Linux Distros Unpatched Vulnerability : CVE-2026-119842

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in GStreamer's gst-plugins-base MicroDVD subtitle parser. When processing a specially crafted subtitle file, the parser may dereference a NULL...

Fedora 43 : firefox (2026-c7df132bcb)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-c7df132bcb advisory. - Updated to latest upstream 159.0 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessu...

Linux Distros Unpatched Vulnerability : CVE-2026-119586

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SQLite command-line shell through 3.54.1 contains a command injection vulnerability in the .recover command that emits attacker-planted dot-commands stored in...

RHCOS 4 : OpenShift Container Platform 4.18.59 (RHSA-2026:89724)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:89724 advisory. - net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGSMAXFRAMESIZE frame...

CentOS Linux 7 [TuxCare] Security Update: pcs / pcs-snmp (CENTOS7:CLSA-2026:1793030556)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1793030556 advisory. - Sinatra before 2.2.0 does not validate that the expanded path matches publicdir when serving static files. CVE-2022-29970 Note that Nessus has...

RHEL 8 : go-toolset:rhel8 (RHSA-2026:90994)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:90994 advisory. Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fixes: golang: net/http:...

Linux Distros Unpatched Vulnerability : CVE-2026-93009

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in dnsmasq. The DHCPv6 client hostname parser can read one byte past the end of a crafted FQDN option because it checks the next label length...

Johnson Controls victor Application Server Deserialization RCE (CVE-2026-21655)

Binary data johnsoncontrolsvictorapplicationservercve-2026-21655.nbin...

MiracleLinux 8 : dotnet10.0-10.0.113-1.el8_10 (AXSA:2026-2163:22)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2163:22 advisory. dotnet: dotnet10.0: ASP.NET Core Remote Code Execution Vulnerability CVE-2026-102870 dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Servic...

CentOS Linux 7 [TuxCare] Security Update: gstreamer1-plugins-bad-free / gstreamer1-plugins-bad-free-devel / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1793016750)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1793016750 advisory. - A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio...

Linux Distros Unpatched Vulnerability : CVE-2026-118654

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's static file handlers can normalize dot segments after route matching and serve a file through a...

RockyLinux 8 : libXrender (RLSA-2026:91267)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:91267 advisory. libXrender: libXrender: Code injection via heap overflow in RenderQueryPictFormats CVE-2026-88807 Tenable has extracted the preceding description block directly...

RHEL 10 : kernel (RHSA-2026:92362)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:92362 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: HID: wacom: fix out-of-bound...

RHEL 9 : xdg-dbus-proxy (RHSA-2026:91623)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:91623 advisory. xdg-dbus-proxy is a filtering proxy for D-Bus connections. It was originally part of the flatpak project, but it has been broken out as a standalone...

Linux Distros Unpatched Vulnerability : CVE-2026-88967

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A user with query access to an Azure Monitor data source in Grafana can cause server-side requests to an attacker-controlled endpoint that disclose the data...

CentOS Linux 8.4 [TuxCare] Security Update: ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc (CENTOS8.4:CLSA-2026:1793260012)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1793260012 advisory. - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, an unauthenticated...

Linux Distros Unpatched Vulnerability : CVE-2026-118652

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.JSONP and Context.JSONPBlob concatenate an unvalidated callback value into a JavaScript response....

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: perl-DBI (UTSA-2026-147019)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-147019 advisory. DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile. When a string is assigned to a DBI handle's Profile attribute, DBI...

RHEL 10 : xdg-dbus-proxy (RHSA-2026:90523)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:90523 advisory. xdg-dbus-proxy is a filtering proxy for D-Bus connections. It was originally part of the flatpak project, but it has been broken out as a standalon...

RockyLinux 10 : brotli (RLSA-2026:90449)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:90449 advisory. brotli: Out-of-Bounds Write in Google Brotli Decoder CVE-2026-111497 Tenable has extracted the preceding description block directly from the RockyLinux security...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mongo-c-driver (UTSA-2026-146974)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146974 advisory. An off-by-one error in the BSON bulk document writer in the MongoDB C Driver can write one zero byte immediately past a heap allocation when a document ends at a...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: libsoup (UTSA-2026-146991)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146991 advisory. A vulnerability was found in libsoup's WebSocket frame parsing implementation. The library fails to validate length rules specified in RFC 6455 5.5, which mandates...

RHEL 10 : kernel (RHSA-2026:91565)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:91565 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: tcp: restrict SOATTACHFILTER...

Oracle Linux 8 : curl (ELSA-2026-92368)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-92368 advisory. - fix incomplete mTLS config in connection reuse CVE-2026-8932 - fix cookie injection via trailing dot super cookies CVE-2026-8924 - fix digest auth...

AlmaLinux 8 : mod_auth_openidc:2.3 (ALSA-2026:92157)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:92157 advisory. cjose: OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption CVE-2026-53939 Tenable has extracted the preceding description block...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: xorg-x11-server-Xwayland (UTSA-2026-147036)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-147036 advisory. A flaw was identified in the X.Org X servers X Keyboard Xkb extension where improper bounds checking in the XkbSetCompatMap function can cause an unsigned short...

VMware Cloud Foundation SDDC Manager Brotli Decoder Out-of-Bounds Write (VMSA-2026-0008)

The version of VMware Cloud Foundation SDDC Manager installed on the remote host is 5.2.x, 9.0.x, 9.1.0, or 9.1.1. It is, therefore, affected by a remote code execution vulnerability in the Brotli decoder of its Node.js component as referenced in the VMSA-2026-0008 advisory: - A buffer overflow...

