RHEL 8 : brotli (RHSA-2026:90891)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:90891 advisory. Brotli is a generic-purpose lossless compression algorithm that compresses data using a combination of a modern variant of the LZ77 algorithm, Huffm...

Alibaba Cloud Linux 3 : 0328: golang (ALINUX3-SA-2026:0328)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2026:0328 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-111943: On most platforms, Go use...

RHEL 8 : libXi (RHSA-2026:91268)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:91268 advisory. X.Org X11 libXi runtime library Security Fixes: libXi: libXi: Denial of Service via out-of-bounds read in XI2 class parser CVE-2026-93543 For more...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mongo-c-driver (UTSA-2026-146973)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146973 advisory. A size check in the client-side authentication path of the MongoDB C Driver can wrap around, so an unusually large user-name value is accepted and copied past the en...

Oracle Linux 9 : libXi (ELSA-2026-91056)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-91056 advisory. 1.7.10-8.1 - CVE fix for CVE-2026-93541, CVE-2026-93542, CVE-2026-93543 Resolves: RHEL-270061 Tenable has extracted the preceding description block directly fr...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mongo-c-driver (UTSA-2026-146972)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146972 advisory. A double free in the OpenSSL-based TLS certificate revocation checking path of the MongoDB C Driver can be reached by a TLS endpoint that the client already trusts...

RHEL 8 : rhc (RHSA-2026:90725)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:90725 advisory. rhc is a client tool and daemon that connects the system to Red Hat hosted services enabling system and subscription management. Security...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: OpenEXR (UTSA-2026-147024)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-147024 advisory. OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions before 3.2.11, 3.3.0 through...

CentOS Linux 8.5 [TuxCare] Security Update: bzip2 / bzip2-devel / bzip2-libs / bzip2-static (CENTOS8.5:CLSA-2026:1793292297)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2026:1793292297 advisory. - bzip2 contains an offbyone error in the bzip2recover utility. When processing a specially crafted file, the application performs an...

Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-3335)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3335 advisory. In the Linux kernel, the following vulnerability has been resolved: bpf: Fix UAF in sock clone early bailouts CVE-2026-68399 In the Linux kernel, the following vulnerability has been resolved:...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: util-linux (UTSA-2026-146982)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146982 advisory. util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy mount2 path is used...

Linux Distros Unpatched Vulnerability : CVE-2026-118688

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wasmtime-wasi in Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 re-appends a trailing slash to rename source paths, causing renameat on...

Linux Distros Unpatched Vulnerability : CVE-2026-103506

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authenticated user in Grafana can read SSO client secrets and modify instance-wide SSO settings without the required permissions missing authorization. This...

RHEL 9 : ignition (RHSA-2026:90514)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:90514 advisory. Ignition is a utility used to manipulate systems during the initramfs. This includes partitioning disks, formatting partitions, writing files regula...

Linux Distros Unpatched Vulnerability : CVE-2026-118650

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, a globally mounted middleware.Static instance can interpret an encoded request path differently from Echo...

Linux Distros Unpatched Vulnerability : CVE-2026-7180

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. Note that Nessus relies on the presence of the package as reported by the vendor. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description...

MiracleLinux 8 : libXtst-1.2.3-8.el8_10 (AXSA:2026-2201:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-2201:01 advisory. libXtst: libXtst: Denial of Service via out-of-bounds read in RECORD reply parser CVE-2026-94286 Tenable has extracted the preceding description block direct...

RockyLinux 8 : pki-deps:10.6 (RLSA-2026:90909)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:90909 advisory. com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing...

Rocky Linux 9.6 [TuxCare] Security Update: wireshark / wireshark-cli / wireshark-devel Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1793272959)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793272959 advisory. - RRC protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service CVE-2026-76880 - ESS protocol...

RockyLinux 8 : brotli (RLSA-2026:90501)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:90501 advisory. brotli: Out-of-Bounds Write in Google Brotli Decoder CVE-2026-111497 Tenable has extracted the preceding description block directly from the RockyLinux security...

Alibaba Cloud Linux 3 : 0324: ghostscript (ALINUX3-SA-2026:0324)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2026:0324 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-101258: A flaw was found in...

MiracleLinux 8 : xorg-x11-server-1.20.11-28.el8_10.5 (AXSA:2026-2200:20)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2200:20 advisory. xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling CVE-2026-93516 xorg-x11-server:...

Linux Distros Unpatched Vulnerability : CVE-2026-118653

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Echo is a Go web framework. From 4.0.0 until 5.1.0, Context.RealIP falls back to client-supplied X-Forwarded-For or X-Real-IP values when Echo.IPExtractor is...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2026-3336)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3336 advisory. In the Linux kernel, the following vulnerability has been resolved: sctp: close UDP tunnel sockets during netns teardown CVE-2026-68161 In the Linux kernel, the following vulnerability has bee...

RHEL 10 : python-tornado (RHSA-2026:91583)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:91583 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic...

Linux Distros Unpatched Vulnerability : CVE-2026-105031

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When using the OpenSSL TLS implementation, both the pnssldomainsettrustedcadb & pntlsconfigsettrustedcerts APIs added to rather than replaced the default system...

RHEL 8 : thunderbird (RHSA-2026:90913)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:90913 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Sandbox escape due to incorrect bounda...

