Oracle Linux 8 : perl-DBI (ELSA-2026-71608)

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-71608 advisory. 1.641-3 - Force placeholder limit on :N and :pN placeholders CVE-2026-73194 Resolves: RHEL-247320 Tenable has extracted the preceding description block directl...

Oracle Linux 9 : expat (ELSA-2026-72663)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-72663 advisory. - Fix CVE-2026-66046: dtdCopy out-of-bounds access via isCdata hash lookup - CVE-2026-93990 expat: Expat: XML Injection via Malformed UTF-16 Input...

SUSE SLES15 Security Update : hplip (SUSE-SU-2026:4371-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4371-1 advisory. - CVE-2026-91097: high severity issue - multiple vulnerabilities enable remote code execution, privilege escalation, denial of...

Amazon Linux 2023 : rclone (ALAS2023-2026-3129)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3129 advisory. On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /...

RHEL 9 : freerdp (RHSA-2026:72481)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:72481 advisory. FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to RDP serve...

RHEL 8 : freerdp (RHSA-2026:73068)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:73068 advisory. FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to RDP serve...

Amazon Linux 2023 : libssh, libssh-config, libssh-devel (ALAS2023-2026-3096)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3096 advisory. A flaw was found in libssh. A remote authenticated client can issue SSHFXPREAD requests with an arbitrarily large length, causing a libssh SFTP server to allocate excessive memory and...

Amazon Linux 2 : flatpak (ALAS-2026-3959)

The version of flatpak installed on the remote host is prior to 1.0.9-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3959 advisory. In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be...

Amazon Linux 2023 : flatpak, flatpak-devel, flatpak-libs (ALAS2023-2026-3143)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3143 advisory. A flaw was found in Flatpak. A Time-of-check to time-of-use TOCTOU race condition exists in the org.freedesktop.Flatpak.SystemHelper component. This vulnerability occurs because a privileged...

Amazon Linux 2 : freerdp (ALAS-2026-3938)

The version of freerdp installed on the remote host is prior to 2.11.7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3938 advisory. A flaw was found in FreeRDP. This vulnerability allows a remote attacker with low privileges to disclose sensitive...

Amazon Linux 2023 : firefox (ALAS2023-2026-3126)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3126 advisory. Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2. CVE-2026-8411...

Amazon Linux 2 : gvfs (ALAS-2026-3943)

The version of gvfs installed on the remote host is prior to 1.36.2-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3943 advisory. A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause readreply t...

Amazon Linux 2023 : python3-bson, python3-pymongo, python3-pymongo-gridfs (ALAS2023-2026-3121)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3121 advisory. Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Python Driver can cause a caller-supplied structured file identifier to be interpreted as a query...

Amazon Linux 2 : python-tornado (ALAS-2026-3925)

The version of python-tornado installed on the remote host is prior to 4.2.1-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3925 advisory. Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses...

Amazon Linux 2 : python3-tornado (ALAS-2026-3924)

The version of python3-tornado installed on the remote host is prior to 5.0.2-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3924 advisory. Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses...

Debian dla-4799 : python-lxml-doc - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4799 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4799-1 [email protected]...

Amazon Linux 2 : runc (ALASECS-2026-138)

The version of runc installed on the remote host is prior to 1.3.6-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2026-138 advisory. On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final...

Amazon Linux 2023 : rsync, rsync-daemon (ALAS2023-2026-3131)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3131 advisory. Rsync versions before 3.4.3 contain a time-of-check to time-of-use TOCTOU race condition in daemon file handling that allows attackers to redirect file writes outside intended directories by...

Amazon Linux 2 : gdb (ALAS-2026-3958)

The version of gdb installed on the remote host is prior to 8.0.1-36. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3958 advisory. A flaw was found in GDB's STABS debug format parser. Thereadmemberfunctions function in gdb/stabsread.c contains a linkedlist removal...

Fedora 43 : chromium (2026-8729b61cd3)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-8729b61cd3 advisory. Update to 154.0.8037.57 CVE-2026-95274: Improper output encoding in DevTools CVE-2026-95275: Incorrect reference resolution in MediaStream...

Amazon Linux 2023 : libsoup3, libsoup3-devel (ALAS2023-2026-3144)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3144 advisory. The fix for CVE-2026-0716 commit 6ff7ef0, libsoup 3.6.6 placed the integer overflow guard inside the if masked block, leaving unmasked server-to-client frames unprotected. A malicious WebSocke...

Mozilla Firefox ESR < 115.42

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 115.42. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-98 advisory. - Sandbox escape due to incorrect boundary conditions in the Graphics component. This vulnerability was...

Mozilla Firefox < 157.0

The version of Firefox installed on the remote Windows host is prior to 157.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-97 advisory. - Privilege escalation in the Places component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157...

RockyLinux 8 : expat (RLSA-2026:72448)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:72448 advisory. expat: Expat: Denial of Service via quadratic complexity in attribute processing CVE-2026-66046 expat: Expat: XML Injection via Malformed UTF-16 Input...

Ubuntu 24.04 LTS : libvirt vulnerabilities (USN-8831-1)

The remote Ubuntu 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8831-1 advisory. It was discovered that libvirt had an integer overflow vulnerability in the NodeGetFreePages RPC handler. A local attacker could possibly use this issue ...

