RHEL 10 : tomcat (RHSA-2026:92863)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:92863 advisory. Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages JSP technologies. Security Fixes: tomcat: Apache Tomcat:...

RHEL 9 : tomcat (RHSA-2026:92871)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:92871 advisory. Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages JSP technologies. Security Fixes: tomcat: Apache Tomcat:...

Amazon Linux 2023 : runfinch-finch (ALAS2023-2026-3343)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3343 advisory. Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority CA, the Go's crypto/x509 package is updated to not trust certificates issued by th...

Amazon Linux 2 : amazon-ssm-agent (ALAS-2026-4063)

The version of amazon-ssm-agent installed on the remote host is prior to 3.3.5700.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-4063 advisory. Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authorit...

Amazon Linux 2 : amazon-ecr-credential-helper (ALASECS-2026-153)

The version of amazon-ecr-credential-helper installed on the remote host is prior to 0.12.0-6. It is, therefore, affected by a vulnerability as referenced in the ALAS2ECS-2026-153 advisory. Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificat...

Amazon Linux 2 : containerd (ALASNITRO-ENCLAVES-2026-130)

The version of containerd installed on the remote host is prior to 2.3.7-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2NITRO-ENCLAVES-2026-130 advisory. Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate...

Amazon Linux 2 : amazon-ecr-credential-helper (ALASNITRO-ENCLAVES-2026-131)

The version of amazon-ecr-credential-helper installed on the remote host is prior to 0.12.0-6. It is, therefore, affected by a vulnerability as referenced in the ALAS2NITRO-ENCLAVES-2026-131 advisory. Due to security concerns regarding a small set of intermediate certificates issued by a specific...

Amazon Linux 2 : oci-add-hooks (ALASNITRO-ENCLAVES-2026-132)

The version of oci-add-hooks installed on the remote host is prior to 0-0.13.20200504git325a340. It is, therefore, affected by a vulnerability as referenced in the ALAS2NITRO-ENCLAVES-2026-132 advisory. Due to security concerns regarding a small set of intermediate certificates issued by a specif...

Amazon Linux 2 : golang-github-cpuguy83-go-md2man (ALAS-2026-4056)

The version of golang-github-cpuguy83-go-md2man installed on the remote host is prior to 1.0.4-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-4056 advisory. Due to security concerns regarding a small set of intermediate certificates issued by a specific Certifica...

Amazon Linux 2 : golist (ALAS-2026-4064)

The version of golist installed on the remote host is prior to 0.10.1-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-4064 advisory. Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority CA, the Go'...

RHEL 9 : Satellite 6.18 (RHSA-2026:92860)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:92860 advisory. openvox-agent: curl: Cookie injection via malicious HTTP server using super cookies CVE-2026-8924. openvox-agent: heap buffer overflow in C...

Linux Distros Unpatched Vulnerability : CVE-2026-119138

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows pending calls to trigger an assertion failure afte...

Amazon Linux 2 : kernel (ALASKERNEL-5.10-2026-137)

The version of kernel installed on the remote host is prior to 5.10.271-272.1121. It is, therefore, affected by a vulnerability as referenced in the ALAS2KERNEL-5.10-2026-137 advisory. In the Linux kernel, the following vulnerability has been resolved: ipv4: free inetopt and ireqopt after an RCU...

CentOS Linux 7 [TuxCare] Security Update: dracut / dracut-caps / dracut-config-generic / dracut-config-rescue / etc (CENTOS7:CLSA-2026:1793090225)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1793090225 advisory. - A flaw was found in dracut. The die error-handling function writes its message into a shell script under the initramfs emergency-hook directory...

Rocky Linux 10.2 [CIQ] Security Update: ignition / ignition-debuginfo / ignition-debugsource / etc (crlsa-2026_91720)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202691720 advisory. crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates CVE-2026-111943 Tenable has extracted the preceding...

Rocky Linux 9 [CIQ] Security Update: podman / podman-debuginfo / podman-debugsource / podman-docker / etc Multiple Vulnerabilities (crlsa-2026_90362)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202690362 advisory. podman: Arbitrary file write when importing OCI archive CVE-2025-11395 net/http: golang: golang: Denial of Service via crafted HTTP Range headers...

Rocky Linux 9 [CIQ] Security Update: buildah / buildah-debuginfo / buildah-debugsource / buildah-tests / etc Multiple Vulnerabilities (crlsa-2026_90424)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202690424 advisory. podman: Arbitrary file write when importing OCI archive CVE-2025-11395 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted...

Amazon Linux 2023 : ecs-init (ALAS2023-2026-3359)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3359 advisory. Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority CA, the Go's crypto/x509 package is updated to not trust certificates issued by th...

Amazon Linux 2023 : compat-golang-github-cpuguy83-md2man-2-devel, golang-github-cpuguy83-md2man, golang-github-cpuguy83-md2man-devel (ALAS2023-2026-3362)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3362 advisory. Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority CA, the Go's crypto/x509 package is updated to not trust certificates issued by th...

Amazon Linux 2 : amazon-cloudwatch-agent (ALAS-2026-4049)

The version of amazon-cloudwatch-agent installed on the remote host is prior to 1.300073.2-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4049 advisory. Due to security concerns regarding a small set of intermediate certificates issued by a specific...

Amazon Linux 2023 : amazon-cloudwatch-agent (ALAS2023-2026-3350)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3350 advisory. Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority CA, the Go's crypto/x509 package is updated to not trust certificates...

