Amazon Linux 2 : gstreamer1-plugins-bad-free, --advisory ALAS2-2026-3832 (ALAS-2026-3832)

The version of gstreamer1-plugins-bad-free installed on the remote host is prior to 1.18.4-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3832 advisory. A heap buffer overflow vulnerability was found in GStreamer's librfb RFB/VNC client. The rectangle bounds chec...

Amazon Linux 2023 : python3.14, python3.14-devel, python3.14-freethreading (ALAS2023-2026-1999)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1999 advisory. When using the configparser module to write configuration filescontaining multi-line text values with carriage return characters \r theresulting file could be injected with unexpected keys and...

Amazon Linux 2023 : python3.12, python3.12-devel, python3.12-idle (ALAS2023-2026-1996)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1996 advisory. The incremental HTML parser html.parser.HTMLParser allows for CPUdenial-of-service through repeated unterminated markup declarations whenprocessing uncontrolled data. CVE-2026-15308 In the...

RHEL 8 : python3 (RHSA-2026:50065)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:50065 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic da...

SUSE SLED15 / SLES15 Security Update : python3-dulwich (SUSE-SU-2026:3459-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3459-1 advisory. This update for python3-dulwich fixes the following issue - CVE-2026-38974: Dulwich through 1.1.0 was found to be missi...

MiracleLinux 8 : vim-8.0.1763-31.el8_10.ML.1 (AXSA:2026-1446:20)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1446:20 advisory. vim: Vim: Denial of Service via stack out-of-bounds write in spellsoundfoldsofo CVE-2026-57455 vim: Vim: Arbitrary code execution via malicious...

Amazon Linux 2023 : cifs-utils, cifs-utils-devel, cifs-utils-info (ALAS2023-2026-2030)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2030 advisory. A flaw was found in the cifs-utils package where the cifs.upcall helper fails to securely drop its root privileges before looking up user information inside a user-controlled environment. A local, low...

Schneider Electric EcoStruxure Panel Server Initialization of a Resource with an Insecure Default (CVE-2026-6866)

CWE-1188 Initialization of a Resource with an Insecure Default vulnerability exists that could cause unauthorized disclosure of sensitive information when credentials revert to initial settings in rare circumstances, enabling unauthorized authentication using known credentials. This plugin only...

SUSE SLES15: java-11-openjdk / java-11-openjdk-demo / java-11-openjdk-devel / etc (SUSE-SU-2026:3453-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3453-1 advisory. Upgrade to upstream tag jdk-11.0.32+9 July 2026 CPU. Security issues fixed: - CVE-2026-41254: lcms: information disclosure and deni...

Amazon Linux 2 : python-tornado, --advisory ALAS2-2026-3847 (ALAS-2026-3847)

The version of python-tornado installed on the remote host is prior to 4.2.1-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3847 advisory. Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient...

SUSE SLED15 / SLES15 Security Update : perl-HTTP-Date (SUSE-SU-2026:3454-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3454-1 advisory. This update for perl-HTTP-Date fixes the following issue - CVE-2026-14741: CPU exhaustion due to polynomial regex...

Amazon Linux 2023 : python3.13-tornado (ALAS2023-2026-2015)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2015 advisory. Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed only the Host header, leaving...

RHEL 8 : systemd (RHSA-2026:50077)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:50077 advisory. The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and LSB init scripts. It provides aggressive...

Amazon Linux 2 : python3-tornado, --advisory ALAS2-2026-3846 (ALAS-2026-3846)

The version of python3-tornado installed on the remote host is prior to 5.0.2-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3846 advisory. Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient...

Amazon Linux 2023 : bind, bind-chroot, bind-devel (ALAS2023-2026-2040)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2040 advisory. BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses.This issue affects BIND 9 versions 9.18.0 through 9.18.50,...

Linux Distros Unpatched Vulnerability : CVE-2026-18785

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was determined in o6 open62541 ca356b088ada7dee824d1b4acd07c1ff07ce242b. Impacted is the function UAClientgetRemoteDataTypes of the file...

Fedora 44 : coreutils (2026-36041358b1)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-36041358b1 advisory. fix CVE-2026-56391 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2026-128 (ALASKERNEL-5.10-2026-128)

The version of kernel installed on the remote host is prior to 5.10.260-259.1061. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2026-128 advisory. In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU in ip6output...

Amazon Linux 2 : java-1.8.0-openjdk, --advisory ALAS2-2026-3848 (ALAS-2026-3848)

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.502.b07-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3848 advisory. Vulnerability in Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java S...