RockyLinux 10 : gcc-toolset-15-gcc (RLSA-2026:89891)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:89891 advisory. gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: Denial of Service via use-after-free in binary heap eraseif CVE-2026-102010 Tenable has extracted the preceding...

AlmaLinux 9.6 [TuxCare] Security Update: python3.11 / python3.11-debug / python3.11-devel / python3.11-idle / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1793265694)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793265694 advisory. - To allow builds of Python to be run from an in-tree layout rather than an installed file layout, the VPATH variable is defined at...

RHEL 9 : mrtg (RHSA-2026:92051)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:92051 advisory. The Multi Router Traffic Grapher MRTG monitors the traffic load on network connections. MRTG generates HTML pages containing PNG images which provid...

Linux Distros Unpatched Vulnerability : CVE-2026-118693

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CherryTree through 1.7.2 contains a path traversal vulnerability in CtStorageXmlHelper::createimagefromxml that trusts unvalidated embedded-file 'filename'...

RockyLinux 9 : python-urllib3 (RLSA-2026:90494)

The remote RockyLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RLSA-2026:90494 advisory. urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser CVE-2026-97689 urllib3: urllib3: Traffic interception via HTTPS prox...

Rocky Linux 8.6 [CIQ] Security Update: brotli / brotli-devel / python3-brotli (ciqsa-2026_1729)

The Rocky Linux 8.6 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261729 advisory. This advisory aggregates security fixes for the brotli SRPM in CIQ LTS 8.6. It addresses 1 CVE: CVE-2026-111497. Tenable has extracted the preceding description...

Linux Distros Unpatched Vulnerability : CVE-2026-118598

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A logic error in Epiphany's site permission handling can cause camera and microphone access to be granted when the user only approves a different permission. In...

RHEL 7 : webkitgtk4 (RHSA-2026:91631)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:91631 advisory. WebKitGTK+ is port of the WebKit portable web rendering engine to the GTK+ platform. These packages provide WebKitGTK+ for GTK+ 3. Security...

RHEL 8 : Red Hat OpenStack Platform 16.2 security advisory (Important) (RHSA-2026:90330)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:90330 advisory. Red Hat OpenStack Platform provides the facilities for building, deploying and monitoring a private or public infrastructure-as-a-service...

RHEL 8 : java-17-openjdk security update for RHEL 8 (Important) (RHSA-2026:88352)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:88352 advisory. The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security...

AlmaLinux 9.2 [TuxCare] Security Update: podman / podman-docker / podman-gvproxy / podman-plugins / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1793284553)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1793284553 advisory. - When parsing a Range header containing a large number of small ranges, FileServerFS, ServeContent, and ServeFileFS can consume an...

RHEL 8 : osbuild-composer (RHSA-2026:90493)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:90493 advisory. A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building...

Linux Distros Unpatched Vulnerability : CVE-2026-118753

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeImage through 3.18.0 and the danoli3 FreeImage fork before 3.19.25 contain a heap buffer overflow vulnerability in PluginGIF.cpp that allows attackers to...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: httpd (UTSA-2026-146967)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146967 advisory. Unity Link Advisory UTSA-2026-146967 Tenable has extracted the preceding description block directly from the Unity Linux security advisory. Note that Nessus has not...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: OpenEXR (UTSA-2026-147001)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-147001 advisory. OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In OpenEXRUtil versions 3.3.0 through...

RockyLinux 8 : libXtst (RLSA-2026:91294)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:91294 advisory. libXtst: libXtst: Denial of Service via out-of-bounds read in RECORD reply parser CVE-2026-94286 Tenable has extracted the preceding description block directly...

Python < 3.11.18 / 3.12.x < 3.12.16 / 3.13.x < 3.13.18 / 3.14.x < 3.14.10 / 3.15.x < 3.15.2 / 3.16.x < 3.16.0 Multiple Vulnerabilities

The version of Python installed on the remote Windows host is prior to 3.11.18, or is 3.12.x prior to 3.12.16, or 3.13.x prior to 3.13.18, or 3.14.x prior to 3.14.10, or 3.15.x prior to 3.15.2, or 3.16.x prior to 3.16.0. It is, therefore, affected by multiple vulnerabilities: - tarfile.tarfilter...

RockyLinux 10 : libXi (RLSA-2026:91004)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:91004 advisory. libXi: libXi: Denial of Service via out-of-bounds read in XI2 class parser CVE-2026-93543 Tenable has extracted the preceding description block directly from th...

AlmaLinux 9 : cjose (ALSA-2026:90812)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:90812 advisory. cjose: cjose: Heap buffer overflow in AES Key Wrap decryption leads to denial of service CVE-2026-53938 Tenable has extracted the preceding description block...

RockyLinux 9 : podman (RLSA-2026:90362)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:90362 advisory. podman: Arbitrary file write when importing OCI archive CVE-2025-11395 net/http: golang: golang: Denial of Service via crafted HTTP Range headers...

Linux Distros Unpatched Vulnerability : CVE-2026-118694

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - python-markdown2 through 2.5.5 contains a denial of service vulnerability that allows remote users to exhaust CPU by submitting Markdown with unclosed inline li...

AlmaLinux 8 : pki-deps:10.6 (ALSA-2026:90909)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:90909 advisory. com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing...

AlmaLinux 9.6 [TuxCare] Security Update: bind / bind-chroot / bind-devel / bind-dnssec-doc / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1793303963)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793303963 advisory. - For a secondary zone with transfers restricted by TSIG, named may start to serve the data provided in a zone transfer before the...