FreeBSD : PowerDNS Authoritative Server -- Denial of Service vulnerability (eb135656-db92-11f1-83b3-3c7c3fba4204)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the eb135656-db92-11f1-83b3-3c7c3fba4204 advisory. PowerDNS Team reports: CVE ID: CVE-2026-73206A malicious server can send a crafted reply that leads to...

Linux Distros Unpatched Vulnerability : CVE-2026-123597

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Hickory DNS hickory-proto 0.25.0-alpha.1 through 0.26.0-alpha.1 and hickory-net before 0.26.2 contain a logic bug in DnssecDnsHandle's DS-fetch path that caches...

CentOS Linux 7 [TuxCare] Security Update: giflib / giflib-devel / giflib-utils (CENTOS7:CLSA-2026:1793710801)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1793710801 advisory. - Giflib contains a double-free vulnerability that is the result of a shallow copy in GifMakeSavedImage and incorrect error handling. The...

Fedora 44 : copyparty (2026-4d013a5c67)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-4d013a5c67 advisory. New upstream release. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for...

Fedora 45 : mingw-qt5-qtdeclarative (2026-587a1cec32)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-587a1cec32 advisory. Backport fix for CVE-2025-12385. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

Linux Distros Unpatched Vulnerability : CVE-2026-123580

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 perform insufficient checks on NSEC3 record names during DNSSEC...

SUSE SLED15 / SLES15 Security Update : python-certifi (SUSE-SU-2026:5130-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:5130-1 advisory. - CVE-2024-39689: remove root certificates from GLOBALTRUST from the root store bsc1227519. - Removed eMudhra...

Linux Distros Unpatched Vulnerability : CVE-2026-123588

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The recursive resolver in Hickory DNS all versions of the hickory-recursor crate, and hickory-resolver 0.26.0 before 0.26.2 caches an empty connection pool when...

Unity Linux 20.1070e Security Update: firefox (UTSA-2026-151013)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-151013 advisory. Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41,...

Unity Linux 20.1070e Security Update: firefox (UTSA-2026-151011)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-151011 advisory. Unity Link Advisory UTSA-2026-151011 Tenable has extracted the preceding description block directly from the Unity Linux security advisory. Note that Nessus has not...

Unity Linux 20.1070e Security Update: glibc (UTSA-2026-151009)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-151009 advisory. The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS server returns too large a response for a DNS query,...

Unity Linux 20.1070e Security Update: 389-ds-base (UTSA-2026-150984)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150984 advisory. A flaw was found in 389 Directory Server in the aclpnormalizeacltxt function of aclparse.c. A malformed ACI Access Control Instruction string can trigger...

Amazon Linux 2 : kernel (ALAS-2026-4082)

The version of kernel installed on the remote host is prior to 4.14.355-287.768. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-4082 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix order of kfreercu and...

TencentOS Server 4: python-pyasn1 (TSSA-2026:1349)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1349 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

Amazon Linux 2 : freerdp (ALAS-2026-4087)

The version of freerdp installed on the remote host is prior to 2.11.7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4087 advisory. FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the client video redirection channel that allo...

Amazon Linux 2 : python-twisted-words (ALAS-2026-4074)

The version of python-twisted-words installed on the remote host is prior to 12.2.0-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4074 advisory. A flaw was found in Twisted. An unauthenticated remote attacker can cause a Denial of Service DoS by...

AlmaLinux 8 : util-linux (ALSA-2026:96212)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:96212 advisory. util-linux: util-linux: heap use-after-free in libblkid nested partition probing CVE-2026-13595 util-linux: TOCTOU in the mount program via ancestor...

AlmaLinux 9 : ruby:3.3 (ALSA-2026:96068)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:96068 advisory. ruby: double free issue in regular expression parser CVE-2026-89078 ruby: integer overflow issue in regular expression compiler CVE-2026-93577 ruby:...

Amazon Linux 2023 : guava, guava-javadoc, guava-testlib (ALAS2023-2026-3419)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3419 advisory. Allocation of resources without limits or throttling CWE-770 during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via...

AlmaLinux 9.6 [TuxCare] Security Update: cups / cups-client / cups-devel / cups-filesystem / cups-ipptool / etc (ALMALINUX9.6:CLSA-2026:1794244575)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1794244575 advisory. - OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the backend/ipp.c...

AlmaLinux 9.6 [TuxCare] Security Update: netpbm / netpbm-devel / netpbm-doc / netpbm-progs Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1794238162)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1794238162 advisory. - Netpbm before 10.86.51, 11.02.30, and 11.15.08 contains an integer overflow vulnerability in winicontopam that allows attackers to...

CentOS Linux 8.4 [TuxCare] Security Update: cups / cups-client / cups-devel / cups-filesystem / cups-ipptool / etc (CENTOS8.4:CLSA-2026:1794243365)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1794243365 advisory. - OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the backend/ipp.c...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: bouncycastle (UTSA-2026-150764)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150764 advisory. Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator, specifically RSA Key Pairs...

CentOS Linux 8.5 [TuxCare] Security Update: cups / cups-client / cups-devel / cups-filesystem / cups-ipptool / etc (CENTOS8.5:CLSA-2026:1794243685)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2026:1794243685 advisory. - OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the backend/ipp.c...

Oracle Linux 10 : ruby4.0 (ELSA-2026-96233)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-96233 advisory. - Fix: integer overflow issue in regular expression compiler CVE-2026-110264 Resolves: RHEL-292062 - Fix: integer overflow issue in CI/CD regular...