Linux Distros Unpatched Vulnerability : CVE-2026-18103

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in dhcp-server. A remote attacker with network access to the OMAPI Open Management Application Programming Interface port, especially if not...

Amazon Linux 2023 : openvpn, openvpn-devel (ALAS2023-2026-2038)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2038 advisory. OpenVPN memory-leak in tls-crypt-v2 client key handling that could lead to out-of-memory situations and subsequent server crashes CVE-2026-12932 When dynamic tls-crypt is active, it is possibl...

Amazon Linux 2023 : cargo-c (ALAS2023-2026-2024)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2024 advisory. gix-submodule before 0.29.0 gitoxide before 0.5.21, gix before 0.84.0 incorrectly validates the update field in .gitmodules, allowing attackers to bypass the CommandForbiddenInModulesConfiguration guar...

SUSE SLED15 / SLES15 Security Update : vim (SUSE-SU-2026:3458-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3458-1 advisory. This update for vim fixes the following issues: Security issues fixed: - CVE-2026-59856: Arbitrary Code...

RockyLinux 9 : perl-DBI (RLSA-2026:49612)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:49612 advisory. DBI: DBI: Arbitrary code execution via caller-influenced Profile attribute CVE-2026-14380 DBI: DBI: Heap overflow when preparsing SQL statements with...

Linux Distros Unpatched Vulnerability : CVE-2026-18739

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in popt, a command-line option parsing library. An off-by-one error in the poptStuffArgs function, when repeatedly called by a host application...

RockyLinux 10 : gstreamer1-plugins-good (RLSA-2026:49508)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:49508 advisory. gstreamer: GStreamer: Arbitrary code execution via stack-based buffer overflow in qtdemux CVE-2026-5056 Tenable has extracted the preceding description block...

RHEL 9 : sssd (RHSA-2026:49839)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:49839 advisory. The System Security Services Daemon SSSD service provides a set of daemons to manage access to remote directories and authentication...

Amazon Linux 2023 : glib2, glib2-devel, glib2-static (ALAS2023-2026-2028)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2028 advisory. A flaw was found in xdgmime. A heap-based buffer overflow can be triggered in xdgmimemagicparsemagicline in the xdgmimemagic.c file on little-endian systems when an attacker- controlled MIME magic file...

RHEL 9 : ldns (RHSA-2026:50108)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:50108 advisory. The ldns packages contain a library with the aim to simplify DNS programming in C. All low-level DNS/DNSSEC operations are supported. We also define...

Amazon Linux 2023 : perl-YAML-Syck, perl-YAML-Syck-tests (ALAS2023-2026-2007)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2007 advisory. YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack. In the bundled libsyck, when an anchor name is...

RHEL 10 : libgcrypt (RHSA-2026:50144)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:50144 advisory. The libgcrypt library provides general-purpose implementations of various cryptographic algorithms. Security Fixes: Libgcrypt: Libgcrypt: Denial of...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2026-2032)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2032 advisory. In the Linux kernel, the following vulnerability has been resolved: sched/psi: fix race between file release and pressure write CVE-2026-52991 Tenable has extracted the preceding description block...

Amazon Linux 2023 : gstreamer1-plugin-openh264, gstreamer1-plugins-bad-free, gstreamer1-plugins-bad-free-devel (ALAS2023-2026-1994)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1994 advisory. A flaw was found in GStreamer's gst-plugins-bad package. When processing a specially crafted H.264 video file containing malformed MVC or SVC extension slice NAL units, a 1-byte heap...

AlmaLinux 10 : gstreamer1-plugins-good (ALSA-2026:49508)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:49508 advisory. gstreamer: GStreamer: Arbitrary code execution via stack-based buffer overflow in qtdemux CVE-2026-5056 Tenable has extracted the preceding description block...

Fedora 43 : borgbackup (2026-5a13ef79cc)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-5a13ef79cc advisory. new bugfix release, contains a fix for CVE-2026-62268 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note...

Amazon Linux 2 : gstreamer1-plugins-bad-free, --advisory ALAS2-2026-3833 (ALAS-2026-3833)

The version of gstreamer1-plugins-bad-free installed on the remote host is prior to 1.18.4-5. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3833 advisory. A flaw was found in GStreamer's gst-plugins-bad package. When processing a specially crafted H.264...

