SUSE SLED15: gvfs / gvfs-backend-afc / gvfs-backend-samba / gvfs-backends / etc (SUSE-SU-2026:4240-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4240-1 advisory. - CVE-2026-84267: readstring allocates buffers withouth verifying that the buffer is completely filled when...

Fedora 44 : gnatcoll (2026-11f44e3c2c)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-11f44e3c2c advisory. Patched the vulnerabilities GNATCOLL-CORE-0162 and GNATCOLL-CORE-0164 in a way that avoids interface changes. Tenable has extracted the preceding description...

IBM MQ 9.1 < 9.1.0.38 LTS / 9.2 < 9.2.0.44 LTS / 9.3 < 9.3.0.42 LTS / 9.4 < 9.4.0.26 LTS / 9.3 - 10.0.0.0 CD < 10.0.0.5 (7284895)

The version of IBM MQ Server running on the remote host is 9.1.0.0 prior to 9.1.0.38 LTS, or 9.2.0.0 prior to 9.2.0.44 LTS, or 9.3.0.0 prior to 9.3.0.42 LTS, or 9.4.0.0 prior to 9.4.0.26 LTS, or a 9.3.x / 9.4.x CD release, or 10.0.0.0. It is, therefore, affected by a vulnerability as referenced i...

Fedora 45 : freeciv (2026-6fe2310246)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-6fe2310246 advisory. 3.2.6 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for these...

Oracle Linux 8 : .NET / 10.0 (ELSA-2026-68676)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-68676 advisory. 10.0.112-1.0.1 - Add support for Oracle Linux 10.0.112-1 - Update to .NET SDK 10.0.112 and Runtime 10.0.12 - Resolves: RHEL-252315 Tenable has extract...

openSUSE 16: openai-codex / openai-codex-bash-completion / etc (openSUSE-SU-2026:21870-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21870-1 advisory. Changes in openai-codex: Update to version 0.154.0: Experimental worktree support for isolated checkouts of new or forked sessions, with browse and resu...

MiracleLinux 8 : libsoup-2.62.3-15.el8_10 (AXSA:2026-1875:13)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1875:13 advisory. libsoup: SoupWebsocketConnection: libsoup: WebSocket remote denial of service via oversized control frame protocol violation CVE-2026-15711 Tenable has...

EulerOS 2.0 SP10 : docker-engine (EulerOS-SA-2026-3688)

According to the versions of the docker-engine package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows plugins privileg...

Linux Distros Unpatched Vulnerability : CVE-2026-90122

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - clk: visconti: Make sure clkinitdata is fully initialized The clkinitdata structure contains several mutually-exclusive members for different methods to specify...

Linux Distros Unpatched Vulnerability : CVE-2026-93101

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - media: v4l2-async: Unregister sub-device if asclist is empty When my em28xx USB device that uses the i2c tvp5150 driver is disconnected, it crashes. The cause i...

Linux Distros Unpatched Vulnerability : CVE-2026-90348

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: ath10k: snoc: use memcpyfromio for MSA ramdump On WCN3990/SNOC the MSA region is mapped with devmmemremapMEMREMAPWT. On arm64 such a mapping is not...

Linux Distros Unpatched Vulnerability : CVE-2026-93104

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RDMA/rvt: Return NULL after port allocation failure rvtallocdevice deallocates the IB device when its port array cannot be allocated but then returns the pointe...

Linux Distros Unpatched Vulnerability : CVE-2026-93106

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - crashdump: release keyring reference at the correct time restoredmcryptkeystothreadkeyring gets a reference to the user keyring before restoring the saved...

Linux Distros Unpatched Vulnerability : CVE-2026-90226

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nfc: llcp: avoid userspace overflow on invalid optlen nfcllcpgetsockopt casts optval to u32 user for putuser, so the kernel always stores 4 bytes regardless of...

Linux Distros Unpatched Vulnerability : CVE-2026-90309

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RDMA/erdma: Hold CQ references when processing EQ events EQ handlers look up CQs from dev-cqxa and invoke CQ completion or error callbacks outside the xarray...