Amazon Linux 2 : gstreamer1-plugins-base (ALAS-2026-3930)

The version of gstreamer1-plugins-base installed on the remote host is prior to 1.18.4-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3930 advisory. A NULL pointer dereference flaw was found in GStreamer's RTSP support library. The vulnerability occurs while...

Linux Distros Unpatched Vulnerability : CVE-2026-97024

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious Flatpak app to cause certain host syste...

Oracle Linux 9 : kernel (ELSA-2026-71700)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-71700 advisory. - pppoe: reload header pointer after devhardheader Guillaume Nault RHEL-237295 CVE-2026-68121 - smb: smbdirect: introduce...

Fedora 43 : NetworkManager-iodine (2026-d3a0471c75)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-d3a0471c75 advisory. Fix CVE-2026-91837 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...

Linux Distros Unpatched Vulnerability : CVE-2026-87798

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper link resolution in the recursive file pull feature of the LXD CLI client in Canonical LXD versions 4.0.2 up to 6.9 fixed in 4.0.14, 5.0.10 and 5.21.8 o...

Ubuntu 24.04 LTS : Emacs vulnerability (USN-8835-1)

The remote Ubuntu 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8835-1 advisory. It was discovered that Emacs improperly handled specially crafted SVG images, resulting in memory corruption. An attacker could possibly use this issue to cause...

Linux Distros Unpatched Vulnerability : CVE-2026-87799

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper link resolution in the migration receive path in Canonical LXD versions 4.0 and later fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10 on Linux allows an...

SUSE SLES15 Security Update : hplip (SUSE-SU-2026:4364-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4364-1 advisory. - CVE-2026-91097: high severity issue - multiple vulnerabilities enable remote code execution, privilege escalation, denial of...

Ubuntu 24.04 LTS / 26.04 LTS : FreeRDP vulnerabilities (USN-8836-1)

The remote Ubuntu 24.04 LTS / 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8836-1 advisory. It was discovered that FreeRDP contained multiple security issues. An attacker could possibly use these issues to obtain sensitive information, cause...

Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : Requests vulnerability (USN-8825-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-8825-1 advisory. It was discovered that Requests did not correctly handle generating random temporary file paths. An attacker could possibly us...

Fedora 44 : perl-Catalyst-Plugin-Static-Simple (2026-2d96cf2594)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-2d96cf2594 advisory. Catalyst::Plugin::Static::Simple for Perl sets the CacheControl header to public for every static asset served. Consequently, intermediaries such as shared...

RockyLinux 9 : resteasy (RLSA-2026:72424)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:72424 advisory. resteasy-core: RESTeasy SourceProvider remote unauthenticated file read CVE-2026-17615 Tenable has extracted the preceding description block directly from the...

Amazon Linux 2 : qemu (ALAS-2026-3934)

The version of qemu installed on the remote host is prior to 3.1.0-8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3934 advisory. NOTE: https://gitlab.com/qemu-project/qemu/-/workitems/4073NOTE: Fixed by: https://gitlab.com/qemu-...

RHEL 10 : thunderbird (RHSA-2026:73130)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:73130 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Privilege escalation in the DOM:...

Amazon Linux 2023 : amazon-efs-utils (ALAS2023-2026-3132)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3132 advisory. RustCrypto CMOV provides conditional move CPU intrinsics which are guaranteed on major platforms to execute in constant-time and not be rewritten as branches by the compiler. From 0.1.1 until 0.5.4, th...

Linux Distros Unpatched Vulnerability : CVE-2026-86335

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing Authorization in imageDownload in Canonical LXD before 5.0.10, 5.21.8, and 6.10 on Linux allows a project-restricted client to access private images fro...

RHEL 8 : gstreamer1-plugins-good (RHSA-2026:73040)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:73040 advisory. GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages conta...

CentOS 9 : unbound-1.26.1-1.el9

"The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the unbound-1.26.1-1.el9 build changelog. - In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap memory and under...

Fedora 45 : freerdp (2026-ff8f6f4444)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-ff8f6f4444 advisory. Update to 3.32.0 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...

Oracle Linux 9 : resteasy (ELSA-2026-72424)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-72424 advisory. 3.0.26-20 - Fix CVE-2026-17615: SourceProvider remote unauthenticated file read Resolves: RHEL-251553 Tenable has extracted the preceding description block...

Oracle Linux 10 : ipa (ELSA-2026-72279)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-72279 advisory. - Resolves: RHEL-248199 CVE-2026-79678 ipa: freeipa: idp-add eval reachable before authorization check allows environment disclosure and denial of...

Amazon Linux 2023 : aspnetcore-runtime-8.0, aspnetcore-runtime-dbg-8.0, aspnetcore-targeting-pack-8.0 (ALAS2023-2026-3114)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3114 advisory. Origin validation error in .NET allows an unauthorized attacker to disclose information over a network. CVE-2026-58649 Integer overflow or wraparound in .NET allows an unauthorized attacker to...

Debian dla-4800 : glance - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4800 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4800-1 [email protected]...

Linux Distros Unpatched Vulnerability : CVE-2026-94287

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU usage and memo...

RHEL 8 : git-lfs (RHSA-2026:72737)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:72737 advisory. Git Large File Storage LFS replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while...