Rocky Linux 9 [CIQ] Security Update: pki-jackson-databind (crlsa-2026_98492)

The Rocky Linux 9 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-202698492 advisory. com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion...

RHEL 10 : gstreamer1 (RHSA-2026:99129)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:99129 advisory. The gstreamer1 packages contain a streaming media framework, based on graphs of filters which operate on media data. Security Fixes: gstreamer:...

RHEL 9 : oci-seccomp-bpf-hook (RHSA-2026:99169)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:99169 advisory. OCI Hook to generate seccomp json files based on EBF syscalls used by container oci-seccomp-bpf-hook provides a library for applications...

RHEL 9 : squid (RHSA-2026:99124)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:99124 advisory. Squid is a high-performance proxy caching server for web clients, supporting FTP, and HTTP data objects. Security Fixes: squid: squid: Request...

SUSE SLES15: proftpd / proftpd-devel / proftpd-doc / proftpd-lang / proftpd-ldap / etc (SUSE-SU-2026:5181-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:5181-1 advisory. - Authenticated SFTP sessions can overflow the SFTP packet buffer bsc1271096. - CVE-2026-35025: access control bypass allows...

RHEL 9 : gnome-remote-desktop (RHSA-2026:99136)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:99136 advisory. GNOME Remote Desktop is a remote desktop and screen sharing service for the GNOME desktop environment. Security Fixes: gnome-remote-desktop...

RHEL 9 : gimp (RHSA-2026:99154)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:99154 advisory. The GIMP GNU Image Manipulation Program is an image composition and editing program. GIMP provides a large image manipulation toolbox, including...

SUSE SLES15 Security Update : SDL2_image (SUSE-SU-2026:5158-1)

The remote SUSE Linux SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:5158-1 advisory. This update for SDL2image fixes the following issue: - CVE-2026-117557: denial of service via crafted ILBM image file bsc1289031. Tenable has extracted...

Linux Distros Unpatched Vulnerability : CVE-2026-123865

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An unauthenticated HTTP/2 client can permanently leak Node.js server memory and file descriptors. If a peer triggers a protocol error, for example an oversized...

Linux Distros Unpatched Vulnerability : CVE-2026-123828

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A one-byte heap buffer overflow in Node.js HTTP/2 Alt-Svc handling lets a remote, unauthenticated attacker corrupt process memory. When an application passes an...

Rocky Linux 9 [CIQ] Security Update: dpdk / dpdk-debuginfo / dpdk-debugsource / dpdk-devel / dpdk-doc / etc Multiple Vulnerabilities (crlsa-2026_98505)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202698505 advisory. dpdk: dpdk: Missing memory size validation before mmap in vhost memory region setup CVE-2026-86561 dpdk: dpdk: Control-queue descriptor double-fetch...

Linux Distros Unpatched Vulnerability : CVE-2026-123874

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A use-after-free in Node.js HTTP/2 lets an unauthenticated client corrupt server memory, over both TLS and cleartext, when the server serves files with...

SUSE SLES15 Security Update : openssl-1_1-livepatches (SUSE-SU-2026:5208-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2026:5208-1 advisory. This update for openssl-11-livepatches fixes the following issue: - CVE-2026-84782: DTLS Retransmits Handshake Messages From a Stale Buffer Offset...

Rocky Linux 9 [CIQ] Security Update: nodejs-nodemon / nodejs-packaging / nodejs-packaging-bundler Multiple Vulnerabilities (crlsa-2026_97855)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202697855 advisory. nodejs: Node.js: Permission Model bypass via process.report.writeReport path misvalidation CVE-2026-48617 nodejs: Node.js HTTP Agent: Information disclosu...

SUSE SLED15 / SLES15 Security Update : python-M2Crypto (SUSE-SU-2026:5204-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:5204-1 advisory. This update for python-M2Crypto fixes the following issue: - CVE-2026-109087: SSL.Checker subjectAltName hostname...

Debian dla-4894 : python3-watcher - security update

The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dla-4894 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4894-1 [email protected] https://www.debian.org/lts/security/...