RHCOS 4 : OpenShift Container Platform 4.12.102 (RHSA-2026:90271)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:90271 advisory. - openstack-ironic: Prevent rehoming resources to nodes with different owner CVE-2026-44918 - crypto/x509: golang: crypto/x509:...

Linux Distros Unpatched Vulnerability : CVE-2026-110952

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A Kafka broker that authenticates clients with SASL/OAUTHBEARER using the bundled JWKS-backed validator always verifies the JWT signature, but two further chec...

Rocky Linux 9.6 [TuxCare] Security Update: 389-ds-base / 389-ds-base-devel / 389-ds-base-libs / etc (ALMALINUX9.6:CLSA-2026:1793270033)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793270033 advisory. - A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes of an...

Oracle Linux 9 : libXtst (ELSA-2026-91223)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-91223 advisory. 1.2.3-16.1 - CVE-2026-94286 libXtst: libXtst: Denial of Service via out-of-bounds read in RECORD reply parser read in RECORD reply parser Resolves: RHEL-271689...

Oracle Linux 9 : webkit2gtk3 (ELSA-2026-91580)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-91580 advisory. 2.54.2-0.1 - Update to 2.54.2 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus...

RHEL 10 : ignition (RHSA-2026:90513)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:90513 advisory. Ignition is a utility used to manipulate systems during the initramfs. This includes partitioning disks, formatting partitions, writing files regul...

AlmaLinux 9.2 [TuxCare] Security Update: libX11 / libX11-common / libX11-devel / libX11-xcb (ALMALINUX9.2:CLSA-2026:1793283834)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1793283834 advisory. - A malicious X server could exploit a buffer overflow in libX11 before 1.8.14 during handling of XkbGetMap overflowing the keysymmap...

Oracle Linux 8 : expat (ELSA-2026-92323)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-92323 advisory. - CVE-2026-102633 expat: expat: Denial of Service via integer overflow in expatrealloc - CVE-2026-77214 expat: expat: Information disclosure via heap...

Oracle Coherence (October 2026 CPU)

The 12.2.1.4.0 and 14.1.1.0.0 versions of Coherence installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2026 CPU advisory. - Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware component: Centralized Thirdparty Jars jline...

MiracleLinux 8 : libXi-1.7.10-2.el8_10 (AXSA:2026-2198:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-2198:01 advisory. libXi: libXi: Denial of Service via out-of-bounds read in XI2 class parser CVE-2026-93543 Tenable has extracted the preceding description block directly from...

Debian dla-4867 : tzdata - security update

The remote Debian 12 host has a package installed that is affected by a vulnerability as referenced in the dla-4867 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4867-1 [email protected] https://www.debian.org/lts/security/...

Amazon Linux 2023 : libnvidia-nscq (ALAS2023NVIDIA-2026-318)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023NVIDIA-2026-318 advisory. NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where permissions on read-only memory might not be preserved. A successful exploit of this...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: OpenEXR (UTSA-2026-147014)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-147014 advisory. OpenEXR is the reference implementation and specification for the EXR image file format, widely used in the motion picture industry. In versions through 3.2.10, 3.3....

RHEL 10 : Red Hat JBoss Enterprise Application Platform 8.1.9 (RHSA-2026:92059)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:92059 advisory. Red Hat JBoss Enterprise Application Platform 8 is a platform for Java applications based on the WildFly application runtime. This release...

RHEL 9 : brotli (RHSA-2026:90890)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:90890 advisory. Brotli is a generic-purpose lossless compression algorithm that compresses data using a combination of a modern variant of the LZ77 algorithm, Huffm...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: xorg-x11-server-Xwayland (UTSA-2026-147006)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-147006 advisory. A flaw was found in the Big Requests extension. The request length is multiplied by 4 before checking against the maximum allowed size, potentially causing an intege...

RHEL 9 : flatpak (RHSA-2026:90364)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:90364 advisory. Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Security Fixes: flatpak: Flatpak:...

Linux Distros Unpatched Vulnerability : CVE-2026-110985

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A Kafka broker using SASL/OAUTHBEARER with the default validator sasl.oauthbearer.jwt.validator.class=DefaultJwtValidator selects its implementation from...

RHEL 8 / 9 : Red Hat Service Interconnect 2.2.4 Release (rpms) (Important) (RHSA-2026:91329)

The remote Redhat Enterprise Linux 8 / 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:91329 advisory. Red Hat Service Interconnect 2.2 creates a service network, linking TCP and HTTP services across the hybrid cloud. A service network enables...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: xorg-x11-server-Xwayland (UTSA-2026-147041)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-147041 advisory. A flaw was found in the RandR extension, where the RRChangeProviderProperty function does not properly validate input. This issue leads to an integer overflow when...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mongo-c-driver (UTSA-2026-146965)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146965 advisory. A memory-handling error in the BSON-to-JSON conversion helpers of the MongoDB C Driver can write a small number of bytes past the end of a heap buffer when a binary...

Linux Distros Unpatched Vulnerability : CVE-2026-118265

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's ExtractIPFromRealIPHeader validates whether the client-supplied X-Real-IP value belongs to a trust...

Linux Distros Unpatched Vulnerability : CVE-2026-118581

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A BSON encoding component of the MongoDB Java Driver does not verify that an externally supplied raw document's self-declared length agrees with the extent of t...