Linux Distros Unpatched Vulnerability : CVE-2026-63996

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: ethtool: cmis: require exact CDB reply length Malicious SFP module could respond with rpllen...

Linux Distros Unpatched Vulnerability : CVE-2026-64018

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: mana: validate rxreqidx to prevent out-of-bounds array access In manahwcrxeventhandler, rxreqidx is derived from sge-address in DMA-coherent memory. In...

Linux Distros Unpatched Vulnerability : CVE-2026-63896

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: gadget: composite: fix integer underflow in WebUSB GETURL handling The WebUSB GETURL handler in compositesetup narrows landingpagelength to fit the...

Linux Distros Unpatched Vulnerability : CVE-2026-64081

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Validate framework notification message layout Framework notifications car...

Linux Distros Unpatched Vulnerability : CVE-2026-63941

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: arm64: Correctly cap ZCREL2 provided by a guest hypervisor ZCREL2 can be updated by a VHE guest hypervisor either using ZCREL2 which traps or ZCREL1 which...

Linux Distros Unpatched Vulnerability : CVE-2026-63868

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: garp: fix unsigned integer underflow in garppduparseattr The receive-side GARP attribute parser computes dlen with reversed operands: dlen = sizeofga -...

Linux Distros Unpatched Vulnerability : CVE-2026-64086

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - hwmon: pmbus/adm1266 include PEC byte in pmbusblockxfer read buffer adm1266pmbusblockxfer sets up the read transaction with .buf = data-readbuf, .len =...

Amazon Linux 2 : runfinch-finch, --advisory ALAS2DOCKER-2026-136 (ALASDOCKER-2026-136)

The version of runfinch-finch installed on the remote host is prior to 1.17.2-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2DOCKER-2026-136 advisory. containerd is an open-source container runtime. In versions prior to 1.7.32, 2.0.9, 2.2.4 and 2.3.1, containers launch...

Linux Distros Unpatched Vulnerability : CVE-2026-64053

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: block: don't overwrite bipvcnt in biointegritycopyuser biointegrityaddpage already sets...

Linux Distros Unpatched Vulnerability : CVE-2026-64191

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - i2c: stub: Reject I2C block transfers with invalid length The I2CSMBUSI2CBLOCKDATA case in stubxfer uses data-block0 as the transfer length. The existing check...

Linux Distros Unpatched Vulnerability : CVE-2026-63843

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/jpeg: set nouserfence for JPEG v4.0.5 ring JPEG rings do not support 64-bit user...

Linux Distros Unpatched Vulnerability : CVE-2026-63901

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - USB: serial: digiacceleport: fix memory corruption with small endpoints Add the missing bulk-out buffer size sanity checks to avoid out-of-bounds memory accesse...

Amazon Linux 2 : php, --advisory ALAS2PHP8.2-2026-012 (ALASPHP8.2-2026-012)

The version of php installed on the remote host is prior to 8.2.32-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2PHP8.2-2026-012 advisory. PHP: ext/openssl: Memory corruption zendmmheap corrupted in opensslencrypt with AES-WRAP-PAD CVE-2026-14355 Tenable has extracted...

Linux Distros Unpatched Vulnerability : CVE-2026-63933

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iio: gyro: adis16260: fix division by zero in writeraw Add a validation check for the sampling frequency value before using it as a divisor. A user writing zero...

Oracle Linux 10 : thunderbird (ELSA-2026-19131)

The remote Oracle Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-19131 advisory. 140.12.0-1.0.1 - Add Oracle prefs 140.12.0-1 - Update to 140.12.0 ESR 140.11.0-1 - Update to 140.11.0 ESR 140.10.1-1 - Update to 140.10.1 ESR Tenable...

Linux Distros Unpatched Vulnerability : CVE-2026-63987

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: ethtool: coalesce: cap profile updates at NETDIMPARAMSNUMPROFILES ethnlupdateprofile walks t...

Linux Distros Unpatched Vulnerability : CVE-2026-64138

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ksmbd: validate SID in parent security descriptor during ACL inheritance Introduce smbvalidatentsdsid helper to safely validate Owner SID and Group SID inside t...

TencentOS Server 3: kernel (TSSA-2026:0664)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0664 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

RHEL 10 : dovecot (RHSA-2026:41988)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:41988 advisory. Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and...

Linux Distros Unpatched Vulnerability : CVE-2026-64029

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: seq: Serialize UMP output teardown with eventinput sequmpprocessevent borrows client-outrfile.output without synchronizing with the first-open and...

Amazon Linux 2023 : nodejs24, nodejs24-devel, nodejs24-full-i18n (ALAS2023-2026-1980)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1980 advisory. A use-after-free / double-free in c-ares' query-completion handling. Thesame flaw -- a query's callback being invoked while the query is stilllinked in the channel's internal lookup structures -- is...

Linux Distros Unpatched Vulnerability : CVE-2026-63914

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xfrm: route MIGRATE notifications to caller's netns xfrmsendmigrate in net/xfrm/xfrmuser.c and pfkeysendmigrate in net/key/afkey.c both hardcode &initnet for t...

Linux Distros Unpatched Vulnerability : CVE-2026-64038

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - hwmon: lm90 Stop work before releasing hwmon device Sashiko reports: In lm90probe, the devm action to cancel the alertwork and reportwork lm90restoreconf is...

TencentOS Server 3: libreoffice (TSSA-2026:0633)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0633 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

Linux Distros Unpatched Vulnerability : CVE-2026-64044

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: ovpn: respect peer refcount in CMDNEWPEER error path ovpnnlpeernewdoit's error path calls...