Rocky Linux 9 [CIQ] Security Update: tesseract / tesseract-debuginfo / tesseract-debugsource / etc Multiple Vulnerabilities (crlsa-2026_98514)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202698514 advisory. tesseract: Tesseract: Heap out-of-bounds write/read leading to information disclosure via crafted data CVE-2026-88048 tesseract: Tesseract: Stack buffer...

RHEL 10 : perl-CGI (RHSA-2026:99212)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:99212 advisory. CGI.pm is a stable, complete and mature solution for processing and preparing HTTP requests and responses. Major features including...

SUSE SLES15 Security Update : openssl-1_1-livepatches (SUSE-SU-2026:5198-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2026:5198-1 advisory. This update for openssl-11-livepatches fixes the following issue: - CVE-2026-84782: DTLS Retransmits Handshake Messages From a Stale Buffer Offset...

openSUSE 16 Security Update : python-graphql-core (openSUSE-SU-2026:22258-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22258-1 advisory. Changes in python-graphql-core: - CVE-2026-75507: Fix quadratic complexity in OverlappingFieldsCanBeMerged validation rule when comparing nested...

Debian dla-4892 : python3-dnspython - security update

The remote Debian 12 host has a package installed that is affected by a vulnerability as referenced in the dla-4892 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4892-1 [email protected] https://www.debian.org/lts/security/...

Linux Distros Unpatched Vulnerability : CVE-2026-123868

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An unauthenticated HTTP/2 client can exhaust Node.js server memory because inbound DATA queued on an undrained stream is charged to no session budget. Each...

Google Chrome < 156.0.8078.100 Vulnerability

The version of Google Chrome installed on the remote Windows host is prior to 156.0.8078.100. It is, therefore, affected by a vulnerability as referenced in the 202611extended-stable-update-for-desktop01570615041 advisory. Note that Nessus has not tested for this issue but has instead relied only...

openSUSE 16 Security Update : python-urllib3_1 (openSUSE-SU-2026:22252-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22252-1 advisory. - CVE-2026-97687: traffic interception due to possible HTTPS proxy TLS configuration override bsc1283908. - CVE-2026-97688: denial of service du...

SUSE SLES15: xen / xen-devel / xen-libs / xen-tools / xen-tools-domU / etc (SUSE-SU-2026:5159-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:5159-1 advisory. This update for xen fixes the following issue: - CVE-2026-102703,CVE-2026-102704: arbitrary read/write via grant copy bsc1288663...

SUSE SLES15 Security Update : aliyun-cli (SUSE-SU-2026:5195-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:5195-1 advisory. - CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict allows an attacker to bypass repeat index...

RHEL 10 : gstreamer1-plugins-good (RHSA-2026:99140)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:99140 advisory. GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a...

SUSE SLED15 / SLES15 Security Update : libXi (SUSE-SU-2026:5165-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:5165-1 advisory. - CVE-2026-93541: Out-of-bounds read in libXi's XQueryDeviceState bsc1281605. - CVE-2026-93542: Out-of-bounds...

Rocky Linux 8 [CIQ] Security Update: nodejs-packaging / nodejs-packaging-bundler Multiple Vulnerabilities (crlsa-2026_98113)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202698113 advisory. brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns CVE-2026-102278 brace-expansion: brace-expansion:...

Rocky Linux 9 [CIQ] Security Update: xdg-dbus-proxy / xdg-dbus-proxy-debuginfo / etc (crlsa-2026_98530)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202698530 advisory. xdg-dbus-proxy: xdg-dbus-proxy: message filtering bypass via reply serial allows sandbox escape CVE-2026-94422 Tenable has extracted the preceding description bloc...

Linux Distros Unpatched Vulnerability : CVE-2026-123877

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A certificate validation bypass in Node.js https.Agent lets a cached TLS session authenticated under one CA policy be reused by a later request with a stricter...

Linux Distros Unpatched Vulnerability : CVE-2026-123862

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An uncatchable exception in the Node.js zlib streaming API lets a peer crash a process by disconnecting while data is being compressed. zlib.params queues a flu...

