Linux Distros Unpatched Vulnerability : CVE-2026-19141

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Resources in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentiall...

FreeBSD : erlang -- SSH plaintext recovery attack against CBC ciphers (0b58454e-8ff3-11f1-b35c-4c526214c986)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 0b58454e-8ff3-11f1-b35c-4c526214c986 advisory. The Erlang/OTP team reports: The SSH client and server now reject incoming packets not aligned to the...

MiracleLinux 8 : mingw-glib2-2.70.1-9.el8_10 (AXSA:2026-1482:02)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1482:02 advisory. glib: GLib: Buffer underflow in GVariant parser leads to heap corruption CVE-2025-14087 glib: buffer over-read in glib/gvariant-serialiser.c via...

MiracleLinux 9 : gstreamer1-plugins-ugly-free-1.22.12-6.el9_8.1 (AXSA:2026-1481:01)

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-1481:01 advisory. gstreamer1-plugins-ugly-free: GStreamer: Out-of-bounds read in RealMedia demuxer audio stream header parser CVE-2026-53703...

Photon OS 5.0: Rubygem PHSA-2026-5.0-92-0942

An update of the rubygem package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-92-0942. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Linux Distros Unpatched Vulnerability : CVE-2026-19147

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Aura in Google Chrome on Linux prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perfo...

Linux Distros Unpatched Vulnerability : CVE-2026-19151

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page...

MiracleLinux 9 : gstreamer1-plugins-bad-free-1.22.12-7.el9_8.1 (AXSA:2026-1479:03)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1479:03 advisory. gstreamer1-plugins-bad-free: GStreamer: Denial of service via AV1 tilelistobu parser byte/bit confusion CVE-2026-52718 gstreamer1-plugins-bad-free:...

Linux Distros Unpatched Vulnerability : CVE-2026-19171

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Media in Google Chrome on Windows prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML...

SUSE SLES15 Security Update : nodejs24 (SUSE-SU-2026:3520-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3520-1 advisory. Update to 24.18.1. - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF an...

Linux Distros Unpatched Vulnerability : CVE-2026-19167

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Integer overflow in GPU in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to leak cross-origin data vi...

Fedora 43 : abrt (2026-cccf5985b5)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-cccf5985b5 advisory. Update to 2.17.9 Resolves: 2484614 Resolves: CVE-2026-54230 Resolves: CVE-2026-54231 Resolves: CVE-2026-54228 Resolves: CVE-2026-54229 Tenable has...

Linux Distros Unpatched Vulnerability : CVE-2026-19145

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Translate in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML pag...

SUSE SLES15: apache2-mod_php8 / php8 / php8-bcmath / php8-bz2 / php8-calendar / etc (SUSE-SU-2026:3514-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3514-1 advisory. Update to version 8.2.33. Security issues fixed: - CVE-2026-7260: circular symbolic links in phar archives can lead to unbounded...

SUSE SLES15: apache2-mod_php8 / php8 / php8-bcmath / php8-bz2 / php8-calendar / etc (SUSE-SU-2026:3513-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3513-1 advisory. - CVE-2026-7260: circular symbolic links in phar archives can lead to unbounded recursion and cause C stack exhaustion bsc1273077. ...

Linux Distros Unpatched Vulnerability : CVE-2026-19168

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Inappropriate implementation in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted...

Linux Distros Unpatched Vulnerability : CVE-2026-19175

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Payments in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-19143

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Insufficient validation of untrusted input in WebAPKs in Google Chrome on Android prior to 151.0.7922.109 allowed a local attacker to potentially perform a...

RHEL 8 : libyang (RHSA-2026:51339)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:51339 advisory. Libyang is YANG data modeling language parser and toolkit written and providing API in C. Security Fixes: libyang: libyang: Denial of Service or...

openSUSE 16 Security Update : dnsdist (openSUSE-SU-2026:21533-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21533-1 advisory. Update to 1.9.15. Changes for dnsdist: - https://www.dnsdist.org/changelog.htmlchange-1.9.15 - https://www.dnsdist.org/changelog.htmlchange-1.9....

openSUSE 16: apache2-mod_php8 / php8 / php8-bcmath / php8-bz2 / php8-calendar / etc (openSUSE-SU-2026:21532-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21532-1 advisory. This update for php8 fixes the following issues - Update to version 8.4.24 - CVE-2026-7260: Stack overflow in phar with circular symlinks...

Linux Distros Unpatched Vulnerability : CVE-2026-19161

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uninitialized Use in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to leak cross-origin data...

Linux Distros Unpatched Vulnerability : CVE-2025-49506

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - APR-util versions 1.6.3 and earlier function aprpasswordvalidate was not constant-time with regards to hashes or passwords comparisons, potentially leaking thei...

RHEL 7 : glib2 (RHSA-2026:51183)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:51183 advisory. GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, th...

Linux Distros Unpatched Vulnerability : CVE-2026-19146

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uninitialized Use in GPU in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to obtain...

Linux Distros Unpatched Vulnerability : CVE-2026-61477

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value...

Node.js Module axios 0.31.1 < 0.33.0 / 1.15.1 < 1.18.0 DoS (CVE-2026-67321)

The version of the axios Node.js module installed on the remote host is 0.31.1 prior to 0.33.0 or 1.15.1 prior to 1.18.0. It is, therefore, affected by a vulnerability: - An incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in ''. Attackers who...

