RHEL 9 : xdg-dbus-proxy (RHSA-2026:91625)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:91625 advisory. xdg-dbus-proxy is a filtering proxy for D-Bus connections. It was originally part of the flatpak project, but it has been broken out as a standalone...

RHEL 8 : kpatch-patch-4_18_0-477_107_1, kpatch-patch-4_18_0-477_120_1, kpatch-patch-4_18_0-477_130_1, kpatch-patch-4_18_0-477_143_1, and kpatch-patch-4_18_0-477_161_1 (RHSA-2026:92063)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:92063 advisory. This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the code of a running kernel. This patc...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: libsoup (UTSA-2026-147035)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-147035 advisory. A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequately cap total message size against the limits ...

CentOS Linux 8.5 [TuxCare] Security Update: java-1.8.0-openjdk / java-1.8.0-openjdk-accessibility / etc (CENTOS8.5:CLSA-2026:1793289498)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2026:1793289498 advisory. - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE...

RockyLinux 8 : libreswan (RLSA-2026:90492)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:90492 advisory. libreswan: IKEv2 Use-After-Free bug when using IKE-over-TCP CVE-2026-94453 libreswan: IKEv2 pre-authentication Null Pointer deref in EAP code...

RHEL 8 : rhc (RHSA-2026:90726)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:90726 advisory. rhc is a client tool and daemon that connects the system to Red Hat hosted services enabling system and subscription management. Security...

Linux Distros Unpatched Vulnerability : CVE-2026-118650

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, a globally mounted middleware.Static instance can interpret an encoded request path differently from Echo...

RHEL 10 : gcc-toolset-15-gcc (RHSA-2026:89891)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:89891 advisory. The gcc-toolset-15-gcc package contains the GNU Compiler Collection version 15. Security Fixes: gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: Denia...

Fedora 45 : accessibility-inspector / akonadi-calendar / akonadi-calendar-tools / etc (2026-21f4914bca)

The remote Fedora 45 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-21f4914bca advisory. KDE Plasma 6.8.1 + Gear 28.08.2 And related rebuilds ---- - CVE-2026-110236 Arbitrary command execution via crafted folder name Tenable has extracted the...

RHEL 9 : ignition (RHSA-2026:90518)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:90518 advisory. Ignition is a utility used to manipulate systems during the initramfs. This includes partitioning disks, formatting partitions, writing files regula...

RHEL 8 : emacs (RHSA-2026:90800)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:90800 advisory. GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language elisp, and the...

RockyLinux 9 : brotli (RLSA-2026:90495)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:90495 advisory. brotli: Out-of-Bounds Write in Google Brotli Decoder CVE-2026-111497 Tenable has extracted the preceding description block directly from the RockyLinux security...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: xorg-x11-server-Xwayland (UTSA-2026-147033)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-147033 advisory. A use-after-free vulnerability was found in the ProcRenderAddGlyphs function of Xorg servers. This issue occurs when AllocateGlyph is called to store new glyphs sent...

AlmaLinux 8 : java-17-openjdk security update for AlmaLinux 8 (High) (ALSA-2026:88352)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:88352 advisory. JDK: Enhance PKCS5 padding CVE-2026-83374 JDK: Enhance TLS certificate handling CVE-2026-83376 JDK: Enhance LDAP logins CVE-2026-83380 JDK: Enhance SASL...

FreeBSD : trafficserver -- multiple vulnerabilities (3caa3b4b-d2ab-11f1-bae2-3497f65b111b)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 3caa3b4b-d2ab-11f1-bae2-3497f65b111b advisory. The Apache Traffic Server project published security advisories for issues fixed in releases...

NuGet Package 'Amazon.Extensions.S3.Encryption' 2.1.x <= 2.3.0 / 3.x < 3.2.2 / 4.0.x < 4.0.3 RSA Padding Oracle

The version of the NuGet Package 'Amazon.Extensions.S3.Encryption' Amazon S3 Encryption Client for .NET installed on the remote host is 2.x greater than or equal to 2.1.0, or 3.x prior to 3.2.2, or 4.0.x prior to 4.0.3. It is, therefore, affected by a padding oracle vulnerability. A remote user w...

