Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: xorg-x11-server-Xwayland (UTSA-2026-147013)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-147013 advisory. A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. XkbSetMapChecks declares a fixed-size stack buffer mapWidths256 indexed by key type...

AlmaLinux 9.2 [TuxCare] Security Update: bzip2 / bzip2-devel / bzip2-libs / bzip2-static (ALMALINUX9.2:CLSA-2026:1793282029)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1793282029 advisory. - bzip2 contains an offbyone error in the bzip2recover utility. When processing a specially crafted file, the application performs an...

Linux Distros Unpatched Vulnerability : CVE-2026-118590

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A security vulnerability has been detected in nipy nibabel up to 5.4.2. The affected element is the function arrayfromfile of the file nibabel/volumeutils.py of...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: xorg-x11-server-Xwayland (UTSA-2026-147025)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-147025 advisory. A heap-based buffer over-read vulnerability was found in the X.org server's ProcXIPassiveGrabDevice function. This issue occurs when byte-swapped length values are...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: xorg-x11-server-Xwayland (UTSA-2026-146999)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146999 advisory. A flaw was found in the X.Org X server and Xwayland when processing X11 Present extension notifications. Improper error handling during notification creation can lea...

Linux Distros Unpatched Vulnerability : CVE-2026-111073

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The broker-side PushTelemetry API KIP-714 validates only the compressed size of a client's metrics payload against telemetry.max.bytes default 1 MB before...

RHEL 8 : webkit2gtk3 (RHSA-2026:91636)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:91636 advisory. WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fixes: chromium-browser: angle: Use after...

HCL BigFix Server 10.0.x <= 10.0.16 / 11.0.x <= 11.0.7 Certificate Validation (KB0134758)

The version of HCL BigFix Server installed on the remote host is 10.0.x through 10.0.16 or 11.0.x through 11.0.7. It is, therefore, affected by a vulnerability in the bundled CA certificate store: - BigFix Platform uses Mozilla CA certificate bundle PEM. Versions of the bundle dated before...

Symfony and Symfony HTTP Foundation Component 4.1.x < 5.4.54 / 6.0.x < 6.4.46 / 7.0.x < 7.4.19 / 8.0.x < 8.1.7 DoS

The version of Symfony and/or the Symfony HTTP Foundation Component installed on the remote host is 4.1.0 or later prior to 5.4.54, or 6.0.0 or later prior to 6.4.46, or 7.0.x prior to 7.4.19, or 8.0.x prior to 8.1.7. It is, therefore, affected by a denial of service vulnerability. -...

Amazon Linux 2023 : kmod-nvidia-open-dkms (ALAS2023NVIDIA-2026-317)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023NVIDIA-2026-317 advisory. NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where permissions on read-only memory might not be preserved. A successful exploit of this...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: rpm (UTSA-2026-146970)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146970 advisory. A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec function in tools/rpmbuild.cc passes an...

Tanium Comply 2.32.x < 2.32.263 / 2.35.x < 2.35.323 / 2.37.x < 2.37.326 Improper Access Control (TAN-2026-073)

The version of Tanium Comply installed on the remote host is 2.32.x prior to 2.32.263, 2.35.x prior to 2.35.323, or 2.37.x prior to 2.37.326. It is, therefore, affected by an improper access controls vulnerability as referenced in the TAN-2026-073 advisory. - Tanium addressed an improper access...

AlmaLinux 9.2 [TuxCare] Security Update: go-toolset / golang / golang-bin / golang-docs / golang-misc / etc (ALMALINUX9.2:CLSA-2026:1793314446)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1793314446 advisory. - On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: xorg-x11-server-Xwayland (UTSA-2026-147039)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-147039 advisory. A flaw was found in the X.Org X server's XKB key types request validation. A local attacker could send a specially crafted request to the X server, leading to an...

Linux Distros Unpatched Vulnerability : CVE-2026-118658

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Echo is a Go web framework. Prior to 4.15.2 and 5.1.1, Context.Scheme returns values from X-Forwarded- Proto, X-Forwarded-Protocol, or X-Url-Scheme without...

MiracleLinux 8 : java-17-openjdk-17.0.21.0.9-2.1.el8 (AXSA:2026-2207:19)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2207:19 advisory. JDK: Enhance PKCS5 padding CVE-2026-83374 JDK: Enhance TLS certificate handling CVE-2026-83376 JDK: Enhance LDAP logins CVE-2026-83380 JDK: Enhance...