Linux Distros Unpatched Vulnerability : CVE-2026-52682

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - dnsdist - None pdns - None pdns-recursor - None Ubuntu Linux - A crafted DNS packet can cause increased memory and CPU consumption CVE-2026-52682...

Node.js Module axios 0.31.1 < 0.33.0 / 1.15.2 < 1.18.0 Proxy Hijacking (CVE-2026-67320)

The version of the axios Node.js module installed on the remote host is 0.31.1 prior to 0.33.0 or 1.15.2 prior to 1.18.0. It is, therefore, affected by a vulnerability: - axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. Request...

Slackware Linux 15.0 / current p11-kit Vulnerability (SSA:2026-218-02)

The version of p11-kit installed on the remote host is prior to 0.26.5. It is, therefore, affected by a vulnerability as referenced in the SSA:2026-218-02 advisory. New p11-kit packages are available for Slackware 15.0 and -current to fix a security issue. Tenable has extracted the preceding...

Linux Distros Unpatched Vulnerability : CVE-2026-19170

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in WebGL in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML...

RHEL 8 : libyang (RHSA-2026:51351)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:51351 advisory. Libyang is YANG data modeling language parser and toolkit written and providing API in C. Security Fixes: libyang: libyang: Denial of Service or...

Fedora 43 : freeipa / samba (2026-8e7fa96cf3)

The remote Fedora 43 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-8e7fa96cf3 advisory. Update to Samba 4.23.10 and rebuild of FreeIPA. Security fixes for CVE-2026-6949, CVE-2026-58218, CVE-2026-58221, CVE-2026-58222, CVE-2026-58216 and...

Linux Distros Unpatched Vulnerability : CVE-2026-19176

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to execute arbitrary code...

Fedora 43 : libXfont2 (2026-4f471dd34a)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-4f471dd34a advisory. libXfont2 2.0.9 CVE-2026-59679, CVE-2026-44950 Tenable has extracted the preceding description block directly from the Fedora security advisory. Not...

Node.js Module axios < 0.33.0 / 1.x < 1.18.0 Prototype Pollution

The version of the axios Node.js module installed on the remote host is prior to 0.33.0 or 1.x prior to 1.18.0. It is, therefore, affected by multiple vulnerabilities: - axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has...

Linux Distros Unpatched Vulnerability : CVE-2026-34191

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Portable Runtime Utility via aprdbdoracle provider...

Node.js Module axios 0.28.0 < 0.33.0 / 1.x < 1.18.0 DoS

The version of the axios Node.js module installed on the remote host is 0.28.0 prior to 0.33.0 or 1.x prior to 1.18.0. It is, therefore, affected by multiple vulnerabilities: - Uncontrolled recursion in formDataToJSON when an application passes attacker-controlled FormData field names with...

Linux Distros Unpatched Vulnerability : CVE-2026-70632

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD CFHD decoder that allow...

RockyLinux 10 : gpsd (RLSA-2026:51075)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:51075 advisory. gpsd: gpsd: Command Injection via GPS device subtype allows arbitrary code execution CVE-2026-58459 Tenable has extracted the preceding description block direct...

SolarWinds Web Help Desk < 2026.2.1 SAML Authentication Bypass (CVE-2026-28323)

The version of SolarWinds Web Help Desk installed on the remote host is prior to 2026.2.1. It is, therefore, affected by a SAML authentication bypass vulnerability: - SolarWinds Web Help Desk is found to be affected by a SAML authentication bypass vulnerability. This requires the SAML 2.0...

Linux Distros Unpatched Vulnerability : CVE-2026-71478

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 1.5.0 until 2.9.0, the AttributesExtension's href and src unsafe-link...

Oracle Linux 8 : glibc (ELSA-2026-500140)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-500140 advisory. - CVE-2026-5435 Out-of-bounds write via TSIG record processing RHEL-181724 - CVE-2026-5928: Fix ungetwc operating on byte stream RHEL-181725 -...

Amazon Kiro IDE 1.0.x < 1.0.228 Uncontrolled Search Path Element (Windows)

The version of Amazon Kiro IDE installed on the remote Windows host is 1.0.x prior to 1.0.228. It is, therefore, affected by a vulnerability. - An uncontrolled search path element in Kiro IDE before version 1.0.228 on Windows might allow a remote unauthenticated actor to execute arbitrary code vi...

Linux Distros Unpatched Vulnerability : CVE-2026-64677

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, endpoints in Anki's local HTTP server do not adequately constrain requested media and...

MiracleLinux 9 : xorg-x11-server-1.20.11-34.el9_8.3 (AXSA:2026-1489:14)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1489:14 advisory. xorg: X11: xserver: X.org: glamor Font Atlas Heap Buffer Overflow CVE-2026-55999 Tenable has extracted the preceding description block directly from the...

Linux Distros Unpatched Vulnerability : CVE-2026-43631

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - llama.cpp builds b7492 through the latest b9060 contains a use-after-free vulnerability in the vocab pointer of llama-server when the --sleep-idle-seconds featu...

Linux Distros Unpatched Vulnerability : CVE-2026-64638

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an...

Linux Distros Unpatched Vulnerability : CVE-2026-50159

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid is vulnerable to CS...

Linux Distros Unpatched Vulnerability : CVE-2026-71439

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 11.6.0 until 11.16.1, Mermaid Radar Diagram...