RHEL 9 : osbuild-composer (RHSA-2026:92372)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:92372 advisory. A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building...

AlmaLinux 8 : kernel (ALSA-2026:92209)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:92209 advisory. kernel: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling CVE-2026-72288 kernel: KVM: arm64: vgic: Check the interrupt is...

Amazon Linux 2023 : nvidia-imex (ALAS2023NVIDIA-2026-324)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023NVIDIA-2026-324 advisory. NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where permissions on read-only memory might not be preserved. A successful exploit of this...

RockyLinux 9 : skopeo (RLSA-2026:90462)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:90462 advisory. podman: Arbitrary file write when importing OCI archive CVE-2025-11395 net/http: golang: golang: Denial of Service via crafted HTTP Range headers...

Oracle Linux 10 : dogtag-pki (ELSA-2026-92408)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-92408 advisory. - Fix CVE-2026-89059: RESTEasy IIOImageProvider Unbounded Image Decode - Fix CVE-2026-89058: RESTEasy CorsFilter Reflects Arbitrary Origin with...

Fedora 44 : libreswan (2026-fe33d29b75)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-fe33d29b75 advisory. Fixes CVE-2026-77205, CVE-2026-77206, CVE-2026-77207 and CVE-2026-9445 Tenable has extracted the preceding description block directly from the Fedor...

Linux Distros Unpatched Vulnerability : CVE-2026-118266

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's MethodOverride middleware accepts a safe HTTP method as the override target for a POST request. Wh...

AlmaLinux 10 : libXrender (ALSA-2026:91003)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:91003 advisory. libXrender: libXrender: Code injection via heap overflow in RenderQueryPictFormats CVE-2026-88807 Tenable has extracted the preceding description block directly...

Linux Distros Unpatched Vulnerability : CVE-2026-88858

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A user with the Viewer role in Grafana can crash the server by submitting a crafted server-side math expression uncontrolled recursion. A user with permission t...

Oracle Linux 9 : libX11 (ELSA-2026-91365)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-91365 advisory. 1.8.12-1.1 - CVE-2026-88806 libX11: libX11: Heap-based buffer overflow via malicious X server X server Tenable has extracted the preceding description block...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: xorg-x11-server-Xwayland (UTSA-2026-147015)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-147015 advisory. A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. A mismatch between the X server and the libXfont2 library's maximum font name length...

AlmaLinux 9.6 [TuxCare] Security Update: 389-ds-base / 389-ds-base-devel / 389-ds-base-libs / etc (ALMALINUX9.6:CLSA-2026:1793270033)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793270033 advisory. - A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes of an...

Rocky Linux 9.6 [TuxCare] Security Update: python3.11 / python3.11-debug / python3.11-devel / python3.11-idle / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1793265694)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793265694 advisory. - To allow builds of Python to be run from an in-tree layout rather than an installed file layout, the VPATH variable is defined a...

RHEL 9 : php:8.3 (RHSA-2026:89111)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:89111 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: OOM bailout during request parsi...

CentOS Linux 6 [TuxCare] Security Update: kernel / kernel-abi-whitelists / kernel-debug / kernel-debug-devel / etc Multiple Vulnerabilities (CENTOS6:CLSA-2026:1792975902)

The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1792975902 advisory. - In the Linux kernel, the following vulnerability has been resolved: hwrng: geode - Fix PCI device refcount leak foreachpcidev is...

Linux Distros Unpatched Vulnerability : CVE-2026-118655

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path a second time. Double-encoded separators...

RHEL 6 : python-lxml (RHSA-2026:90336)

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:90336 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic da...

RHCOS 4 : Red Hat build of MicroShift 4.20.44 (RHSA-2026:91172)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:91172 advisory. - crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates CVE-2026-111943 Note that Nessus has n...

