openSUSE 16 Security Update : chromium (openSUSE-SU-2026:21724-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21724-1 advisory. Changes in chromium: - Chromium 152.0.7977.64 boo1276749, stable released 2026-08-25: CVE-2026-79282: Use after free in ANGLE CVE-2026-79290: Us...

RockyLinux 10 : nodejs22 (RLSA-2026:61376)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:61376 advisory. nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw CVE-2026-58043 nodejs: Node.js: Remote memory exhaustion via...

TencentOS Server 3: gimp:2.8 (TSSA-2026:0972)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0972 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

Roundcube Webmail 1.6.x < 1.6.18 / 1.7.x < 1.7.3 Multiple Vulnerabilities

The remote web server is running Roundcube Webmail version 1.6.x prior to 1.6.18 or 1.7.x prior to 1.7.3. It is, therefore, affected by multiple vulnerabilities: - The cmdlearn driver of the markasjunk plugin is subject to remote code execution via crafted placeholder replacement values. This iss...

FreeBSD : Erlang/OTP -- multiple vulnerabilities in inets, stdlib, snmp and eldap (e9dfc357-a63f-11f1-9195-4c526214c986)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the e9dfc357-a63f-11f1-9195-4c526214c986 advisory. The Erlang/OTP project reports: OTP 29.0.6, 28.5.0.6 and 27.3.4.17 fix the following issues,...

openSUSE 16 Security Update : apache2-mod_auth_openidc (openSUSE-SU-2026:21717-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21717-1 advisory. This update for apache2-modauthopenidc fixes the following issue: - CVE-2026-54789: out-of-bounds read and one-byte out-of-bounds write in the...

Linux Distros Unpatched Vulnerability : CVE-2026-84333

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Dawn in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside the sandbox via a craft...

openSUSE 16: emacs / emacs-el / emacs-eln / emacs-games / emacs-info / emacs-nox / etc (openSUSE-SU-2026:21711-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21711-1 advisory. Security issues fixed: - Arbitrary code execution when opening a specially crafted file bsc1275941. - CVE-2026-77219: integer overflow in the...

Linux Distros Unpatched Vulnerability : CVE-2026-84378

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HTTPX2 is a next generation HTTP client for Python. From 2.5.0 until 2.10.0, the HTTPX2 Server-Sent Events parser in src/httpx2/httpx2/sse.py repeatedly copies...

Linux Distros Unpatched Vulnerability : CVE-2026-84640

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A maliciously constructed mail header could lead to a one byte read past the end of a buffer. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.1...

Unity Linux 20.1060a / 20.1070a Security Update: glib2 (UTSA-2026-105542)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-105542 advisory. A flaw was found in GLib. An off-by-one error can occur in the gvstupleisnormal function in the glib/gvariant-serialiser.c file when doing an alignment padding check...

Fedora 43 : exiv2 (2026-2854e48ee4)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-2854e48ee4 advisory. Exiv2 0.28.9 bugfix release. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has...

Unity Linux 20.1050e / 20.1070e Security Update: kernel (UTSA-2026-105545)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-105545 advisory. In the Linux kernel, the following vulnerability has been resolved: udf: Avoid double brelse in udfrename syzbot reported a warning like below 1: VFS: brelse: Trying...

Linux Distros Unpatched Vulnerability : CVE-2026-66835

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Path Equivalence vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a modauth protected directory by prefixin...

Unity Linux 20.1070-8ae / 20.1070e Security Update: kernel (UTSA-2026-105435)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-105435 advisory. In the Linux kernel, the following vulnerability has been resolved: iommu/fslpamu: Fix resource leak in fslpamuprobe The fslpamuprobe returns directly when createcsd...

Fedora 44 : firefox / nss (2026-42a3a95e62)

The remote Fedora 44 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-42a3a95e62 advisory. NSS Release Notes Update NSS to 3.127.0 - Bug 1869493 - Heap-buffer overflow in AES Keywrap. - Bug 2052210 - Generate additional test message for...

