FreeBSD : qt6-webengine -- multiple vulnerabilities (a188c081-9ce8-11f1-8fc6-cb9659fdabad)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the a188c081-9ce8-11f1-8fc6-cb9659fdabad advisory. Qt qtwebengine-chromium repo reports: Backports for 747 security bugs in Chromium: Tenable has...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102050)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102050 advisory. In the Linux kernel, the following vulnerability has been resolved: RDMA/vmwpvrdma: Fix double free on pvrdmaallocucontext error path Sashiko points out that...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: skopeo (UTSA-2026-102706)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102706 advisory. Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102039)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102039 advisory. In the Linux kernel, the following vulnerability has been resolved: tipc: fix use-after-free of the discoverer in tipcdiscrcv bearerdisable frees b-disc with...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102081)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102081 advisory. In the Linux kernel, the following vulnerability has been resolved: crypto: asymmetrickeys - prevent overflow in asymmetrickeygenerateid Use checkaddoverflow to guar...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2024-002902)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2024-002902 advisory. In the Linux kernel, the following vulnerability has been resolved: KVM: s390: fix setting of fpc register kvmarchvcpuioctlsetfpu allows to set the floating point...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: postgresql (UTSA-2026-099437)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099437 advisory. Stack buffer overflow in PostgreSQL module refint allows an unprivileged database user to execute arbitrary code as the operating system user running the database. A...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-001498)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-001498 advisory. In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix kernel bug due to missing clearing of checked flag Syzbot reported that in directory...

Fedora 44 : php-phpseclib3 (2026-d2d58edf7d)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-d2d58edf7d advisory. Update to v3.0.56 - contains fixes for CVE-2026-40194 and CVE-2026-44167 Tenable has extracted the preceding description block directly from the...

Kibana 8.x < 8.19.20 / 9.0.x < 9.3.8 / 9.4.x < 9.4.5 Denial of Service (ESA-2026-101)

The version of Kibana installed on the remote host is 8.x prior to 8.19.20, 9.0.x prior to 9.3.8, or 9.4.x prior to 9.4.5. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-101 advisory. - Uncaught Exception CWE-248, resulting from Improper Input Validation CWE-20, in...

Unity Linux 20.1050e / 20.1070e Security Update: kernel (UTSA-2025-001417)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-001417 advisory. In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential out-of-bounds memory access in nilfsfindentry Syzbot reported that when...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102048)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102048 advisory. In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Add sanity check for OOB writes at silencing At silencing the playback URB packe...

MLflow < 3.15.0 SSRF (CVE-2026-64849)

The version of MLflow installed on the remote host is prior to 3.15.0. It is, therefore, affected by a server-side request forgery vulnerability: - The unauthenticated POST /api/2.0/mlflow/webhooks/id/test endpoint calls validatewebhookurl only for the original URL while the webhook delivery...

Oracle Linux 9 : kbd (ELSA-2026-57610)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-57610 advisory. 2.4.0-12 - Fix CVE-2026-72693: openvt -u process matching made more conservative Resolves: RHEL-235988 Tenable has extracted the preceding description block...

RockyLinux 10 : kbd (RLSA-2026:57597)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:57597 advisory. kbd: Local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login CVE-2026-72693 Tenable has extracted the...

openSUSE 16: libpython3_13-1_0 / libpython3_13-1_0-x86-64-v3 / libpython3_13t1_0 / etc (openSUSE-SU-2026:21595-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21595-1 advisory. - CVE-2025-15366: user-controlled command can allow additional commands injected using newlines bsc1257044. - CVE-2025-15367: control characters...

SUSE SLED15: libpython3_13-1_0 / python313 / python313-base / python313-curses / etc (SUSE-SU-2026:3649-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3649-1 advisory. - CVE-2025-15366: user-controlled command can allow additional commands injected using newlines bsc1257044. -...

AlmaLinux 10 : kbd (ALSA-2026:57597)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:57597 advisory. kbd: Local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login CVE-2026-72693 Tenable has extracted the...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: php (UTSA-2026-102698)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102698 advisory. Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process,in PHP versionsfrom 8.2. before 8.2.3...

Python Library sqlparse < 0.6.0 Multiple Vulnerabilities

The version of the sqlparse Python library installed on the remote host is prior to 0.6.0. It is, therefore, affected by multiple vulnerabilities: - A denial of service vulnerability exists in sqlparse due to the regular expressions used by the lexer to match dollar-quoted strings and multiline...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102100)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102100 advisory. In the Linux kernel, the following vulnerability has been resolved: mm: blk-cgroup: fix use-after-free in cgwbreleaseworkfn cgwbreleaseworkfn calls cssputwb-blkcgcss...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-001506)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-001506 advisory. In the Linux kernel, the following vulnerability has been resolved: wifi: rtl8xxxu: add cancelworksync for c2hcmdwork The workqueue might still be running, when the...

Linux Distros Unpatched Vulnerability : CVE-2026-73198

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit a vulnerability in the /ipa/i18nmessages endpoint by sending an arbitrarily large...

Linux Distros Unpatched Vulnerability : CVE-2026-71116

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.14. Difficult to explo...