Debian dla-4866 : firefox-esr - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4866 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4866-1 [email protected]...

RockyLinux 8 : emacs (RLSA-2026:90800)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:90800 advisory. emacs: Emacs: arbitrary code execution in Flymake mode CVE-2026-96442 Tenable has extracted the preceding description block directly from the RockyLinux security...

RHEL 10 : kpatch-patch-6_12_0-211_16_1 and kpatch-patch-6_12_0-211_49_1 (RHSA-2026:92061)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:92061 advisory. This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the code of a running kernel. This pat...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: xorg-x11-server-Xwayland (UTSA-2026-147031)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-147031 advisory. A flaw was found in the X Record extension. The RecordSanityCheckRegisterClients function does not check for an integer overflow when computing request length, which...

AlmaLinux 9.6 [TuxCare] Security Update: wireshark / wireshark-cli / wireshark-devel Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1793272959)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793272959 advisory. - RRC protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service CVE-2026-76880 - ESS protocol dissecto...

Rocky Linux 9.6 [TuxCare] Security Update: squid (ALMALINUX9.6:CLSA-2026:1793281224)

The Rocky Linux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793281224 advisory. - Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of behavioral workflow bug, Squid is...

Amazon Linux 2023 : ca-certificates (ALAS2023-2026-3337)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3337 advisory. The system certificate authority CA store in Amazon Linux, distributed via the ca-certificates RPM package, included multiple root CA certificates belonging to authorities that signed eMudhra...

FreeBSD : p5-Starman -- multiple vulnerabilities (d8b29eb8-d2d8-11f1-97dc-40b034429ecf)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the d8b29eb8-d2d8-11f1-97dc-40b034429ecf advisory. Starman project reports: SECURITY Tenable has extracted the preceding description block direct...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: xorg-x11-server-Xwayland (UTSA-2026-147009)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-147009 advisory. A flaw was found in the X.Org X server. This use-after-free vulnerability occurs in the XSYNC fence triggering logic, specifically within the miSyncTriggerFence...

AlmaLinux 9.2 [TuxCare] Security Update: cjose / cjose-devel (ALMALINUX9.2:CLSA-2026:1793287693)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1793287693 advisory. - OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption JOSE. In versions 0.6.1 through 0.6.2.5, when cjose...

Linux Distros Unpatched Vulnerability : CVE-2026-118261

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in Decompress middleware exposes a gzip-decoded request stream without limiting its expanded...

RockyLinux 9 : java-25-openjdk (RLSA-2026:88347)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:88347 advisory. JDK: Enhance PKCS5 padding CVE-2026-83374 JDK: Enhance TLS certificate handling CVE-2026-83376 JDK: Improve C2 loop transformations CVE-2026-83378 JDK:...

RHEL 9 : firefox (RHSA-2026:92335)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:92335 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fixes: firefox:...

ArubaOS 10.4.x < 10.4.1.14 / 10.7.x < 10.7.2.7 / 10.8.x < 10.8.1.2 Multiple Vulnerabilities (HPESBNW05162)

The version of ArubaOS AOS-10 installed on the remote host is affected by multiple vulnerabilities as referenced in the HPESBNW05162 advisory: - Buffer overflow vulnerabilities in the affected interface of AOS-10 could lead to unauthenticated remote code execution by sending specially crafted...

MiracleLinux 8 : libX11-1.6.8-10.el8_10 (AXSA:2026-2204:02)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-2204:02 advisory. libX11: libX11: Heap-based buffer overflow via malicious X server CVE-2026-88806 Tenable has extracted the preceding description block directly from the...

FreeBSD : p5-HTTP-Body -- multiple vulnerabilities (005c73c2-d2d1-11f1-97dc-40b034429ecf)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 005c73c2-d2d1-11f1-97dc-40b034429ecf advisory. HTTP-Body oroject reports: Multiple security issues: Tenable has extracted the preceding...