Unity Linux 20.1060a / 20.1070a Security Update: glib2 (UTSA-2026-105540)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-105540 advisory. A flaw was found in GLib. An off-by-one error can occur in the gkeyfilegetlocalestringlist function in the gkeyfile.c file when loading a key file with an empty valu...

Linux Distros Unpatched Vulnerability : CVE-2026-53683

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - resetpassword.html parses query string parameters and uses the 'url' parameter as a redirection target window.location = url after password reset, optionally...

Linux Distros Unpatched Vulnerability : CVE-2026-19931

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - curl - None Ubuntu Linux - Unknown description CVE-2026-19931 Note that Nessus relies on the presence of the package as reported by the vendor...

Rockwell FactoryTalk Activation Manager <= 5.02 Privilege Escalation (SD1799)

The version of Rockwell FactoryTalk Activation Manager installed on the remote Windows host is 5.02 or prior. It is, therefore, affected by a privilege escalation vulnerability. The security issue stems from custom actions in the installer that spawn visible console windows running with SYSTEM...

FreeBSD : py-strawberry-graphql -- Incorrect authorization (1ee62c05-a646-11f1-b187-901b0edee044)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 1ee62c05-a646-11f1-b187-901b0edee044 advisory. Patrick Arminio reports: PermissionExtension.resolve evaluates the return value of haspermission for...

Fedora 44 : python-linkify-it-py (2026-7c23b06d74)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-7c23b06d74 advisory. Security release: LinkifyIt.match was quadratic on untrusted input when linkify is enabled GHSA-8m2q-wq3r-6hq8. - Fix quadratic complexity in...

Fedora 43 : bubblewrap (2026-96e0765328)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-96e0765328 advisory. Update to 0.12.0 Fixes GHSA-pxhw-h44j-8pfx Reset disposition of SIGCHLD, restoring normal subprocess management if bwrap1 was run from a process that was...

FreeBSD : Erlang/OTP -- remote crash via gen_tcp with {packet,4} (62b56853-a609-11f1-9195-4c526214c986)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 62b56853-a609-11f1-9195-4c526214c986 advisory. The OTP 29.0.6 release notes report: A gentcp socket using the inet driver and packet,4 had a bug if...

Unity Linux 20.1070-8ae / 20.1070e Security Update: kernel (UTSA-2026-105428)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-105428 advisory. In the Linux kernel, the following vulnerability has been resolved: testfirmware: fix memory leak in testfirmwareinit When miscregister failed in testfirmwareinit, t...

RockyLinux 8 : libssh (RLSA-2026:62218)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:62218 advisory. libssh: libssh: denial of service via zero advertised channel packet size CVE-2026-59843 libssh: libssh: denial of service via oversized SFTP read lengt...

Unity Linux 20.1060a / 20.1070a Security Update: glib2 (UTSA-2026-105541)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-105541 advisory. A flaw was found in GLib. A buffer over-read can occur in the gregexreplace function when used with the GREGEXRAW compile flag and case-change replacement escapes...

F5 Networks BIG-IP : BIND vulnerability (K000163169)

The version of F5 Networks BIG-IP installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the K000163169 advisory. The issue is unexpected program termination based on ordering and/or specific content in responses to queries for CNAM...

MiracleLinux 8 : curl-7.61.1-34.el8_10.13.ML.1 (AXSA:2026-1729:06)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1729:06 advisory. curl: curl: Insecure connection establishment due to TLS configuration mismatch CVE-2026-8286 Bug Fixes and Enhancements: Regression of RHEL-73788. The .9...

RockyLinux 9 : libssh (RLSA-2026:62217)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:62217 advisory. libssh: libssh: denial of service via zero advertised channel packet size CVE-2026-59843 libssh: libssh: denial of service via oversized SFTP read lengt...

Unity Linux 20.1060e / 20.1070-8ae / 20.1070e Security Update: kernel (UTSA-2026-105422)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-105422 advisory. In the Linux kernel, the following vulnerability has been resolved: USB: serial: omninet: fix memory corruption with small endpoint Make sure that the bulk-out buffe...

Debian dla-4768 : libapache2-mod-auth-openidc - security update

The remote Debian 12 host has a package installed that is affected by a vulnerability as referenced in the dla-4768 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4768-1 [email protected] https://www.debian.org/lts/security/...

MiracleLinux 8 : NetworkManager-1.40.16-21.el8_10.ML.1 (AXSA:2026-1732:08)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1732:08 advisory. NetworkManager: NetworkManager: Local privilege escalation via malformed MUD URLs in dhclient backend CVE-2026-10805 Tenable has extracted the preceding...

RockyLinux 8 : gimp:2.8 (RLSA-2026:62507)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:62507 advisory. gimp: gimp: Stack buffer overflow in pnmscannergettoken CVE-2026-58380 gimp: integer overflow in file-fits plugin causes a heap-based buffer overflow on...

Linux Distros Unpatched Vulnerability : CVE-2026-80255

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - curl - None Ubuntu Linux - Unknown description CVE-2026-80255 Note that Nessus relies on the presence of the package as reported by the vendor...

F5 Networks BIG-IP : Intel UEFI vulnerability (K000163187)

The version of F5 Networks BIG-IP installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the K000163187 advisory. Improper input validation in the UEFI FlashUcAcmSmm module for some IntelR reference platforms may allow an escalation...

Linux Distros Unpatched Vulnerability : CVE-2026-83619

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.7.0 until 0.8.15, the release-0.8.x parser in...

RHEL 9 : golang (RHSA-2026:62404)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:62404 advisory. The golang packages provide the Go programming language compiler. Security Fixes: encoding/asn1: golang: Go encoding/asn1: Denial of Servic...

