Rocky Linux 8 [CIQ] Security Update: nodejs / nodejs-debuginfo / nodejs-debugsource / nodejs-devel / etc Multiple Vulnerabilities (crlsa-2026_92376)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202692376 advisory. ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing CVE-2026-101911 brace-expansion: brace-expansion: Denial of Service via...

Rocky Linux 9 [CIQ] Security Update: brotli / brotli-debuginfo / brotli-debugsource / brotli-devel / etc (crlsa-2026_90495)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202690495 advisory. brotli: Out-of-Bounds Write in Google Brotli Decoder CVE-2026-111497 Tenable has extracted the preceding description block directly from the CIQ security advisory...

Fedora 43 : brotli / perl-Alien-Brotli (2026-4aade61415)

The remote Fedora 43 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-4aade61415 advisory. Brotli 1.2.1 update which is security fix for CVE-2026-111497 Tenable has extracted the preceding description block directly from the Fedora security advisor...

Microsoft PowerShell 7.4.x < 7.4.22 / 7.5.x < 7.5.13 / 7.6.x < 7.6.9 RCE (macOS)

The version of Microsoft PowerShell installed on the remote macOS host is 7.4.x prior to 7.4.22, 7.5.x prior to 7.5.13, or 7.6.x prior to 7.6.9. It is, therefore, affected by a remote code execution vulnerability. An out-of-bounds write in the Brotli decoder used by PowerShell 7 allows an...

Oracle Linux 8 : .NET / 8.0 (ELSA-2026-92420)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-92420 advisory. 8.0.133-1.0.1 - Add support for Oracle Linux 8.0.133-1 - Update to .NET SDK 8.0.133 and Runtime 8.0.33 - Resolves: -RHEL-291714 Tenable has extracted...

RockyLinux 8 : .NET 8.0 (RLSA-2026:92420)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:92420 advisory. brotli: Out-of-Bounds Write in Google Brotli Decoder CVE-2026-111497 dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege...

SUSE SLES12: MozillaFirefox / MozillaFirefox-devel / etc (SUSE-SU-2026:4928-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4928-1 advisory. Update to Firefox Extended Support Release 153.6.0 ESR MFSA 2026-112, MFSA 2026-120, bsc1286385: - CVE-2026-100801: Privilege...

RHEL 8 : httpd:2.4 (RHSA-2026:92616)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:92616 advisory. The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: modauthdigest:...

CentOS Linux 8.4 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1793364521)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1793364521 advisory. - An out-of-bounds access flaw was found in the Linux kernel's implementation of the eBPF code verifier in the way a user running th...

CentOS Linux 8 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1793362651)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1793362651 advisory. - In the Linux kernel, the following vulnerability has been resolved: gfs2: fix use-after-free in gfs2qddealloc gfs2qddealloc,...

SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:4934-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4934-1 advisory. The SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues: The following security issues were fixed: -...

AlmaLinux 9.2 [TuxCare] Security Update: bpftool / kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1793333110)

"The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1793333110 advisory. - In the Linux kernel, the following vulnerability has been resolved: dma-debug: don't call dmaentryalloccheckleak under...

RHEL 9 : kernel-rt (RHSA-2026:93047)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:93047 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism...

Linux Distros Unpatched Vulnerability : CVE-2026-119143

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows guest code to trigger a host panic through...

Linux Distros Unpatched Vulnerability : CVE-2026-119195

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed string and indefinite-length ANY decoding repeatedly concatenates each fragment onto a...

Docker Desktop < 4.97.0 Multiple Vulnerabilities

The version of Docker Desktop installed on the remote host is prior to 4.97.0. It is, therefore, affected by multiple vulnerabilities: - A kernel vulnerability where a container could exploit bad IPv4 checksum metadata via TUN or AFPACKET to corrupt the VM's network stack. If a packet with bad...

RockyLinux 8 : .NET 10.0 (RLSA-2026:92431)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:92431 advisory. dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnerability CVE-2026-114148 Bug Fixes and Enhancements: Update .NET 10.0 to S...

Amazon Linux 2023 : nerdctl (ALAS2023-2026-3344)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3344 advisory. Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority CA, the Go's crypto/x509 package is updated to not trust certificates issued by th...

Amazon Linux 2023 : amazon-ssm-agent (ALAS2023-2026-3358)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3358 advisory. Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority CA, the Go's crypto/x509 package is updated to not trust certificates issued by th...

Amazon Linux 2023 : containerd, containerd-stress (ALAS2023-2026-3339)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3339 advisory. Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority CA, the Go's crypto/x509 package is updated to not trust certificates issued by th...

Amazon Linux 2023 : rclone (ALAS2023-2026-3348)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3348 advisory. Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority CA, the Go's crypto/x509 package is updated to not trust certificates issued by th...

Amazon Linux 2 : soci-snapshotter (ALASDOCKER-2026-157)

The version of soci-snapshotter installed on the remote host is prior to 0.16.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2026-157 advisory. Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificat...

Amazon Linux 2 : rclone (ALAS-2026-4055)

The version of rclone installed on the remote host is prior to 1.55.1-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-4055 advisory. Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority CA, the Go's...

