AlmaLinux 9.2 [TuxCare] Security Update: ansible-core / ansible-test (ALMALINUX9.2:CLSA-2026:1793373763)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1793373763 advisory. - A flaw was found in ansible-core. The extractcollectionfromgit function in ansible-core's concreteartifactmanager.py constructs git clone...

RockyLinux 9 : libXi (RLSA-2026:91056)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:91056 advisory. libXi: libXi: Denial of Service via out-of-bounds read in XI2 class parser CVE-2026-93543 Tenable has extracted the preceding description block directly from the...

Rocky Linux 8 [CIQ] Security Update: libreswan / libreswan-debuginfo / libreswan-debugsource Multiple Vulnerabilities (crlsa-2026_90492)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202690492 advisory. libreswan: IKEv2 Use-After-Free bug when using IKE-over-TCP CVE-2026-94453 libreswan: IKEv2 pre-authentication Null Pointer deref in EAP code CVE-2026-772...

RHEL 10 : xdg-dbus-proxy (RHSA-2026:91626)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:91626 advisory. xdg-dbus-proxy is a filtering proxy for D-Bus connections. It was originally part of the flatpak project, but it has been broken out as a standalon...

Fedora 43 : mingw-python-certifi (2026-f82897416f)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-f82897416f advisory. Update to certifi-2026.10.18. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not test...

Amazon Linux 2023 : python3-dns, python3-dns+dnssec, python3-dns+idna (ALAS2023-2026-3357)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3357 advisory. dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.name.fromwireparser follows attacker- controlled DNS compression pointer chains without a hop limit. A malicious DNS wire-format message can...

Rocky Linux 10.2 [CIQ] Security Update: libXi / libXi-debuginfo / libXi-debugsource / libXi-devel (crlsa-2026_91004)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202691004 advisory. libXi: libXi: Denial of Service via out-of-bounds read in XI2 class parser CVE-2026-93543 Tenable has extracted the preceding description block directly from th...

RockyLinux 8 : expat (RLSA-2026:92323)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:92323 advisory. expat: expat: Denial of Service via integer overflow in expatrealloc CVE-2026-102633 expat: expat: Information disclosure via heap buffer over-read in...

CentOS Linux 8.5 [TuxCare] Security Update: platform-python / platform-python-debug / platform-python-devel / etc (CENTOS8.5:CLSA-2026:1793354420)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2026:1793354420 advisory. - Python has added a denylist for known compromised certificates to the ssl module to ensure user safety even without certificate revocation...

Linux Distros Unpatched Vulnerability : CVE-2026-108346

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - request-tracker5 - None CVE-2026-108346 Note that Nessus relies on the presence of the package as reported by the vendor. %NASLMINLEVEL 80900 C...

AlmaLinux 10 : dogtag-pki (ALSA-2026:92408)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:92408 advisory. resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode Decompression-Bomb DoS CVE-2026-89059 resteasy-core: RESTEasy: CorsFilter Reflects...

CentOS Linux 7 [TuxCare] Security Update: dovecot / dovecot-devel / dovecot-mysql / dovecot-pgsql / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1793089374)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1793089374 advisory. - An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating. If...

RHEL 9 : librsvg2 (RHSA-2026:92212)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:92212 advisory. The librsvg2 packages provide a Scalable Vector Graphics SVG library based on the libart library. Security Fixes: librsvg: Use-after-free when XML...

AlmaLinux 9 : cjose (ALSA-2026:92145)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:92145 advisory. cjose: OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption CVE-2026-53939 Tenable has extracted the preceding description block...

Amazon Linux 2 : emacs (ALAS-2026-4046)

The version of emacs installed on the remote host is prior to 27.2-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-4046 advisory. GNU Emacs before 31.2 and TRAMP through 2.8.2 allows OS command injection via a filename because tramp- user-regexp has an incomplete...

RockyLinux 8 : curl (RLSA-2026:92368)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:92368 advisory. libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse CVE-2026-8932 curl: libcurl: Unauthorized connection reuse due to a...

RockyLinux 8 : kernel-rt (RLSA-2026:92208)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:92208 advisory. kernel: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling CVE-2026-72288 kernel: KVM: arm64: vgic: Check the interrupt i...

RHEL 8 : aspell (RHSA-2026:92615)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:92615 advisory. GNU Aspell is a spell checker designed to eventually replace Ispell. It can either be used as a library or as an independent spell checker. Security...

CentOS Linux 8.5 [TuxCare] Security Update: python2 / python2-debug / python2-devel / python2-libs / etc (CENTOS8.5:CLSA-2026:1793361081)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2026:1793361081 advisory. - Python has added a denylist for known compromised certificates to the ssl module to ensure user safety even without certificate revocation...

Linux Distros Unpatched Vulnerability : CVE-2026-108277

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - request-tracker5 - None CVE-2026-108277 Note that Nessus relies on the presence of the package as reported by the vendor. %NASLMINLEVEL 80900 C...

RHEL 9 : xterm (RHSA-2026:92418)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:92418 advisory. The xterm program is a terminal emulator for the X Window System. It provides DEC VT102 and Tektronix 4014 compatible terminals for programs that...

Amazon Linux 2023 : java-25-amazon-corretto, java-25-amazon-corretto-devel, java-25-amazon-corretto-headless (ALAS2023-2026-3369)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3369 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java SE:...

RHEL 9 : libX11 (RHSA-2026:91365)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:91365 advisory. The libX11 packages contain the core X11 protocol client library. Security Fixes: libX11: libX11: Heap-based buffer overflow via malicious X server...

Linux Distros Unpatched Vulnerability : CVE-2026-76026

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in Autofill in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML...