Rocky Linux 10.2 [CIQ] Security Update: yggdrasil / yggdrasil-debuginfo / yggdrasil-debugsource / etc Multiple Vulnerabilities (crlsa-2026_91138)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202691138 advisory. net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart form parsing CVE-2026-94440 net/http:...

RHEL 9 : osbuild-composer (RHSA-2026:91958)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:91958 advisory. A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building...

Fedora 43 : trafficserver (2026-7a2def92e8)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-7a2def92e8 advisory. Changes with Apache Traffic Server 10.2.1 13553 - originserverauth: Improve log messages 13567 - Metrics: Revert added locking and annotations 13505 - Add...

RockyLinux 8 : httpd:2.4 (RLSA-2026:92616)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:92616 advisory. httpd: modauthdigest: timing attack allows a bypass of digest authentication CVE-2026-33006 httpd: httpd: HTTP response smuggling via crafted...

Linux Distros Unpatched Vulnerability : CVE-2026-108275

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - request-tracker5 - None CVE-2026-108275 Note that Nessus relies on the presence of the package as reported by the vendor. %NASLMINLEVEL 80900 C...

Linux Distros Unpatched Vulnerability : CVE-2026-119053

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - lwIP 2.0.0 through 2.2.1 built with the SNMP agent contains an out-of-bounds read vulnerability in snmppbufstreamwriteto that bounds copies by pbuf-len instead ...

Rocky Linux 9.6 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1793358242)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793358242 advisory. - Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990. This issue affects Apache...

RHEL 9 : kernel (RHSA-2026:91492)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:91492 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: netfilter: nfnetlinkqueue:...

Linux Distros Unpatched Vulnerability : CVE-2026-110133

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Ghostscript. When processing a specially crafted TrueType font or document embedding one, an accounting error during font rendering can bypa...

Linux Distros Unpatched Vulnerability : CVE-2026-119137

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a stack overflow vulnerability that allows guests to crash the host through recursive type drops...

Linux Distros Unpatched Vulnerability : CVE-2026-119123

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick before 7.1.2-34 contains a stack overflow vulnerability in the TIFF decoder that occurs when the DNG decoder is disabled. Attackers can supply a...

Linux Distros Unpatched Vulnerability : CVE-2026-119281

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the connector...

SUSE SLES16: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:24446-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:24446-1 advisory. The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues: The following security issues were fixed: -...

Linux Distros Unpatched Vulnerability : CVE-2026-118772

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - joi is a schema description language and data validator for JavaScript. From 17.1.1 until 17.13.9 and 18.3.1, the Joi.string.email multiple: true rule uses a...

Linux Distros Unpatched Vulnerability : CVE-2026-118773

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Glob matches files using patterns the shell uses. From 9.0.0 until 14.0.2, abort branches in src/walker.ts, including GlobUtil.walkCB, GlobUtil.walkCB2,...

Linux Distros Unpatched Vulnerability : CVE-2026-118244

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Highcharts JS is a JavaScript charting library based on SVG. From 12.0.0 until 12.6.1 and 13.1.0, Highcharts falls back to assigning raw markup to innerHTML whe...

Linux Distros Unpatched Vulnerability : CVE-2026-118764

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Starting in 7.0.0 and prior to 11.0.1, src/index.ts...

AlmaLinux 9.6 [TuxCare] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1793370479)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793370479 advisory. - In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Fix buffer overflow in debugfs If the user tries...

RHEL 8 : python-pillow (RHSA-2026:92639)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:92639 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level...

RHEL 9 : firefox (RHSA-2026:92012)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:92012 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fixes: firefox:...

Nessus Network Monitor < 6.6.0 Multiple Vulnerabilities (TNS-2026-32)

According to its self-reported version, the Nessus Network Monitor running on the remote host is prior to 6.6.0. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2026-32 advisory. - In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree ...

RHEL 9 : nodejs:24 (RHSA-2026:92378)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:92378 advisory. Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language...

RHEL 8 : nodejs:24 (RHSA-2026:92376)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:92376 advisory. Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language...

Oracle Linux 9 : nodejs:24 (ELSA-2026-92378)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-92378 advisory. - Fix out-of-bounds write in bundled Brotli decoder CVE-2026-111497 Tenable has extracted the preceding description block directly from the Oracle Lin...

CentOS Linux 6 [TuxCare] Security Update: patch (CENTOS6:CLSA-2026:1793083677)

The CentOS Linux 6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1793083677 advisory. - A double free exists in the anotherhunk function in pch.c in GNU patch through 2.7.6. CVE-2018-6952 Note that Nessus has not tested for this...

RHEL 8 : libxml2 (RHSA-2026:92589)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:92589 advisory. The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fixes: libxml2: mingw-libxml2:...

Linux Distros Unpatched Vulnerability : CVE-2026-79656

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A user with read access to Grafana's server logs, or to a log store they are shipped to, can recover the OAuth and OIDC access, refresh and ID tokens of users w...

Rocky Linux 8.6 [CIQ] Security Update: python3-unbound / unbound / unbound-devel / unbound-libs (ciqsa-2026_1732)

The Rocky Linux 8.6 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261732 advisory. This advisory aggregates security fixes for the unbound SRPM in CIQ LTS 8.6. It addresses 1 CVE: CVE-2026-81642. Tenable has extracted the preceding description...

Amazon Linux 2023 : java-27-amazon-corretto, java-27-amazon-corretto-devel, java-27-amazon-corretto-headless (ALAS2023-2026-3368)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3368 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java SE:...