Amazon Linux 2 : oci-add-hooks (ALASDOCKER-2026-160)

The version of oci-add-hooks installed on the remote host is prior to 0-0.13.20200504git325a340. It is, therefore, affected by a vulnerability as referenced in the ALAS2DOCKER-2026-160 advisory. Due to security concerns regarding a small set of intermediate certificates issued by a specific...

Amazon Linux 2 : nerdctl (ALAS-2026-4053)

The version of nerdctl installed on the remote host is prior to 2.3.5-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-4053 advisory. Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority CA, the Go's...

AlmaLinux 10 : ignition (ALSA-2026:91720)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:91720 advisory. crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates CVE-2026-111943 Tenable has extracted the preceding descripti...

RHEL 8 / 9 : Satellite 6.16 EUS (RHSA-2026:92858)

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:92858 advisory. This advisory provides security fixes for affected packages used by Red Hat Satellite. The updates address the vulnerabilities describe...

RockyLinux 9 : ignition (RLSA-2026:91719)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:91719 advisory. crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates CVE-2026-111943 Tenable has extracted the preceding descripti...

RHEL 9 : osbuild-composer (RHSA-2026:91587)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:91587 advisory. A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building...

RockyLinux 10 : pipewire (RLSA-2026:61241)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:61241 advisory. pipewire: RAOP RTSP NULL Deref CVE-2026-14324 Tenable has extracted the preceding description block directly from the RockyLinux security advisory. Note that...

AlmaLinux 9.2 [TuxCare] Security Update: python3.11 / python3.11-debug / python3.11-devel / python3.11-idle / etc (ALMALINUX9.2:CLSA-2026:1793379344)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1793379344 advisory. - Python has added a denylist for known compromised certificates to the ssl module to ensure user safety even without certificate revocation...

Linux Distros Unpatched Vulnerability : CVE-2026-119272

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Out of bounds read in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page...

SUSE SLES16 Security Update : kernel (SUSE-SU-2026:24437-1)

The remote SUSE Linux SLES16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:24437-1 advisory. The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2026-31731:...

RockyLinux 8 : python3.12-urllib3 (RLSA-2026:92474)

The remote RockyLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RLSA-2026:92474 advisory. urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser CVE-2026-97689 urllib3: urllib3: Traffic interception via HTTPS prox...

Linux Distros Unpatched Vulnerability : CVE-2026-119207

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive memory when strict mode loads a crafted invalid PDF...

Linux Distros Unpatched Vulnerability : CVE-2026-76027

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Information loss in CacheStorage in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium...

Linux Distros Unpatched Vulnerability : CVE-2026-76028

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker leveraging social engineering to execute arbitrary code...

Rocky Linux 10.2 [CIQ] Security Update: xdg-dbus-proxy / xdg-dbus-proxy-debuginfo / etc (crlsa-2026_90523)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202690523 advisory. xdg-dbus-proxy: xdg-dbus-proxy: message filtering bypass via reply serial allows sandbox escape CVE-2026-94422 Tenable has extracted the preceding description...

Linux Distros Unpatched Vulnerability : CVE-2026-119188

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used...

Linux Distros Unpatched Vulnerability : CVE-2026-119206

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can take excessive time to retrieve page labels from a crafted PDF containing a...

Linux Distros Unpatched Vulnerability : CVE-2026-108344

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - request-tracker5 - None CVE-2026-108344 Note that Nessus relies on the presence of the package as reported by the vendor. %NASLMINLEVEL 80900 C...

RHEL 8 : rsyslog (RHSA-2026:91582)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:91582 advisory. The rsyslog packages provide an enhanced, multi-threaded syslog daemon. It supports MySQL, syslog/TCP, RFC 3195, permitted sender lists,...

Linux Distros Unpatched Vulnerability : CVE-2026-119528

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in GIMP. The PSD plug-in's image resource header loader uses an incorrect destination size when copying a converted resource name into a fixed...

RockyLinux 8 : mod_auth_openidc:2.3 (RLSA-2026:92157)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:92157 advisory. cjose: OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption CVE-2026-53939 Tenable has extracted the preceding description block...

RockyLinux 8 : python-pillow (RLSA-2026:92639)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:92639 advisory. pillow: Pillow: Denial of Service via unbounded recursion in PDF parser CVE-2026-112391 pillow: pillow: Denial of service via double free during image...

Linux Distros Unpatched Vulnerability : CVE-2026-119268

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Integer overflow in Editing in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a...

Fedora 44 : mingw-python-certifi (2026-746612ff80)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-746612ff80 advisory. Update to certifi-2026.10.18. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not test...

Oracle Linux 8 : .NET / 9.0 (ELSA-2026-92427)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-92427 advisory. 9.0.123-1.0.1 - Add support for Oracle Linux 9.0.123-1 - Update to .NET SDK 9.0.123 and Runtime 9.0.22 - Resolves: RHEL-291723 Tenable has extracted the...

RHEL 9 : librsvg2 (RHSA-2026:92213)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:92213 advisory. The librsvg2 packages provide a Scalable Vector Graphics SVG library based on the libart library. Security Fixes: librsvg: Use-after-free when XML...

Rocky Linux 10.2 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crlsa-2026_91565)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202691565 advisory. kernel: tcp: restrict SOATTACHFILTER to priv users CVE-2026-53236 kernel: fuse: re-lock request before replacing page cache folio CVE-2026-53388 kernel...