Rocky Linux 8 [CIQ] Security Update: gcc-toolset-15-gcc / gcc-toolset-15-gcc-c++ / etc (crlsa-2026_90915)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202690915 advisory. gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: Denial of Service via use-after-free in binary heap eraseif CVE-2026-102010 Tenable has extracted the preceding...

Amazon Linux 2 : perl-Text-CSV_XS (ALAS-2026-4048)

The version of perl-Text-CSVXS installed on the remote host is prior to 1.00-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4048 advisory. Text::CSVXS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline. getlin...

Linux Distros Unpatched Vulnerability : CVE-2026-119567

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - vsftpd through 3.0.5 contains an access control bypass vulnerability that allows authenticated FTP users to execute denied commands by issuing RFC 775 X-prefixe...

Oracle Linux 8 : python-pillow (ELSA-2026-92639)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-92639 advisory. - CVE-2026-112892 python-pillow: pillow: Denial of Service via unbounded memory expansion in MSP image decoder Resolves: RHEL-290437 - CVE-2026-96640...

Linux Distros Unpatched Vulnerability : CVE-2026-76031

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Input in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page...

RHEL 8 : thunderbird (RHSA-2026:91634)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:91634 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Sandbox escape due to incorrect bounda...

Linux Distros Unpatched Vulnerability : CVE-2026-119207

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive memory when strict mode loads a crafted invalid PDF...

Linux Distros Unpatched Vulnerability : CVE-2026-119133

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Wasmtime 47.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a memory misalignment flaw in VMContext layout that causes undefined behavior when modules conta...

RHEL 9 : kpatch-patch-5_14_0-284_134_1, kpatch-patch-5_14_0-284_148_1, kpatch-patch-5_14_0-284_158_1, kpatch-patch-5_14_0-284_172_1, and kpatch-patch-5_14_0-284_188_1 (RHSA-2026:92629)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:92629 advisory. This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the code of a running kernel. This patc...

RHEL 10 : dnsmasq (RHSA-2026:92677)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:92677 advisory. The dnsmasq packages contain Dnsmasq, a lightweight DNS Domain Name Server forwarder and DHCP Dynamic Host Configuration Protocol server...

RHEL 10 : java-21-openjdk security update for RHEL 10 (Important) (RHSA-2026:90504)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:90504 advisory. The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fixes:...

RockyLinux 9 : libXtst (RLSA-2026:91223)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:91223 advisory. libXtst: libXtst: Denial of Service via out-of-bounds read in RECORD reply parser CVE-2026-94286 Tenable has extracted the preceding description block directly...

SUSE SLES16 Security Update : kernel (Live Patch 9 for SUSE Linux Enterprise 16) (SUSE-SU-2026:24449-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:24449-1 advisory. This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.30.1 fixes various security issues: The following security issues...

RHEL 8 : libsoup (RHSA-2026:92347)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:92347 advisory. The libsoup packages provide an HTTP client and server library for GNOME. Security Fixes: libsoup: libsoup: Heap buffer overflow from...

RHEL 8 : perl-XML-LibXML (RHSA-2026:92800)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:92800 advisory. This module implements a Perl interface to the GNOME libxml2 library which provides interfaces for parsing and manipulating XML files. This module...

CentOS Linux 8 [TuxCare] Security Update: platform-python / platform-python-debug / platform-python-devel / etc (CENTOS-STREAM8:CLSA-2026:1793354551)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1793354551 advisory. - Python has added a denylist for known compromised certificates to the ssl module to ensure user safety even without certificate...

Linux Distros Unpatched Vulnerability : CVE-2026-119132

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Wasmtime from 49.0.0 before 49.0.3 contains a denial-of-service vulnerability that allows a WebAssembly guest to trigger a host panic by transcoding overlapping...

SUSE SLES16 Security Update : kernel (Live Patch 5 for SUSE Linux Enterprise 16) (SUSE-SU-2026:24457-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:24457-1 advisory. This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.26.1 fixes various security issues: The following security issues...

Linux Distros Unpatched Vulnerability : CVE-2026-108282

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - request-tracker5 - None CVE-2026-108282 Note that Nessus relies on the presence of the package as reported by the vendor. %NASLMINLEVEL 80900 C...

Linux Distros Unpatched Vulnerability : CVE-2026-119266

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted...

RHEL 9 : bind9.18 (RHSA-2026:93072)

"The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:93072 advisory. BIND Berkeley Internet Name Domain is an implementation of the DNS Domain Name System protocols. BIND includes a DNS server named, which...

RHEL 8 : thunderbird (RHSA-2026:91633)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:91633 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Sandbox escape due to incorrect bounda...

Rocky Linux 10.2 [CIQ] Security Update: thunderbird / thunderbird-debuginfo / thunderbird-debugsource (crlsa-2026_90895)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202690895 advisory. libexpat: denial of service via crafted XML input CVE-2026-45186 Bug Fixes and Enhancements: Thunderbird ESR 153 rebase rhel-10.2.z JIRA:Rocky Linux-175207...

Linux Distros Unpatched Vulnerability : CVE-2026-50185

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RustCrypto CMOV provides conditional move CPU intrinsics which are guaranteed on major platforms to execute in constant-time and not be rewritten as branches by...

SUSE SLES15 Security Update : perl-Cpanel-JSON-XS (SUSE-SU-2026:4926-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4926-1 advisory. - CVE-2025-40929: integer overflow bsc1249331. - CVE-2026-9334: type confusion via duplicate object keys when dupkeysasarrayref is enabled...

Linux Distros Unpatched Vulnerability : CVE-2026-119267

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in DOM in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafte...