Rocky Linux 8 [CIQ] Security Update: kernel-rt / kernel-rt-core / kernel-rt-debug / kernel-rt-debug-core / etc Multiple Vulnerabilities (crlsa-2026_75746)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202675746 advisory. kernel: Linux kernel: Use-after-free in xc5000 tuner driver due to race condition CVE-2025-39994 kernel: gfs2: Fix unlikely race in gdlmputlock...

Rocky Linux 8 [CIQ] Security Update: bpftool / bpftool-debuginfo / kernel / kernel-abi-stablelists / etc Multiple Vulnerabilities (crlsa-2026_75747)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202675747 advisory. kernel: Linux kernel: Use-after-free in xc5000 tuner driver due to race condition CVE-2025-39994 kernel: gfs2: Fix unlikely race in gdlmputlock...

RHEL 8 : kernel (RHSA-2026:77216)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:77216 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: ALSA: firewire-motu: fix buff...

RHEL 9 : kernel (RHSA-2026:77215)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:77215 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: linux/dim: Fix divide by 0 in...

RockyLinux 10 : opentelemetry-collector (RLSA-2026:76743)

The remote RockyLinux 10 host has a package installed that is affected by a vulnerability as referenced in the RLSA-2026:76743 advisory. google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests CVE-2026-84445 Tenable has extracted the preceding description block directly from...

RHEL 8 : vim (RHSA-2026:77359)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:77359 advisory. Vim Vi IMproved is an updated and improved version of the vi editor. Security Fixes: vim: Vim: Arbitrary command execution via crafted tags file in ...

RHEL 9 : kernel-rt (RHSA-2026:77214)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:77214 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism...

AlmaLinux 9 : vim (ALSA-2026:75768)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:75768 advisory. vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion CVE-2026-73073 Tenable has extracted the preceding description block directly fro...

RHEL 10 / 8 / 9 : Red Hat JBoss Web Server 7.0.2 (RHSA-2026:76952)

The remote Redhat Enterprise Linux 10 / 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:76952 advisory. Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised ...

Rocky Linux 10.2 [CIQ] Security Update: vim-X11 / vim-X11-debuginfo / vim-common / vim-data / vim-debuginfo / etc (crlsa-2026_75769)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202675769 advisory. vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion CVE-2026-73073 Tenable has extracted the preceding description block directly...

RockyLinux 9 : vim (RLSA-2026:75768)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:75768 advisory. vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion CVE-2026-73073 Tenable has extracted the preceding description block directly fr...

Oracle Linux 8 : freerdp (ELSA-2026-76747)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-76747 advisory. 2:2.11.7-14 - Backport several CVE fixes CVE-2026-91953, CVE-2026-91954, CVE-2026-91956, CVE-2026-91959, CVE-2026-91963, CVE-2026-91964 Resolves:...

vLLM 0.8.3 < 0.14.1 Information Disclosure (GHSA-4r2x-xpjr-7cvv)

The version of the vLLM Python package installed on the remote host is 0.8.3 prior to 0.14.1. It is, therefore, affected by an information disclosure vulnerability. When an invalid image is sent to the vLLM multimodal endpoint, PIL throws an error that vLLM returns to the client, leaking a heap...

RockyLinux 8 : ghostscript (RLSA-2026:76877)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:76877 advisory. ghostscript: ghostscript: Heap buffer overflow via JPEG 2000 output adapter CVE-2026-39919 Tenable has extracted the preceding description block directly from th...

MiracleLinux 9 : [security - high] ruby:4.0, ruby-4.0.6-35.module+el9+1202+dcbb4dc4 (AXSA:2026-1987:01)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1987:01 advisory. resolv: resolv gem: Denial of Service via uncontrolled memory growth from crafted DNS responses CVE-2026-80212 Tenable has extracted the preceding descriptio...

SUSE SLES15: libtcnative-1-0 / libtcnative-1-0-devel / tomcat / etc (SUSE-SU-2026:4546-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4546-1 advisory. Security issues fixed: libtcnative-1-0: - CVE-2026-86243: buffer overread during the TLS handshake permits a malicious user to...