Next.js Framework 13.x / 14.x / 15.x < 15.5.28 / 16.x < 16.4.1 Server Actions DoS (GHSA-p3m5-59mp-jv5r)

The Next.js Framework on the remote host is affected by a denial of service vulnerability: - A denial of service vulnerability exists in Next.js applications using the App Router with at least one Server Action. Crafted requests targeting such an application can cause excessive CPU consumption,...

Linux Distros Unpatched Vulnerability : CVE-2026-83525

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect operator CWE-480 in the FetchSnapshot RPC handler in Apache Kafka from 2.8.0 before 4.2.2, and from 4.3.0 before 4.3.2 on all platforms allows an...

RockyLinux 10 : kernel (RLSA-2026:91565)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:91565 advisory. kernel: tcp: restrict SOATTACHFILTER to priv users CVE-2026-53236 kernel: fuse: re-lock request before replacing page cache folio CVE-2026-53388 kernel...

RHEL 9 : xdg-dbus-proxy (RHSA-2026:90522)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:90522 advisory. xdg-dbus-proxy is a filtering proxy for D-Bus connections. It was originally part of the flatpak project, but it has been broken out as a standalone...

MiracleLinux 9 : xdg-dbus-proxy-0.1.3-1.el9_8.1 (AXSA:2026-2208:01)

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-2208:01 advisory. xdg-dbus-proxy: xdg-dbus-proxy: message filtering bypass via reply serial allows sandbox escape CVE-2026-94422 Tenable has extracted the preceding descriptio...

AlmaLinux 9.6 [TuxCare] Security Update: libreswan Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1793271759)

The AlmaLinux 9.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793271759 advisory. - Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: xorg-x11-server-Xwayland (UTSA-2026-147022)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-147022 advisory. An out-of-bounds memory access flaw was found in the X.Org server. This issue can be triggered when a device frozen by a sync grab is reattached to a different maste...

AlmaLinux 10 : thunderbird (ALSA-2026:90895)

The remote AlmaLinux 10 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:90895 advisory. libexpat: denial of service via crafted XML input CVE-2026-45186 Bug Fixes and Enhancements: Thunderbird ESR 153 rebase rhel-10.2.z JIRA:RHEL-175207 Tenable has...

Oracle Linux 10 : ignition (ELSA-2026-91720)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-91720 advisory. 2.26.0-3.0.1.4 - Drop RHCK specific module inclusion Orabug: 39718726 - Remove sgdisk requirement and create symbolic link to sgdisk Orabug: 37470782 2.26.0-4...

Alibaba Cloud Linux 3 : 0327: dovecot (ALINUX3-SA-2026:0327)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2026:0327 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-27852: An attacker that can send...

ArubaOS 8.10.x < 8.10.0.24 / 8.13.x < 8.13.3.1 Multiple Vulnerabilities (HPESBNW05162)

The version of ArubaOS AOS-8 installed on the remote host is affected by multiple vulnerabilities as referenced in the HPESBNW05162 advisory: - Command injection vulnerabilities exist in the affected interface of AOS-8 that could allow an unauthenticated remote attacker to run arbitrary commands ...

Amazon Linux 2023 : nvidia-libXNVCtrl, nvidia-libXNVCtrl-devel, nvidia-settings (ALAS2023NVIDIA-2026-328)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023NVIDIA-2026-328 advisory. NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where permissions on read-only memory might not be preserved. A successful exploit of this...

RHCOS 4 : Red Hat build of MicroShift 4.19.53 (RHSA-2026:91191)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:91191 advisory. - encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 - mime: golang:...

RockyLinux 9 : buildah (RLSA-2026:90424)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:90424 advisory. podman: Arbitrary file write when importing OCI archive CVE-2025-11395 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted...

AlmaLinux 9 : libXrender (ALSA-2026:91057)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:91057 advisory. libXrender: libXrender: Code injection via heap overflow in RenderQueryPictFormats CVE-2026-88807 Tenable has extracted the preceding description block directly...

Linux Distros Unpatched Vulnerability : CVE-2026-118258

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.4, interpolateUrl inserts...