Linux Distros Unpatched Vulnerability : CVE-2026-63873

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - accel/amdxdna: Fix mmstruct reference leak in aie2populaterange aie2populaterange jumps back to the again label without calling mmputmm, leaking a reference to...

Linux Distros Unpatched Vulnerability : CVE-2026-53390

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ksmbd: fix out-of-bounds read in smbcheckpermdacl The permission-check ACE walk in smbcheckpermdacl validates the ACE header size and caps sid.numsubauth at...

Linux Distros Unpatched Vulnerability : CVE-2026-63813

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Revert f2fs: remove non-uptodate folio from the page cache in movedatablock This reverts commit 9609dd704725a40cd63d915f2ab6c44248a44598. The kernel panics are...

Linux Distros Unpatched Vulnerability : CVE-2026-63885

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: drm/gem: fix race between changehandle and handledelete drmgemchangehandleioctl leaves the o...

Linux Distros Unpatched Vulnerability : CVE-2026-63918

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: l2tp: use refcountincnotzero in l2tpsessiongetbyifname A reader in l2tpsessiongetbyifname ca...

Linux Distros Unpatched Vulnerability : CVE-2026-63870

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ieee802154: 6lowpan: only accept IPv6 packets in lowpanxmit The aoe driver or similar generates a non-IPv6 packet e.g., ETHPAOE and queues it for transmission v...

Linux Distros Unpatched Vulnerability : CVE-2026-64051

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - accel/qaic: Add overflow check to remappfnrange during mmap The call to remappfnrange in qaicgemobjectmmap is susceptible to remapping beyond the VMA if the BO ...

FreeBSD : Mailpit -- SMTP DATA line reader buffers over-limit input before size enforcement (562ff91e-8407-11f1-bfde-10ffe07f9334)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 562ff91e-8407-11f1-bfde-10ffe07f9334 advisory. Mailpit author reports: Mailpit's SMTP DATA reader enforces the configured MaxMessageSize only after...

Cisco ASA/FTD Observable Discrepancy (CVE-2022-20866)

A vulnerability in the handling of RSA keys on devices running Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to retrieve an RSA private key. This vulnerability is due to a logic error when the RSA key...

Linux Distros Unpatched Vulnerability : CVE-2026-63985

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ethtool: eeprom: add more safeties to EEPROM Netlink fallback The Netlink fallback path for reading module EEPROM fallbacksetparams validates that offset totall...

Linux Distros Unpatched Vulnerability : CVE-2026-64090

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - batman-adv: tt: avoid empty VLAN responses The commit 16116dac2339 batman-adv: prevent TT request storms by not sending inconsistent TT TLVLs added checks to th...

CentOS 9 : expat-2.5.0-7.el9

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the expat-2.5.0-7.el9 build changelog. - In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XM...

Linux Distros Unpatched Vulnerability : CVE-2026-64078

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfilter: xtables: add and use xtablesunregistertableexit Previous change added xtablesunregistertablepreexit to detach the table from the packetpath and to...

Linux Distros Unpatched Vulnerability : CVE-2026-63940

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: SEV: Ignore Port I/O requests of length '0' Explicitly ignore Port I/O requests of length '0' or count '0', so that setting up the software scratch area an...

Linux Distros Unpatched Vulnerability : CVE-2026-53389

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/tcp-ao: fix use-after-free of key in delasync path In tcpaodeletekey, the delasync path skips the currentkey and rnextkey validity checks present in the...

Linux Distros Unpatched Vulnerability : CVE-2026-64117

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: mac80211: capture fast-RX rate before mesh reuses skb-cb ieee80211invokefastrx reads RX status through IEEE80211SKBRXCBskb, which aliases the same skb-cb...

RHEL 9 : httpd (RHSA-2026:41906)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:41906 advisory. The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: incomplete fix...

Linux Distros Unpatched Vulnerability : CVE-2026-63865

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: bpf: Drop tasktoinode and inetconnestablished from lsm sleepable hooks bpflsmtasktoinode is...

Fedora 43 : libtiff (2026-feac063d56)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-feac063d56 advisory. updated to 4.7.2, fixes security issues Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...

Linux Distros Unpatched Vulnerability : CVE-2026-64152

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: iommu: Handle unmap error when iommudebug is enabled Sashiko noticed a latent bug where the...

Linux Distros Unpatched Vulnerability : CVE-2026-63895

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: gadget: ffs: copy only received bytes on short ep0 read ffsep0read allocates its control-OUT data buffer with kmalloc not kzalloc at the Length value from...

Linux Distros Unpatched Vulnerability : CVE-2026-64170

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - spi: qup: fix error pointer deref after DMA setup failure The driver falls back to PIO mode if DMA setup fails during probe. Make sure to the clear the DMA...

Linux Distros Unpatched Vulnerability : CVE-2026-64179

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: wwan: iosm: fix potential memory leaks in ipcimeminit The memory allocated in ipcprotocolinit is not freed on the error paths that follow in ipcimeminit. F...

Linux Distros Unpatched Vulnerability : CVE-2026-63915

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nfc: hci: fix out-of-bounds read in HCP header parsing Both nfchcirecvfromllc and ncihcidatareceivedcb read packet-header from skb-data at function entry withou...

Linux Distros Unpatched Vulnerability : CVE-2026-63899

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - USB: serial: mxuport: fix memory corruption with small endpoint Make sure that the bulk-out endpoint max packet size is at least eight bytes to avoid...