Wireshark 1.8.x < 1.8.11 Multiple Vulnerabilities (macOS)

The version of Wireshark installed on the remote macOS / Mac OS X host is prior to 1.8.11. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-1.8.11 advisory. - epan/dissectors/packet-tcp.c in the TCP dissector in Wireshark 1.8.x before 1.8.11 and 1.10.x before...

Wireshark 1.6.x < 1.6.12 Multiple Vulnerabilities (macOS)

The version of Wireshark installed on the remote macOS / Mac OS X host is prior to 1.6.12. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-1.6.12 advisory. - The USB dissector could go into an infinite loop. It may be possible to make Wireshark consume...

Cisco NX-OS Software Control Plane DoS (cisco-sa-nxos-nscpdos-SnderkC7)

According to its self-reported version, Cisco NX-OS Software is affected by a vulnerability. - A vulnerability in Cisco NX-OS Software could allow an unauthenticated, remote attacker to exhaust system resources, causing a denial of service DoS condition. This vulnerability exists because rate...

CentOS Linux 8 [TuxCare] Security Update: httpd / httpd-devel / httpd-filesystem / httpd-manual / httpd-tools / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1791396690)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1791396690 advisory. - NULL Pointer Dereference vulnerability in Apache HTTP Servers modheartmonitor over unicast listener. This issue affects Apache...

AlmaLinux 9.2 [TuxCare] Security Update: python3.11 / python3.11-debug / python3.11-devel / python3.11-idle / etc (ALMALINUX9.2:CLSA-2026:1791359868)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1791359868 advisory. - The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replac...

Fedora 44 : libical (2026-a76bba1412)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-a76bba1412 advisory. Add a patch for CVE-2026-88383: Denial of Service via crafted iCalendar property parsing Tenable has extracted the preceding description block directly from...

MiracleLinux 9 : ghostscript-9.54.0-19.el9_8.1 (AXSA:2026-1983:01)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1983:01 advisory. ghostscript: ghostscript: Heap buffer overflow via JPEG 2000 output adapter CVE-2026-39919 Tenable has extracted the preceding description block directly fro...

RockyLinux 8 : freerdp (RLSA-2026:76747)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:76747 advisory. FreeRDP: FreeRDP: Denial of Service via crafted Surface Bits command CVE-2026-91954 FreeRDP: FreeRDP: Remote code execution via heap buffer overflow in...

CentOS Linux 8 [TuxCare] Security Update: libxml2 / libxml2-devel / libxml2-static / python3-libxml2 (CENTOS-STREAM8:CLSA-2026:1791372460)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1791372460 advisory. - A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially...

Wireshark 1.10.x < 1.10.12 Multiple Vulnerabilities

The version of Wireshark installed on the remote Windows host is prior to 1.10.12. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-1.10.12 advisory. - Buffer underflow in the ssldecryptrecord function in epan/dissectors/packet-ssl-utils.c in Wireshark 1.10.x...

Fedora 46 : socat (2026-3bb7b0bc5a)

The remote Fedora 46 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-3bb7b0bc5a advisory. Automatic update for socat-1.8.1.3-1.fc46. Changelog Tue Oct 6 2026 Martin Osvald - 1.8.1.3-1 - Update to 1.8.1.3 rhbz2492929 - Fix for CVE-2026-56123...

CentOS Linux 8 [TuxCare] Security Update: gd / gd-devel / gd-progs (CENTOS-STREAM8:CLSA-2026:1791373162)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1791373162 advisory. - libgd: buffer overflow when processing specially crafted GIF file CVE-2026-9672 Note that Nessus has not tested for this issue but has...

SUSE SLES12: MozillaFirefox / MozillaFirefox-devel / etc (SUSE-SU-2026:4543-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4543-1 advisory. Update to Firefox Extended Support Release 153.4.0 ESR MFSA 2026-100, bsc1282929: - CVE-2026-96869: Information disclosure in the...

SUSE SLES12 Security Update : openexr (SUSE-SU-2026:4532-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4532-1 advisory. This update for openexr fixes the following issue: - CVE-2026-88384: NULL pointer dereference in the C++ attribute parsing path when a...

