RHEL 6 : kernel (RHSA-2026:90933)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:90933 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: ipv4: validate checksumstart before...

Linux Distros Unpatched Vulnerability : CVE-2026-18410

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. Note that Nessus relies on the presence of the package as reported by the vendor. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description...

AlmaLinux 9.6 [TuxCare] Security Update: 389-ds-base / 389-ds-base-devel / 389-ds-base-libs / etc (ALMALINUX9.6:CLSA-2026:1793296709)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793296709 advisory. - A flaw was found in 389-ds-base. The server does not discard plaintext bytes already buffered from a client connection when negotiating...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mongo-c-driver (UTSA-2026-146969)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146969 advisory. An incorrect calculation in Decimal128 string parsing in the MongoDB C Driver can accept certain over- precision inputs containing leading zeros instead of rejecting...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mongo-c-driver (UTSA-2026-146984)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146984 advisory. A missing lower-bound validation in the bsonnewfrombuffer function of libbson allows an integer underflow when processing BSON data with a zero-length prefix. The...

Linux Distros Unpatched Vulnerability : CVE-2026-114349

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When a broker decodes a compressed record batch, the per-record decoder reads a declared body size from the decompressed stream and allocates a buffer of that...

MiracleLinux 9 : firefox-153.5.0-1.el9_8.ML.1 (AXSA:2026-2196:29)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2196:29 advisory. libexpat: denial of service via crafted XML input CVE-2026-45186 firefox: thunderbird: Privilege escalation in the Application Update component...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: xorg-x11-server-Xwayland (UTSA-2026-146998)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146998 advisory. A flaw was found in X.Org server. In the XISendDeviceHierarchyEvent function, it is possible to exceed the allocated array length when certain new device IDs are add...

RockyLinux 10 : libXtst (RLSA-2026:91612)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:91612 advisory. libXtst: libXtst: Denial of Service via out-of-bounds read in RECORD reply parser CVE-2026-94286 Tenable has extracted the preceding description block directly...

Oracle Linux 8 : python3.12-urllib3 (ELSA-2026-92474)

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-92474 advisory. - CVE-2026-97689 Denial of Service via unbounded memory allocation in chunk parser Resolves: RHEL-282256 Tenable has extracted the preceding descripti...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: xorg-x11-server-Xwayland (UTSA-2026-147003)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-147003 advisory. A use-after-free flaw was found in the X.Org X server and Xwayland in FreeCounter. A client that sets up multiple SyncCounters and awaits on those triggers can trigg...

RockyLinux 10 : libXrender (RLSA-2026:91003)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:91003 advisory. libXrender: libXrender: Code injection via heap overflow in RenderQueryPictFormats CVE-2026-88807 Tenable has extracted the preceding description block directly...

CentOS Linux 7 [TuxCare] Security Update: wpa_supplicant (CENTOS7:CLSA-2026:1793031651)

The CentOS Linux 7 host has a package installed that is affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1793031651 advisory. - An issue in wpasupplicant all versions before v.2.12 allows a local attacker to bypass proper network context and AKMP matching for PMKSA cachi...

RHEL 9 : buildah (RHSA-2026:90424)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:90424 advisory. The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a...

AlmaLinux 9.2 [TuxCare] Security Update: perl-Net-DNS / perl-Net-DNS-Nameserver (ALMALINUX9.2:CLSA-2026:1793304699)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1793304699 advisory. - Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sigdata when re-encoding a message with a misplac...

Oracle Linux 9 : cjose (ELSA-2026-92145)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-92145 advisory. 0.6.1-17.2 - CVE-2026-53939 cjose: OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption Encryption Key for AES-CBC-HMAC JWE...

Alibaba Cloud Linux 3 : 0325: libpcap (ALINUX3-SA-2026:0325)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2026:0325 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-0799: In BPF instructions that load/store ...

AlmaLinux 9.6 [TuxCare] Security Update: dovecot / dovecot-devel / dovecot-mysql / dovecot-pgsql / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1793307649)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793307649 advisory. - An attacker that can send mail to a user can craft a message whose headers contain a very large number of email addresses or MIME...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: libreoffice (UTSA-2026-146993)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146993 advisory. LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing a stream object. The length of the stream was taken from the object's own...

Linux Distros Unpatched Vulnerability : CVE-2026-93008

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in dnsmasq. When following a CNAME in a DNS response, the resolver can cache records for the CNAME target without checking that those records...

Linux Distros Unpatched Vulnerability : CVE-2026-118681

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - go-chi chi before 5.5.0 contains an authentication bypass in middleware.SupressNotFound, which calls Match with the live routing context and leaves a mounted...

Linux Distros Unpatched Vulnerability : CVE-2026-116738

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - VMime through 0.9.2 contains an integer underflow in the uuEncoder::decode function that allows remote attackers to trigger a stack-based buffer overflow via...