Linux Distros Unpatched Vulnerability : CVE-2026-93061

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gpu: host1x: Avoid stack over-read in debug output helpers host1xdebugoutput and host1xdebugcont used vsnprintf, which returns the length the formatted string...

Linux Distros Unpatched Vulnerability : CVE-2026-93126

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - remoteproc: qcomq6v5adsp: Fix reference leak for device node When calling ofparsephandlewithargs, the caller is responsible to call ofnodeput to release the...

Linux Distros Unpatched Vulnerability : CVE-2026-93161

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - crypto: qat - clear AES key schedule from stack qatalgxtsreversekey expands the forward XTS AES key on the stack. That schedule contains key material and can...

Linux Distros Unpatched Vulnerability : CVE-2026-93185

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ASoC: rt700-sdw: always drain jack work on remove rt700sdwremove drains jackdetectwork and jackbtncheckwork only when rt700-hwinit is true. That state bit is...

Linux Distros Unpatched Vulnerability : CVE-2026-90334

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tty: clear cdev pointer after cdevadd failure ttycdevadd drops the cdev reference when cdevadd fails, but leaves driver-cdevsindex pointing to freed memory...

Linux Distros Unpatched Vulnerability : CVE-2026-92522

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ACPI: processor: validate MADT IOAPIC entry bounds The IOAPIC hotplug lookup parses both MADT and MAT records directly. The MADT walk previously used a subtable...

Linux Distros Unpatched Vulnerability : CVE-2026-93144

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Reject writes through untrusted BTF pointers checkptrtobtfaccess lets program-type btfstructaccess callbacks validate writes before the default BTF access...

Linux Distros Unpatched Vulnerability : CVE-2026-90189

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nullblk: register configfs subsystem after creating default devices In nullinit, configfsregistersubsystem currently runs before registerblkdev, so when nullblk...

Linux Distros Unpatched Vulnerability : CVE-2026-93165

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - platform/chrome: sensorhub: Fix memory overread in ring handler maxresponse and sensornum are read from different EC commands: - maxresponse is from...

Linux Distros Unpatched Vulnerability : CVE-2026-90186

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nullblk: reject per-device queue resize for shared tag set When sharedtags is enabled, nullsetuptagset makes the device use the global tagset, whose driverdata...

Linux Distros Unpatched Vulnerability : CVE-2026-90224

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nfc: nci: fix double completion race in ncidataexchangecomplete nciclosedevice and ncirxwork can both call ncidataexchangecomplete concurrently. After commit...

Linux Distros Unpatched Vulnerability : CVE-2026-90378

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: mt76: mt792x: Fix memory leak in SDIO TX path When txprepareskb returns an error in the SDIO TX path, the skb is not freed, leading to a memory leak. This...

Linux Distros Unpatched Vulnerability : CVE-2026-93381

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Buffer overflow in PDFium in Google Chrome on on Windows prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to potentially execute...

Linux Distros Unpatched Vulnerability : CVE-2026-93485

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Automattic WordPress core allows DOM-Based XSS. This issue...

Linux Distros Unpatched Vulnerability : CVE-2026-90180

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - block: mtip32xx: synchronize ioctls with device removal The ioctl handlers only test REMOVEPENDING before entering mtiphwioctl. Removal can set that bit...

Linux Distros Unpatched Vulnerability : CVE-2026-90196

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ASoC: SOF: validate topology volume range before allocation SOF treats the topology mixer min and max values as non-negative indices into its volume table. It...

Linux Distros Unpatched Vulnerability : CVE-2026-93186

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - cxl/mbox: Clamp mailbox output allocation to the payload size CXLMEMSENDCOMMAND bounds the user's in.size to the mailbox payload size but leaves out.size...

ISC BIND 9.11.0 < 9.20.29 / 9.11.3-S1 < 9.20.29-S1 / 9.20.0 < 9.20.29 / 9.20.9-S1 < 9.20.29-S1 / 9.21.0 < 9.21.26 Multiple Vulnerabilities

The version of ISC BIND running on the remote host is 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, or 9.21.0 through 9.21.25. Supported Preview Edition releases 9.11.3-S1 through 9.18.50-S1 and 9.20.9-S1 through 9.20.27-S1 are also affected. It is, therefore, affected by multiple vulnerabiliti...