Fedora 44 : cockpit (2026-61b2a3477a)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-61b2a3477a advisory. Automatic update for cockpit-368-1.fc44. Changelog for cockpit Wed Sep 23 2026 Packit - 368-1 - Limit concurrent connections CVE-2026-91149 - Harden...

Adobe Campaign Classic < 7.4.3 build 9398 Multiple Vulnerabilities (APSB26-114)

The version of Adobe Campaign Classic installed on the remote host is prior to 7.4.3 build 9398. It is, therefore, affected by multiple vulnerabilities: - An incorrect authorization vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of thi...

Adobe Animate 23.x < 23.0.17 / 24.x < 24.0.15 Code Injection (APSB26-132)

The version of Adobe Animate installed on the remote host is 23.x prior to 23.0.17, or 24.x prior to 24.0.15. It is, therefore, affected by a code injection vulnerability as referenced in the apsb26-132 advisory. - Animate is affected by an Improper Control of Generation of Code 'Code Injection'...

MiracleLinux 8 : gd-2.2.5-8.el8_10 (AXSA:2026-1980:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1980:01 advisory. libgd: buffer overflow when processing specially crafted GIF file CVE-2026-9672 Tenable has extracted the preceding description block directly from the...

Fedora 44 : freerdp (2026-9aca5215f2)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-9aca5215f2 advisory. Update to 3.32.1 ---- Update to 3.32.0 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has...

Wireshark 1.4.x < 1.4.12 Multiple Vulnerabilities (macOS)

The version of Wireshark installed on the remote macOS / Mac OS X host is prior to 1.4.12. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-1.4.12 advisory. - The ANSI A dissector could dereference a NULL pointer and crash. It may be possible to make Wireshark...

Fedora 43 : golang-x-mod (2026-203e30f5d8)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-203e30f5d8 advisory. Rebuild for security fixes Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has no...

CentOS Linux 8.5 [TuxCare] Security Update: httpd / httpd-devel / httpd-filesystem / httpd-manual / httpd-tools / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1791391794)

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1791391794 advisory. - NULL Pointer Dereference vulnerability in Apache HTTP Servers modheartmonitor over unicast listener. This issue affects Apache HTT...

Rocky Linux 8 [CIQ] Security Update: mariadb-connector-c / mariadb-connector-c-config / etc (crlsa-2026_75674)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202675674 advisory. mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysqlrealescapestring CVE-2026-44172 Tenable has extracted th...

MiracleLinux 8 : mariadb-connector-c-3.1.11-3.el8_10 (AXSA:2026-1985:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1985:01 advisory. mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysqlrealescapestring CVE-2026-44172 Tenable has...

Linux Distros Unpatched Vulnerability : CVE-2026-106122

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.36.0, ValueReader.readShortst...

Wireshark 1.10.x < 1.10.11 Multiple Vulnerabilities (macOS)

The version of Wireshark installed on the remote macOS / Mac OS X host is prior to 1.10.11. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-1.10.11 advisory. - The dissectwritestructuredfield function in epan/dissectors/packet-tn5250.c in the TN5250 dissector...

RHEL 8 : kernel-rt (RHSA-2026:77500)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:77500 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism...

AlmaLinux 8 : dovecot (ALSA-2026:76763)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:76763 advisory. dovecot: Dovecot: Denial of Service via IMAP ID command with excessive parameters CVE-2026-42391 dovecot: Dovecot: Authentication bypass via incorrect...

Linux Distros Unpatched Vulnerability : CVE-2026-106273

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uninitialized resource in Video in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to read memory outsid...

Linux Distros Unpatched Vulnerability : CVE-2026-106418

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing authorization in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via...

Linux Distros Unpatched Vulnerability : CVE-2026-106272

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - UI misrepresentation in Chromoting in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially...

Linux Distros Unpatched Vulnerability : CVE-2026-106123

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.35.0,...

Linux Distros Unpatched Vulnerability : CVE-2026-106450

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4FrameInputStream readHeader allocates two new 4 MiB block buffers wheneve...

Linux Distros Unpatched Vulnerability : CVE-2026-106306

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in DevTools in Google Chrome prior to 155.0.8059.39 allowed a local attacker to bypass system access restrictions via a crafted HTML pag...