JetBrains YouTrack < 2026.1.13901 / 2026.2.x < 2026.2.17950 DoS (CVE-2026-75050)

The version of JetBrains YouTrack installed on the remote host is prior to 2026.1.13901, or 2026.2.x prior to 2026.2.17950. It is, therefore, affected by a denial of service vulnerability: - A DoS attack was possible via crafted type parameters. CVE-2026-75050 Note that Nessus has not tested for...

RHEL 9 : osbuild-composer (RHSA-2026:57541)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:57541 advisory. A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building...

Linux Distros Unpatched Vulnerability : CVE-2026-71151

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.14. Difficult to explo...

Debian dla-4747 : python3-httplib2 - security update

The remote Debian 11 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-4747 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4747-1 [email protected]...

RockyLinux 8 : java-21-openjdk (RLSA-2026:55787)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:55787 advisory. JDK: Improve Resource Resolving CVE-2026-60589 JDK: Enhance HTTP Connections CVE-2026-61308 JDK: Enhance TLS server CVE-2026-70907 Tenable has extracted...

Linux Distros Unpatched Vulnerability : CVE-2026-75146

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer libavformat/dashdec.c. When a live DASH manifest is refreshed with a startNumber...

Linux Distros Unpatched Vulnerability : CVE-2026-76890

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Crash in sharkd in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service CVE-2026-76890 Note that Nessus relies on the presence of the package as reported...

Linux Distros Unpatched Vulnerability : CVE-2026-75803

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the...

Linux Distros Unpatched Vulnerability : CVE-2026-73197

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the...

AlmaLinux 10 : libcupsfilters (ALSA-2026:56965)

The remote AlmaLinux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:56965 advisory. libcupsfilters: cups-filters: libcupsfilters: CPU exhaustion via infinite loop in cfIEEE1284NormalizeMakeModel CVE-2026-64611 libcupsfilters:...

Linux Distros Unpatched Vulnerability : CVE-2026-75145

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg before commit b4c199c contains an incorrect integer narrowing conversion in the AV1 RTP packetizer libavformat/rtpencav1.c. The OBU size is cast to long...

Elasticsearch 8.19.x < 8.19.20 / 9.0.x < 9.4.5 DoS (ESA-2026-81)

The version of Elasticsearch installed on the remote host is 8.19.x prior to 8.19.20, or 9.0.x prior to 9.4.5. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-81 advisory. - Elasticsearch does not apply its configurable input length restriction to a user-supplied patte...

Linux Distros Unpatched Vulnerability : CVE-2026-64783

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, visionOS...

Linux Distros Unpatched Vulnerability : CVE-2026-76222

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitPython before 3.1.58 fails to validate submodule names from .gitmodules files, allowing attackers to create Git repositories at arbitrary filesystem paths...

Linux Distros Unpatched Vulnerability : CVE-2026-71130

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.14. Easily exploitable...

Linux Distros Unpatched Vulnerability : CVE-2026-64719

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in Safari 26.6, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPad...

Linux Distros Unpatched Vulnerability : CVE-2026-75144

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg before commit 1cdeb3c contains a heap buffer overflow vulnerability in the VC-2/Dirac RTP packetizer libavformat/rtpencvc2hq.c that allows attackers to...

MiracleLinux 9 : frr10-10.4.3-3.el9_8.2 (AXSA:2026-1591:03)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1591:03 advisory. frr: FRRouting: Denial of Service via crafted BGP UPDATE message CVE-2026-37460 Tenable has extracted the preceding description block directly from the...

Linux Distros Unpatched Vulnerability : CVE-2026-50152

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Monitor subscription...

Linux Distros Unpatched Vulnerability : CVE-2026-63633

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, freerdpdspdecodeopus in libfreerdp/codec/dsp.c calls...

Golang 1.26.x < 1.26.6 DoS

The version of Golang running on the remote host is 1.26.x prior to 1.26.6. It is, therefore, affected by a denial of service vulnerability in the bundled golang.org/x/net/dns/dnsmessage package. Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the messag...

RHEL 8 : webkit2gtk3 (RHSA-2026:57348)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:57348 advisory. WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fixes: Mozilla: Arbitrary JavaScript...

Linux Distros Unpatched Vulnerability : CVE-2026-62291

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted image sequence with a 2x2 primary plane and a 256x256 auxiliary alp...

Linux Distros Unpatched Vulnerability : CVE-2026-28984

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5 and iPadOS 26.5, macOS Tahoe...

JetBrains YouTrack < 2025.3.156085 / 2026.1.x < 2026.1.13913 / 2026.2.x < 2026.2.18112 Authentication Bypass (CVE-2026-75045)

The version of JetBrains YouTrack installed on the remote host is prior to 2025.3.156085, 2026.1.x prior to 2026.1.13913, or 2026.2.x prior to 2026.2.18112. It is, therefore, affected by an authentication bypass vulnerability: - An unauthenticated attacker could download database backups via shar...

Linux Distros Unpatched Vulnerability : CVE-2026-75141

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg before commit acf5d7c contains a heap buffer overflow in the hvcC box writer. When writing an HEVC configuration record with more NAL units of a single...