Devolutions Server < 2026.2.21.0 / 2026.3.5.0 < 2026.3.11.0 Multiple Vulnerabilities (DEVO-2026-0037)

The version of Devolutions Server installed on the remote host is prior to 2026.2.21.0, or is 2026.3.5.0 through 2026.3.10.0. It is, therefore, affected by multiple vulnerabilities, including: - Missing authorization in the PAM AD computer import endpoint in Devolutions Server allows an...

CKEditor 45.x < 47.7.4 / 48.x < 48.5.1 XSS

The version of CKEditor included on the remote web host is 45.x prior to 47.7.4, or 48.x prior to 48.5.1. It is, therefore, affected by a cross-site scripting XSS vulnerability. The CKEditor 5 engine uses a vulnerable es-toolkit version whose prototype-pollution behavior can be reached while...

Google Chrome < 156.0.8078.79 Multiple Vulnerabilities

The version of Google Chrome installed on the remote Windows host is prior to 156.0.8078.79. It is, therefore, affected by multiple vulnerabilities as referenced in the 202610stable-channel-update-for-desktop02107719452 advisory. - Use after free in MediaStream in Google Chrome prior to...

RockyLinux 8 : python-urllib3 (RLSA-2026:90759)

The remote RockyLinux 8 host has a package installed that is affected by a vulnerability as referenced in the RLSA-2026:90759 advisory. urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser CVE-2026-97689 Tenable has extracted the preceding description block directly...

RHEL 9 : python-tornado (RHSA-2026:90777)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:90777 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic da...

Oracle Linux 9 : ignition (ELSA-2026-91719)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-91719 advisory. 2.26.0-1.2 - Rebuild with updated golang 2.26.0-1.1 - Rebuild with updated golang - Resolves: RHEL-175424, RHEL-177307 Tenable has extracted the preceding...

MiracleLinux 9 : dotnet10.0-10.0.113-1.el9_8.ML.1 (AXSA:2026-2150:21)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2150:21 advisory. dotnet: dotnet10.0: ASP.NET Core Remote Code Execution Vulnerability CVE-2026-102870 dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Servic...

AlmaLinux 10 : java-25-openjdk (ALSA-2026:88347)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:88347 advisory. JDK: Enhance PKCS5 padding CVE-2026-83374 JDK: Enhance TLS certificate handling CVE-2026-83376 JDK: Improve C2 loop transformations CVE-2026-83378 JDK:...

RHEL 10 : kernel (RHSA-2026:91648)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:91648 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: bpf: Support for hardening...

RHCOS 4 : Red Hat build of MicroShift 4.21.40 (RHSA-2026:89818)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:89818 advisory. - crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates CVE-2026-111943 Note that Nessus has n...

Linux Distros Unpatched Vulnerability : CVE-2026-118693

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CherryTree through 1.7.2 contains a path traversal vulnerability in CtStorageXmlHelper::createimagefromxml that trusts unvalidated embedded-file 'filename'...

Linux Distros Unpatched Vulnerability : CVE-2026-88967

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A user with query access to an Azure Monitor data source in Grafana can cause server-side requests to an attacker-controlled endpoint that disclose the data...

Linux Distros Unpatched Vulnerability : CVE-2026-118652

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.JSONP and Context.JSONPBlob concatenate an unvalidated callback value into a JavaScript response....

Fedora 44 : librabbitmq (2026-5cb9d320c3)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-5cb9d320c3 advisory. Version 0.18.1 - 2026-10-12 Security - Fix heap buffer over-read in amqpreadmessage when a content header frame with a non-basic class id is received;...

Linux Distros Unpatched Vulnerability : CVE-2026-93006

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in dnsmasq. The TFTP server can serve the wrong file contents because a recently used transfer cache is not invalidated when a transfer finishe...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mongo-c-driver (UTSA-2026-146973)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146973 advisory. A size check in the client-side authentication path of the MongoDB C Driver can wrap around, so an unusually large user-name value is accepted and copied past the en...

RHEL 9 : webkit2gtk3 (RHSA-2026:89822)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:89822 advisory. WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fixes: chromium-browser: skia:...

Oracle Linux 7 : php (ELSA-2026-88693)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-88693 advisory. 5.4.16-48.0.1 - Backport fix for CVE-2026-109619 Orabug: 40200805 Tenable has extracted the preceding description block directly from the Oracle Linux security...