AlmaLinux 9.6 [TuxCare] Security Update: webkit2gtk3 / webkit2gtk3-devel / webkit2gtk3-jsc / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1793285499)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793285499 advisory. - Heap buffer overflow in ANGLE in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap...

Rocky Linux 9.6 [TuxCare] Security Update: webkit2gtk3 / webkit2gtk3-devel / webkit2gtk3-jsc / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1793285499)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793285499 advisory. - Heap buffer overflow in ANGLE in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap...

Linux Distros Unpatched Vulnerability : CVE-2026-110985

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A Kafka broker using SASL/OAUTHBEARER with the default validator sasl.oauthbearer.jwt.validator.class=DefaultJwtValidator selects its implementation from...

Linux Distros Unpatched Vulnerability : CVE-2026-118653

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Echo is a Go web framework. From 4.0.0 until 5.1.0, Context.RealIP falls back to client-supplied X-Forwarded-For or X-Real-IP values when Echo.IPExtractor is...

Linux Distros Unpatched Vulnerability : CVE-2026-118339

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Animation in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML...

Linux Distros Unpatched Vulnerability : CVE-2026-99106

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amdgpu: free the userptr ranges when a CS fails after parserbos amdgpucsparserbos allocates an HMM range for every userptr entry of the BO list and looks up...

Linux Distros Unpatched Vulnerability : CVE-2026-118010

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 159 and Thunderbird 159. CVE-2026-118010 Note that Nessus relies...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-146688)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146688 advisory. In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in rtwrestructwmmie rtwrestructwmmie scans inie for a WMM IE...

Linux Distros Unpatched Vulnerability : CVE-2026-117980

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. CVE-2026-11798...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-146623)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146623 advisory. In the Linux kernel, the following vulnerability has been resolved: dm array: validate array block headers on read arrayblockcheck validates blocknr and csum and...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-146648)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146648 advisory. In the Linux kernel, the following vulnerability has been resolved: drm: fix race between partial drmdevregister failure and ioctl If drmdevregister fails after...

Linux Distros Unpatched Vulnerability : CVE-2026-117500

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HTTP::Body versions before 1.2401 for Perl allow CPU exhaustion via regex backtracking on the filename of a multipart upload. For every file part, the multipart...

Linux Distros Unpatched Vulnerability : CVE-2026-117865

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6...

Linux Distros Unpatched Vulnerability : CVE-2026-116840

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - llama.cpp b5854 before b11275 contains an integer overflow vulnerability in ggufinitfromreader that bypasses the CVE-2025-53630 size check when padding...

Linux Distros Unpatched Vulnerability : CVE-2026-118341

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Modularization in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HT...

Linux Distros Unpatched Vulnerability : CVE-2026-118333

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Buffer overflow in Video in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-118344

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Layout in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-57196

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11...

Rocky Linux 8 [CIQ] Security Update: bpftool / bpftool-debuginfo / kernel / kernel-abi-stablelists / etc (crlsa-2026_89816)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202689816 advisory. kernel: KVM: s390: pci: Reject adapter interrupt forwarding if already enabled CVE-2026-74515 Tenable has extracted the preceding description block directly from t...

Linux Distros Unpatched Vulnerability : CVE-2026-118384

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GNU mtools before 4.0.50 has an out-of-bounds write in parsevses in vfat.c. CVE-2026-118384 Note that Nessus relies on the presence of the package as reported b...

Linux Distros Unpatched Vulnerability : CVE-2026-116135

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HTTP::Body versions before 1.2301 for Perl drop mixed-case percent escapes from urlencoded form fields instead of decoding them. The decode table holds only the...

Linux Distros Unpatched Vulnerability : CVE-2026-116730

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Furnace through 0.6.8.3 contains an out-of-bounds heap read vulnerability in DivEngine::loadFTM in src/engine/fileOps/ftm.cpp, triggered by an unbounded DPCM no...

Linux Distros Unpatched Vulnerability : CVE-2026-117920

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6...

Rocky Linux 10.2 [CIQ] Security Update: skopeo / skopeo-debuginfo / skopeo-debugsource / skopeo-tests Multiple Vulnerabilities (crlsa-2026_89761)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202689761 advisory. podman: Arbitrary file write when importing OCI archive CVE-2025-11395 net/http: golang: golang: Denial of Service via crafted HTTP Range headers...

Linux Distros Unpatched Vulnerability : CVE-2026-99124

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - s390/pci: Fix leak of uninitialized kernel data in SCLP report While reporterrorwrite checks that the provided buffer is at least as large as the header struct,...

Linux Distros Unpatched Vulnerability : CVE-2026-116727

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gbsplay through 0.0.103 contains a heap out-of-bounds read vulnerability in vgmopen in gbs.c that walks the VGM command stream without bounds checks. Attackers...

Linux Distros Unpatched Vulnerability : CVE-2026-118348

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Integer overflow in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a craft...

Linux Distros Unpatched Vulnerability : CVE-2026-118351

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page...