Linux Distros Unpatched Vulnerability : CVE-2026-65139

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - slurm-wlm - None CVE-2026-65139 Note that Nessus relies on the presence of the package as reported by the vendor. %NASLMINLEVEL 80900 C Tenable,...

Linux Distros Unpatched Vulnerability : CVE-2026-84310

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/doccommon.py getoutline to consume long...

Unity Linux 20.1070-8ae / 20.1070e Security Update: kernel (UTSA-2026-105438)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-105438 advisory. In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fhid: fix refcount leak on error path When failing to allocate reportdesc, opts-refc...

Linux Distros Unpatched Vulnerability : CVE-2026-84359

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Information leak in Skia in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to leak cross-origin data vi...

Fedora 43 : mingw-expat (2026-43f21f29dc)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-43f21f29dc advisory. Update to expat-2.8.3. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for...

Fedora 43 : freerdp (2026-e0f5d28f57)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-e0f5d28f57 advisory. Update to 3.31.0 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...

Unity Linux 20.1070-8ae / 20.1070e Security Update: kernel (UTSA-2026-105429)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-105429 advisory. In the Linux kernel, the following vulnerability has been resolved: clk: tegra20: Fix refcount leak in tegra20clockinit offindmatchingnode returns a node pointer wit...

Unity Linux 20.1060a / 20.1070a Security Update: glib2 (UTSA-2026-105539)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-105539 advisory. A flaw was found in GLib. The D-Bus client-side implementation of the DBUSCOOKIESHA1 SASL authentication mechanism does not validate the cookiecontext parameter...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-105460)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-105460 advisory. In the Linux kernel, the following vulnerability has been resolved: ipv4: route: Prevent rtbindexception from rebinding stale fnhe The sit driver's packet transmissi...

Linux Distros Unpatched Vulnerability : CVE-2026-84355

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in Navigation in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to bypass web...

Fedora 43 : proftpd (2026-0abbe10cdc)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-0abbe10cdc advisory. Current upstream maintenance release, with a handful of potentially security-related bugfixes. Tenable has extracted the preceding description block directly...

Linux Distros Unpatched Vulnerability : CVE-2026-78689

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Description NGINX JavaScript njs has a vulnerability in the XML module's namespace prefix list parser, reachable through the xml.exclusiveC14n method. An...

MiracleLinux 8 : kernel-4.18.0-553.156.1.el8_10 (AXSA:2026-1750:72)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1750:72 advisory. kernel: mm/slub: avoid accessing metadata when pointer is invalid in objecterr CVE-2025-39902 kernel: drm/amdkfd: Fix out-of-bounds write in...

Linux Distros Unpatched Vulnerability : CVE-2026-73812

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - httpd function checkheader/3 rejects duplicate Content-Length per CVE-2026-23941 but never checks for the TE+CL co-presence that RFC 9112 6.3 identifies as a...

ManageEngine Password Manager Pro < Build 13235 SQLi (CVE-2026-14828)

According to its self-reported build number, the ManageEngine Password Manager Pro application running on the remote host is prior to build 13235. It is, therefore, affected by an authenticated SQL injection vulnerability. An authenticated, remote attacker can exploit this by crafting a malicious...

openSUSE 16: dovecot24 / dovecot24-backend-mysql / dovecot24-backend-pgsql / etc (openSUSE-SU-2026:21720-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21720-1 advisory. Update to 2.4.5. - CVE-2026-33263: submission-login: panic when mailmaxuseripconnections is reached bsc1276794. - CVE-2026-27852: DoS by sending...

Jupyterlab Python Library 4.1.x < 4.5.10 / 4.6.x < 4.6.2 (CVE-2026-73627)

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. The detected version of the JupyterLab Python package is 4.1.x prior to 4.5.10, or 4.6.x prior to 4.6.2. It is, therefore, affected by a vulnerability: - JupyterLab...

AlmaLinux 8 : freerdp (ALSA-2026:62571)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:62571 advisory. FreeRDP: FreeRDP: Memory disclosure or denial of service via crafted RDP update orders CVE-2026-67301 FreeRDP: FreeRDP: Denial of Service via crafted...