Amazon Linux 2023 : python3-virtualenv (ALAS2023-2026-3409)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3409 advisory. virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the stdlib venv creator reads generated pyvenv.cfg with str.splitlines and merges parsed keys over...

Amazon Linux 2023 : jackson-core (ALAS2023-2026-3383)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3383 advisory. StreamReadConstraints.maxNameLength default 50,000 characters is intended to bound how much memory a single JSON Object property name can consume while being parsed, independently of the much larger...

Unity Linux 20.1070e Security Update: firefox (UTSA-2026-150955)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150955 advisory. Denial-of-service in the Security component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156. Tenable has extracted the preceding...

Amazon Linux 2 : perl-DBI (ALAS-2026-4077)

The version of perl-DBI installed on the remote host is prior to 1.627-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4077 advisory. DBI versions before 1.656 for Perl crash via type confusion in dbiprofile when a database handle is destroyed under a...

Amazon Linux 2023 : librsvg2, librsvg2-devel, librsvg2-tools (ALAS2023-2026-3392)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3392 advisory. A flaw was found in librsvg. When processing an SVG document containing nested XML inclusions Xincludes with duplicate entity declarations, a use-after-free error can occur. This vulnerability arises...

Amazon Linux 2023 : cargo, clippy, rust (ALAS2023-2026-3380)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3380 advisory. gitoxide gix-packetline versions before 0.21.5 contain a panic vulnerability in the TextRef implementation that occurs when processing side-band packet lines with empty payloads. A malicious Git server...

Amazon Linux 2023 : runfinch-finch (ALAS2023-2026-3395)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3395 advisory. go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON parsing and serialization due to unbounded recursion with no depth limit. Remote unauthenticated attacker...

CentOS Linux 8 [TuxCare] Security Update: cups / cups-client / cups-devel / cups-filesystem / cups-ipptool / etc (CENTOS-STREAM8:CLSA-2026:1794243344)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1794243344 advisory. - OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the backend/ipp.c...

Amazon Linux 2023 : python3-mistune (ALAS2023-2026-3386)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3386 advisory. Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parselinktext that allows remote attackers to cause denial of service through unbalanced square brackets...

Amazon Linux 2023 : jackson-databind (ALAS2023-2026-3387)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3387 advisory. PolymorphicTypeValidator bypass via generic type arguments and array element types in jackson-databind allows arbitrary class instantiation incomplete fix for CVE-2026-54512 CVE-2026-110879...

Amazon Linux 2023 : xdg-desktop-portal, xdg-desktop-portal-devel (ALAS2023-2026-3384)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3384 advisory. XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileChooser.SaveFiles method to gain arbitrary file access to...

TencentOS Server 3: gimp:2.8 (TSSA-2026:1390)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1390 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

AlmaLinux 10 : ruby4.0 (ALSA-2026:96233)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:96233 advisory. ruby: integer overflow issue in regular expression compiler CVE-2026-93577 ruby: integer overflow issue in CI/CD regular expression compiler...

Amazon Linux 2023 : gnome-remote-desktop (ALAS2023-2026-3393)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3393 advisory. A denial-of-service flaw was found in gnome-remote-desktop. An unauthenticated remote attacker can open RDP connections without completing the handshake and retain the connection-throttling slots...

Fedora 43 : mingw-qt5-qtdeclarative (2026-29e4b8a289)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-29e4b8a289 advisory. Backport fix for CVE-2025-12385. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

Linux Distros Unpatched Vulnerability : CVE-2026-123575

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Hickory DNS before 0.26.2 contains a resource exhaustion vulnerability in its DNS-over-HTTPS HTTP/2 server that lacks sufficient timeouts or limits for incomple...

Linux Distros Unpatched Vulnerability : CVE-2026-123534

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Tornado before 6.6 contains a path traversal vulnerability in RequestHandler.staticurl and getversion that allows attackers to hash files outside staticpath usi...

RHEL 10 : edk2 (RHSA-2026:96240)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:96240 advisory. EDK Embedded Development Kit is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU...

Linux Distros Unpatched Vulnerability : CVE-2026-112317

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - krb5ktkdbgetentry in lib/kdb/keytab.c in MIT Kerberos 5 aka krb5 1.2.8 and later does not free decrypted key material when a post-decryption check fails, which...

Linux Distros Unpatched Vulnerability : CVE-2026-84503

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in ansible-core's ansible.builtin.git module. The module invokes git ls-remote, clone, fetch with the repository URL as a positional argument a...

Linux Distros Unpatched Vulnerability : CVE-2026-119079

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - decodesequenceof in lib/krb5/asn.1/asn1encode.c in MIT Kerberos 5 aka krb5 1.11 and later grows the decoded element array one entry at a time, which allows remo...

Linux Distros Unpatched Vulnerability : CVE-2026-120304

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - mimedefang - None CVE-2026-120304 Note that Nessus relies on the presence of the package as reported by the vendor. %NASLMINLEVEL 80900 C Tenable...

Linux Distros Unpatched Vulnerability : CVE-2026-119610

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in GStreamer's gst-plugins-good, specifically in the H.264 RTP depayloader element. When processing MTAP16 or MTAP24 multi-time aggregation RTP...

Linux Distros Unpatched Vulnerability : CVE-2026-120211

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - mimedefang - None CVE-2026-120211 Note that Nessus relies on the presence of the package as reported by the vendor. %NASLMINLEVEL 80900 C Tenable...

Linux Distros Unpatched Vulnerability : CVE-2026-112320

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The GSS-RPC transport layer in MIT Kerberos 5 aka krb5 1.4 and later does not release the previous authentication context when a client switches from an RPCSECG...