Linux Distros Unpatched Vulnerability : CVE-2026-90188

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nullblk: free global tagset on init error path If sharedtags is enabled, nullsetuptagset allocates the global tagset via nullinitglobaltagset. If device creatio...

Linux Distros Unpatched Vulnerability : CVE-2026-93097

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - cxl/mbox: Break poison list loop on an empty payload A device that returns count == 0 with CXLPOISONFLAGMORE set on every iteration never advances nrrecords, so...

Linux Distros Unpatched Vulnerability : CVE-2026-93162

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - crypto: qat - cancel work on re-enable SR-IOV timeout The QAT reset worker queues SR-IOV reenable work using a workstruct and completion embedded in an on-stack...

Linux Distros Unpatched Vulnerability : CVE-2026-90088

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: RFCOMM: Validate MTU in rfcommapplypn to prevent infinite loop rfcommapplypn accepts the MTU value from a remote PN Parameter Negotiation frame witho...

Linux Distros Unpatched Vulnerability : CVE-2026-90157

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Reject negative optlen in cgroup getsockopt hook A cgroup getsockopt BPF program can shrink ctx-optlen after the kernel getsockopt handler has run. The...

Linux Distros Unpatched Vulnerability : CVE-2026-90158

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - m68k: nfcon: Do not call consoleisregistered in nfcondevice Since 7c2af0f634f1 tty: ttyio: use consolelistlock for list synchronization showconsactive calls the...

Linux Distros Unpatched Vulnerability : CVE-2026-90351

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: mt76: mt7996: do not attach hif2 WED when the main WED attach failed If the WED attach for the primary PCIe function fails, the probe path still attached...

Linux Distros Unpatched Vulnerability : CVE-2026-93184

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ASoC: fslaudmix: rework runtime PM handling in probe After pmruntimeenable the AUDMIX block is powered off and stays suspended until the first runtime resume...

Linux Distros Unpatched Vulnerability : CVE-2026-93383

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Information leak in Permissions in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium...

Linux Distros Unpatched Vulnerability : CVE-2026-90255

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: hciconn: fix the SCO setup context lifetime hcisetupsync queues a connhandlet with a NULL destroy callback, so the context is only freed if...

Linux Distros Unpatched Vulnerability : CVE-2026-90109

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: sched: fix 32-bit backlog wrap in gred, bfifo and plug enqueue gredenqueue, bfifoenqueue and plugenqueue admit a packet when the current backlog plus the...

Linux Distros Unpatched Vulnerability : CVE-2026-90282

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - phy: qcom: qmp-usb-legacy: Fix possible NULL-deref on early runtime suspend There is a small window where the runtime suspend callback may run after...

Linux Distros Unpatched Vulnerability : CVE-2026-90314

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - remoteproc: fix OOB read via signed offset in rsctableforeachentry table-offseti is a u32 from firmware, but was stored into a signed int. A crafted offset like...

Linux Distros Unpatched Vulnerability : CVE-2026-90325

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - blk-cgroup: skip dying blkg in blkcgactivatepolicy When switching IO schedulers on a block device, blkcgactivatepolicy can race with concurrent blkcg deletion,...

Linux Distros Unpatched Vulnerability : CVE-2026-90057

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - slip: remove sliphangup to fix use-after-free in slipreceivebuf Jaeyoung Chung and Eulgyu Kim reported a slab-use-after-free read in slipreceivebuf when racing...

Linux Distros Unpatched Vulnerability : CVE-2026-90147

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - clk: devres: fix cleanup in devmclkgetoptionalenabledwithrate devmclkgetoptionalenabledwithrate registers its cleanup action before setting the clock rate. If...

Linux Distros Unpatched Vulnerability : CVE-2026-93192

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/v3d: Clear queue-activejob when v3dfencecreate fails The runjob callbacks for BIN, RENDER, TFU and CSD assign the incoming job to queue-activejob before...