RHEL 10 : go-fdo-server (RHSA-2026:62578)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:62578 advisory. This package provides a server-side implementation of the FIDO Device Onboard FDO specification, written in Go. FDO is an open standard fo...

RHEL 10 : go-fdo-client (RHSA-2026:62577)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:62577 advisory. go-fdo-client is the device-side implementation of FIDO Device Onboard specification in Go. It provides an FDO client that interacts with...

RHEL 9 : osbuild-composer (RHSA-2026:62753)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:62753 advisory. A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building...

RHEL 9 : golang (RHSA-2026:62405)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:62405 advisory. The golang packages provide the Go programming language compiler. Security Fixes: encoding/asn1: golang: Go encoding/asn1: Denial of Servic...

FreeBSD : chromium -- security fixes (19d0eaf5-a698-11f1-bf98-a8a1599412c6)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 19d0eaf5-a698-11f1-bf98-a8a1599412c6 advisory. Chrome Releases reports: This update includes 26 security fixes: Tenable has extracted the...

Linux Distros Unpatched Vulnerability : CVE-2026-52131

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - llama.cpp b5693 and before has a Reachable Assertion via the ggufreader::read function. CVE-2026-52131 Note that Nessus relies on the presence of the package as...

Linux Distros Unpatched Vulnerability : CVE-2026-84349

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Browser in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to execute arbitrary code...

MiracleLinux 9 : [security - high] nodejs:22 (AXSA:2026-1738:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1738:01 advisory. nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw CVE-2026-58043 nodejs: Node.js: Remote memory exhaustion vi...

MiracleLinux 8 : glib2-2.56.4-177.el8_10 (AXSA:2026-1730:14)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1730:14 advisory. glib: buffer over-read in glib/gvariant-serialiser.c via gvstupleisnormal CVE-2026-58010 glib: out-of-bounds read in glib/gdatetime.c:gdatetimegetym...

RHEL 9 : kpatch-patch-5_14_0-427_100_1, kpatch-patch-5_14_0-427_113_1, kpatch-patch-5_14_0-427_126_1, kpatch-patch-5_14_0-427_68_2, and kpatch-patch-5_14_0-427_84_1 (RHSA-2026:62639)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:62639 advisory. This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the code of a running kernel. This patc...

Linux Distros Unpatched Vulnerability : CVE-2026-55856

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, when a Java...

RHEL 8 : kernel (RHSA-2026:62372)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:62372 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: net: bridge: stop fast-leave after...

RHEL 9 : kernel (RHSA-2026:62568)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:62568 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: Squashfs: sanity check symbol...

FreeBSD : expat2 -- Inefficient Algorithmic Complexity (88917664-a65c-11f1-a49c-00a0980083d7)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 88917664-a65c-11f1-a49c-00a0980083d7 advisory. https://github.com/libexpat/libexpat/pull/1321 reports: Expat through 2.8.3 contains a denial of servic...

Unity Linux 20.1070-8ae / 20.1070e Security Update: kernel (UTSA-2026-105427)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-105427 advisory. In the Linux kernel, the following vulnerability has been resolved: r6040: Fix kmemleak in probe and remove There is a memory leaks reported by kmemleak: unreferenc...

Linux Distros Unpatched Vulnerability : CVE-2026-83557

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom...

Linux Distros Unpatched Vulnerability : CVE-2026-84123

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Privilege escalation due to use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, a...

MiracleLinux 9 : nginx-1.20.1-28.el9_8.5.ML.1 (AXSA:2026-1735:07)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1735:07 advisory. nginx: NGINX: Heap buffer over-read allows memory modification or denial of service CVE-2026-56434 nginx: NGINX: Memory disclosure and denial of...

RHEL 8 : gegl04 (RHSA-2026:62420)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:62420 advisory. GEGL Generic Graphics Library is a graph-based image processing framework. Security Fixes: gimp: gegl: GIMP: Remote code execution via integer...

Oracle Linux 9 : ELSA-2026-61355-0: / dbus-broker (ELSA-2026-613550)

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-613550 advisory. 28-9 - Fix session bus denial of service via EMFILE during peer setup. Resolves: RHEL-233014 28-8 - Switch from useradd to systemd sysusers Resolves:...

RHEL 10 : php (RHSA-2026:62614)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:62614 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: ext-pgsql: PHP: SQL injection v...

MiracleLinux 9 : dbus-broker-28-9.el9_8 (AXSA:2026-1736:01)

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1736:01 advisory. dbus-broker: dbus-broker: session bus denial of service via EMFILE during peer setup CVE-2026-16730 Tenable has extracted the preceding description block...

RHEL 9 : gegl04 (RHSA-2026:62170)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:62170 advisory. GEGL Generic Graphics Library is a graph-based image processing framework. Security Fixes: gimp: gegl: GIMP: Remote code execution via integer...

Linux Distros Unpatched Vulnerability : CVE-2026-78410

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local...

Linux Distros Unpatched Vulnerability : CVE-2026-84641

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. Heap contents can ultimately be persisted to...

Jenkins LTS < 2.568.3 / Jenkins weekly < 2.580 Multiple Vulnerabilities

According to its its self-reported version number, the version of Jenkins running on the remote web server is Jenkins LTS prior to 2.568.3 or Jenkins weekly prior to 2.580. It is, therefore, affected by multiple vulnerabilities: - In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient...

Linux Distros Unpatched Vulnerability : CVE-2026-84637

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Malicious calendar invitations could use file URI attachments to launch local or network-hosted executables on Windows, bypassing Thunderbird's normal executabl...

Linux Distros Unpatched Vulnerability : CVE-2026-84356

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - UI misrepresentation in FullScreen in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to spoof address bar via a crafted HTML page. Chromium...