Metabase 0.58.x < 0.58.15 / 0.59.x < 0.59.12 / 0.60.x < 0.60.6.3 / 0.61.x < 0.61.1.4 / 1.58.x < 1.58.15 / 1.59.x < 1.59.12 / 1.60.x < 1.60.6.3 / 1.61.x < 1.61.1.4 RCE (CVE-2026-59827)

The version of Metabase installed on the remote host is 0.58.x prior to 0.58.15, 0.59.x prior to 0.59.12, 0.60.x prior to 0.60.6.3, 0.61.x prior to 0.61.1.4, 1.58.x prior to 1.58.15, 1.59.x prior to 1.59.12, 1.60.x prior to 1.60.6.3, or 1.61.x prior to 1.61.1.4. It is, therefore, affected by a...

Linux Distros Unpatched Vulnerability : CVE-2026-68744

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in SSSD. The sssnssprotocolfillinitgr function in the NSS responder pre-allocates reply space for all group entries but does not shrink the...

SUSE SLED15: libopenssl-3-devel / libopenssl-3-fips-provider / etc (SUSE-SU-2026:3444-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3444-1 advisory. - HollowByte: DoS vector against OpenSSL TLS ClientHello via remote, attacker-controlled memory allocations bsc1271712...

MiracleLinux 9 : glibc-2.34-272.el9_8 (AXSA:2026-1432:09)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1432:09 advisory. glibc: glibc: Heap Buffer Overflow in scanf with %mc format specifier and large width CVE-2026-5450 Bug Fixes and Enhancements: glibc: counter overflow in...

CentOS 9 : firewalld-1.3.4-20.el9

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the firewalld-1.3.4-20.el9 build changelog. - A flaw was found in firewalld. A local unprivileged user can exploit this vulnerability by mis-authorizing two runtime D-Bus Desktop Bus setter...

RockyLinux 8 : kernel (RLSA-2026:49214)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:49214 advisory. kernel: rtnetlink: add missing netlinknscapable check for peer netns CVE-2026-31692 kernel: netfilter: ctnetlink: ensure safe access to master conntrack...

Fedora 45 : freeipa / samba (2026-3be8175017)

The remote Fedora 45 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-3be8175017 advisory. Update to Samba 4.24.5 and rebuild of FreeIPA Security fixes for CVE-2026-6949, CVE-2026-58218, CVE-2026-58221, CVE-2026-58222, CVE-2026-58216 and...

Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-2014)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2014 advisory. In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU in ip6output CVE-2025-40158 In the Linux kernel, the following vulnerability has been resolved: gpio: Fix...

Amazon Linux 2023 : freerdp, freerdp-devel, freerdp-libs (ALAS2023-2026-2012)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2012 advisory. Heap-buffer-overflow write in AVC444 YUV buffer allocation In libfreerdp/codec/h264.c, avc444ensurebuffer computes the AVC444 YUV444 intermediate buffer size as piDstSizex = piDstStridex...

MiracleLinux 8 : yelp-3.28.1-3.el8_10.2 (AXSA:2026-1429:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1429:01 advisory. yelp: yelp-xsl: Overly Permissive Content Security Policy in Yelp Allows Host File Disclosure from Flatpak Applications CVE-2026-13601 Tenable has extracted...

Linux Distros Unpatched Vulnerability : CVE-2026-64564

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sctp: don't free the ASCONF's own transport in DEL-IP processing sctpprocessasconf caches the transport the ASCONF chunk is processed against in asconf-transpor...

RockyLinux 8 : kernel-rt (RLSA-2026:49213)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:49213 advisory. kernel: rtnetlink: add missing netlinknscapable check for peer netns CVE-2026-31692 kernel: netfilter: ctnetlink: ensure safe access to master conntrack...

RockyLinux 8 : perl-Archive-Tar (RLSA-2026:49524)

The remote RockyLinux 8 host has a package installed that is affected by a vulnerability as referenced in the RLSA-2026:49524 advisory. perl-Archive-Tar: perl-Archive-Tar: Denial of Service via crafted tar header with large entry size CVE-2026-9538 Tenable has extracted the preceding description...

SUSE SLES15: GraphicsMagick / GraphicsMagick-devel / libGraphicsMagick++-Q16-12 / etc (SUSE-SU-2026:3441-1)

The remote SUSE Linux SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:3441-1 advisory. This update for GraphicsMagick fixes the following issue: - CVE-2026-56379: arbitrary MVG drawing command injection via the SVG decoder when processing...