026-72288 kernel: KVM: arm64: vgic: Check the interrupt i...

Rocky Linux 9 [CIQ] Security Update: python3-urllib3 Multiple Vulnerabilities (crlsa-2026_90494)

The Rocky Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ crlsa-202690494 advisory. urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser CVE-2026-97689 urllib3: urllib3: Traffic interception via HTTPS proxy...

Linux Distros Unpatched Vulnerability : CVE-2026-108350

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - request-tracker5 - None Ubuntu Linux - Unknown description CVE-2026-108350 Note that Nessus relies on the presence of the package as reported by...

Linux Distros Unpatched Vulnerability : CVE-2026-108278

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - request-tracker5 - None Ubuntu Linux - Unknown description CVE-2026-108278 Note that Nessus relies on the presence of the package as reported by...

RockyLinux 10 : libX11 (RLSA-2026:91366)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:91366 advisory. libX11: libX11: Heap-based buffer overflow via malicious X server CVE-2026-88806 Tenable has extracted the preceding description block directly from the...

Linux Distros Unpatched Vulnerability : CVE-2026-115456

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in gcc. An attacker could cause a Denial of Service DoS by passing a string that is not null-terminated to the std::fromchars function in the...

RHEL 8 : python-pillow (RHSA-2026:92639)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:92639 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level...

Linux Distros Unpatched Vulnerability : CVE-2026-119137

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a stack overflow vulnerability that allows guests to crash the host through recursive type drops...

RHEL 9 : curl (RHSA-2026:92907)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:92907 advisory. The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP,...

CentOS Linux 6 [TuxCare] Security Update: bind / bind-chroot / bind-devel / bind-libs / bind-sdb / bind-utils Multiple Vulnerabilities (CENTOS6:CLSA-2026:1793085399)

The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1793085399 advisory. - In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit...

Linux Distros Unpatched Vulnerability : CVE-2026-119281

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the connector...

RockyLinux 10 : ansible-collection-redhat-leapp (RLSA-2026:91491)

The remote RockyLinux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RLSA-2026:91491 advisory. ansible-collection-redhat-leapp: ansible-collection-redhat-leapp: Information disclosure of PostgreSQL data via insecure backup permissions...

RHEL 9 : libXrender (RHSA-2026:91057)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:91057 advisory. X.Org X11 libXrender runtime library Security Fixes: libXrender: libXrender: Code injection via heap overflow in RenderQueryPictFormats CVE-2026-888...

RHEL 7 : sudo (RHSA-2026:92326)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:92326 advisory. The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged...

Linux Distros Unpatched Vulnerability : CVE-2026-119262

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper input validation in V8 in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a...

RHEL 7 : ipa (RHSA-2026:93071)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:93071 advisory. Red Hat Identity Management IdM is a centralized authentication, identity management, and authorization solution for both traditional and...

Linux Distros Unpatched Vulnerability : CVE-2026-119123

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick before 7.1.2-34 contains a stack overflow vulnerability in the TIFF decoder that occurs when the DNG decoder is disabled. Attackers can supply a...

Oracle Linux 9 : aspell (ELSA-2026-92458)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-92458 advisory. 12:0.60.8-9 - Backport fix for CVE-2026-103658 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note tha...

Rocky Linux 9 [CIQ] Security Update: xdg-dbus-proxy / xdg-dbus-proxy-debuginfo / etc (crlsa-2026_90522)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202690522 advisory. xdg-dbus-proxy: xdg-dbus-proxy: message filtering bypass via reply serial allows sandbox escape CVE-2026-94422 Tenable has extracted the preceding description bloc...

Oracle Linux 7 : java-1.8.0-openjdk (ELSA-2026-55774)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-55774 advisory. 1.8.0.504.b01-1.0.1 - update to open-jdk 8u504-b01 GA Orabug: 39966086 - Security update for CVE-2026-60589 CVE-2026-61308 and CVE-2026-70907 Tenable...

Rocky Linux 9.6 [TuxCare] Security Update: bluez / bluez-cups / bluez-hid2hci / bluez-libs / bluez-libs-devel / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1793354956)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793354956 advisory. - BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers...

Linux Distros Unpatched Vulnerability : CVE-2026-119264

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in Dawn in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a craft...

AlmaLinux 9.6 [TuxCare] Security Update: python3.11 / python3.11-debug / python3.11-devel / python3.11-idle / etc (ALMALINUX9.6:CLSA-2026:1793357369)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793357369 advisory. - Python has added a denylist for known compromised certificates to the ssl module to ensure user safety even without certificate revocation...

RHEL 8 : pcre2 (RHSA-2026:92899)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:92899 advisory. The pcre2 package contains a new generation of the Perl Compatible Regular Expression libraries for implementing regular expression pattern...

Rocky Linux 8 [CIQ] Security Update: java-17-openjdk / java-17-openjdk-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_88352)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202688352 advisory. JDK: Enhance PKCS5 padding CVE-2026-83374 JDK: Enhance TLS certificate handling CVE-2026-83376 JDK: Enhance LDAP logins CVE-2026-83380 JDK: Enhance SASL...

RockyLinux 10 : dogtag-pki (RLSA-2026:92408)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:92408 advisory. resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode Decompression-Bomb DoS CVE-2026-89059 resteasy-core: RESTEasy: CorsFilter Reflects...