RHEL 9 : firefox (RHSA-2026:99110)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:99110 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fixes: firefox:...

SUSE SLES15 Security Update : distribution (SUSE-SU-2026:5202-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:5202-1 advisory. - CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST request through...

RHEL 9 : perl-DBI (RHSA-2026:99208)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:99208 advisory. The perl-DBI package provides the standard database interface module for the Perl programming language. It implements a database-independen...

Rocky Linux 9 [CIQ] Security Update: lrzsz / lrzsz-debuginfo / lrzsz-debugsource Multiple Vulnerabilities (crlsa-2026_98481)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202698481 advisory. lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode CVE-2026-105840 lrzsz: lrzsz: Arbitrary command execution via crafte...

RHEL 8 : httpd:2.4 (RHSA-2026:99514)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:99514 advisory. The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: incomplete fix...

SUSE SLED15: apache-commons-cli / aqute-bndlib / glassfish-annotation-api / etc (SUSE-SU-2026:5189-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:5189-1 advisory. apache-parent was updated to 40: Breaking changes - Replace nicoulaj checksum plugin with maveniverse checksum...

Debian dla-4893 : octavia-agent - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4893 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4893-1 [email protected]...

SUSE SLES15 Security Update : xorg-x11-server (SUSE-SU-2026:5180-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:5180-1 advisory. - CVE-2026-109091: X.Org Server EDID DSRANGES Out-Of-Bounds Write bsc1285086. - CVE-2026-109092: X.Org Server XvShmPutImage...

Rocky Linux 9 [CIQ] Security Update: librabbitmq / librabbitmq-debuginfo / librabbitmq-debugsource / etc (crlsa-2026_98467)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202698467 advisory. rabbitmq-c: rabbitmq-c: Heap buffer overflow leading to denial of service CVE-2026-44236 Tenable has extracted the preceding description block directly from the CI...

SUSE SLES16 Security Update : zchunk (SUSE-SU-2026:24657-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:24657-1 advisory. This update for zchunk fixes the following issue: - CVE-2026-117556: heap out-of-bounds read in readpreface allows attackers to cause an...

JetBrains PyCharm 2019.2.5 / 2019.3 Credential Disclosure (Windows)

According to its self-reported version, the JetBrains PyCharm installation on the remote Windows host is 2019.2.5 or 2019.3. It is, therefore, affected by a credential disclosure vulnerability. In JetBrains PyCharm 2019.2.5 and 2019.3 on Windows, Apple Notarization Service credentials were includ...

RHEL 9 : .NET 8.0 (RHSA-2026:99146)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:99146 advisory. .NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It...

SUSE SLED15 / SLES15 Security Update : tar (SUSE-SU-2026:5160-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:5160-1 advisory. - CVE-2026-18477: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape bsc1274489. -...

RHEL 9 : perl-CGI (RHSA-2026:99213)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:99213 advisory. CGI.pm is a stable, complete and mature solution for processing and preparing HTTP requests and responses. Major features including...

openSUSE 16 Security Update : rust-keylime (openSUSE-SU-2026:22249-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22249-1 advisory. This update for rust-keylime fixes the following issue: - CVE-2026-115905: zip: security control bypass via parser differential between central...

Linux Distros Unpatched Vulnerability : CVE-2026-123875

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A NULL pointer dereference in Node.js HTTP/2 lets an unauthenticated client crash the server, over both TLS and cleartext, by cancelling file downloads. When th...

SUSE SLES15 Security Update : haproxy (SUSE-SU-2026:5170-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2026:5170-1 advisory. This update for haproxy fixes the following issue: - h1-htx: report an error on a too long chunk-size line bsc1285046. Tenable has extracted the...

JetBrains PyCharm < 2026.2.4 Certificate Validation (CVE-2026-118697)

According to its self-reported version, the JetBrains PyCharm installation on the remote host is prior to 2026.2.4. It is, therefore, affected by a certificate validation vulnerability. In JetBrains PyCharm before 2026.3 and 2026.2.4, the jetbrainsd daemon trusted compromised intermediate...