Dell PowerProtect Cyber Recovery < 20.3.0.0 Multiple Vulnerabilities (DSA-2026-370)

The version of Dell PowerProtect Cyber Recovery installed on the remote host is prior to 20.3.0.0. It is, therefore, affected by multiple vulnerabilities: - Dell PowerProtect Cyber Recovery, versions 20.2 and prior, contain an Improper Neutralization of Special Elements used in an SQL Command 'SQ...

libcurl 7.44.0 < 8.22.0 HTTP/2 Server Push Use-After-Free

The version of libcurl installed on the remote host is 7.44.0 prior to 8.22.0. It is, therefore, affected by a use-after-free vulnerability: - A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to...

libcurl 7.64.1 < 8.22.0 Negotiate Ambient User Connection Reuse

The version of libcurl installed on the remote host is 7.64.1 prior to 8.22.0. It is, therefore, affected by an information disclosure vulnerability: - A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request i...

Linux Distros Unpatched Vulnerability : CVE-2026-70409

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP eldap allows a malicious or compromised LDAP server to degrade availability by...

Linux Distros Unpatched Vulnerability : CVE-2026-73270

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a modauth protected...

openSUSE 16: gimp / gimp-devel / gimp-extension-goat-excercises / gimp-lang / etc (openSUSE-SU-2026:21733-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21733-1 advisory. Changes in gimp: - Update CVE-2026-66757 patch. The original patch wasn't allocating enough bytes. Tenable has extracted the preceding description block...

AlmaLinux 10 : go-fdo-server (ALSA-2026:62578)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:62578 advisory. crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application CVE-2026-33810 encoding/asn1: golang: Go...

RockyLinux 9 : grafana (RLSA-2026:62406)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:62406 advisory. net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 net/mail: golang: Go net/mail: Denial of Service via...

Node.js Module mariadb < 3.2.4 / 3.3.3 / 3.4.6 / 3.5.3 Information Disclosure

The version of the MariaDB Connector/Node.js mariadb module detected on the host is prior to 3.2.4, 3.3.3, 3.4.6, or 3.5.3. It is, therefore, affected by an information disclosure vulnerability. When SSL/TLS is enabled but no CA or server certificate is provided, the connector validates the serve...

RHEL 8 : kernel (RHSA-2026:63014)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:63014 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: s390/cpumsf: Handle CPU hotpl...

MiracleLinux 8 : libssh-0.9.6-17.el8_10 (AXSA:2026-1742:02)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1742:02 advisory. libssh: libssh: denial of service via zero advertised channel packet size CVE-2026-59843 libssh: libssh: denial of service via oversized SFTP read...

AlmaLinux 8 : libssh (ALSA-2026:62218)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:62218 advisory. libssh: libssh: denial of service via zero advertised channel packet size CVE-2026-59843 libssh: libssh: denial of service via oversized SFTP read length...

Next.js Framework 15.5.x < 15.5.21 / 16.x < 16.2.11 Image Optimization API DoS (GHSA-q8wf-6r8g-63ch)

The Next.js Framework on the remote host is affected by a denial of service vulnerability: - When self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely hosted images if configured not enabled by default. If those images contain malicious content, the...

Oracle Linux 10 : ELSA-2026-62578-0: / go-fdo-server (ELSA-2026-625780)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-625780 advisory. 1.0.1-4 - Rebuild go-fdo-server against updated golang 1.0.1-3 - Rebuild against updated golang Tenable has extracted the preceding description bloc...

RockyLinux 8 : freerdp (RLSA-2026:62571)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:62571 advisory. FreeRDP: FreeRDP: Memory disclosure or denial of service via crafted RDP update orders CVE-2026-67301 FreeRDP: FreeRDP: Denial of Service via crafted...

RockyLinux 8 : gegl (RLSA-2026:62425)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:62425 advisory. gimp: gegl: GIMP: Remote code execution via integer overflow in HDR file parsing CVE-2026-18300 Tenable has extracted the preceding description block directly fr...