Linux Distros Unpatched Vulnerability : CVE-2026-64757

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A memory corruption issue was addressed with improved state management. This issue is fixed in Safari 26.6, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS...

Linux Distros Unpatched Vulnerability : CVE-2026-65609

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nnn is vulnerable to Out-of-Bound write vulnerability. Due to lack of validation of attacker-controlled length fields deserialized from a session file, a crafte...

Elasticsearch 8.11.x < 8.18.0 DoS (ESA-2026-111)

The version of Elasticsearch installed on the remote host is 8.11.x prior to 8.18.0. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-111 advisory. - Memory Allocation with Excessive Size Value CWE-789 in the ES|QL query processing of Elasticsearch can lead to denial of...

Oracle Linux 9 : mysql:8.4 (ELSA-2026-56973)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-56973 advisory. mecab 0.996-3.4 - Bump version for package rebuild We are moving the 'mecab-devel' RPM from the 'buildroot' repo to the 'CRB' repo - Resolves: 2182069...

JetBrains YouTrack < 2026.2.18068 Stored XSS (CVE-2026-75048)

The version of JetBrains YouTrack installed on the remote host is prior to 2026.2.18068. It is, therefore, affected by a stored cross-site scripting vulnerability: - Stored XSS via the fenced code-block language label was possible. CVE-2026-75048 Note that Nessus has not tested for this issue but...

AlmaLinux 8 : gstreamer1-plugins-good (ALSA-2026:56966)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:56966 advisory. gst-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay RTP depayloaders CVE-2026-18649 gstreamer1-plugins-good:...

Elasticsearch 5.x < 8.19.19 / 9.3.x < 9.3.8 / 9.4.x < 9.4.4 DoS (ESA-2026-75)

The version of Elasticsearch installed on the remote host is 5.x prior to 8.19.19, or 9.3.x prior to 9.3.8, or 9.4.x prior to 9.4.4. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-75 advisory. - A flaw in Elasticsearch allows an authenticated user with the privileges...

Linux Distros Unpatched Vulnerability : CVE-2026-76878

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In OpenStack Aodh before 22.0.1, the alarm list API bypasses project scoping when the allprojects query parameter is set to false. The API checks for the presen...

Linux Distros Unpatched Vulnerability : CVE-2026-76883

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Catapult DCT2000 file parser crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service CVE-2026-76883 Note that Nessus relies on the presence of the...

Linux Distros Unpatched Vulnerability : CVE-2026-75595

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandlerdecode...

Oracle Linux 10 / 9 : java-25-openjdk (ELSA-2026-55798)

The remote Oracle Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-55798 advisory. 1:25.0.4.1.1-1.1.0.1 - Add Oracle vendor bug URL Orabug: 34340155 1:25.0.4.1.1-1.1 - Update to jdk-25.0.4.1+1 GA - Update release notes to...

Oracle Linux 8 / 9 : java-17-openjdk (ELSA-2026-55781)

The remote Oracle Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-55781 advisory. 17.0.20.1.1-1.1.0.1 - Add Oracle vendor bug URL Orabug: 34340155 1:17.0.20.1.1-1.1 - Update to jdk-17.0.20.1+1 GA - Add to .gitignore...

MiracleLinux 9 : java-21-openjdk-21.0.12.0.8-1.2.el9.ML.1 (AXSA:2026-1580:09)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1580:09 advisory. JDK: Enhance TLS certificate handling CVE-2026-46968 JDK: Improve DTLS handshaking CVE-2026-46917 JDK: Enhance JPEG handling CVE-2026-47010 JDK:...

RockyLinux 8 : gstreamer1-plugins-good (RLSA-2026:56966)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:56966 advisory. gst-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay RTP depayloaders CVE-2026-18649 gstreamer1-plugins-good:...

Linux Distros Unpatched Vulnerability : CVE-2026-76928

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - X.509IF protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service CVE-2026-76928 Note that Nessus relies on the presence of the...

Photon OS 5.0: Gawk PHSA-2026-5.0-91-0933

An update of the gawk package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-91-0933. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Elasticsearch 8.x < 8.19.20 / 9.0.x < 9.4.5 / 9.5.x < 9.5.1 Multiple Vulnerabilities (ESA-2026-78 / ESA-2026-79 / ESA-2026-116)

The version of Elasticsearch installed on the remote host is 8.x prior to 8.19.20, or 9.0.x prior to 9.4.5, or 9.5.x prior to 9.5.1. It is, therefore, affected by multiple vulnerabilities as referenced in the ESA-2026-78, ESA-2026-79, and ESA-2026-116 advisories. - Memory Allocation with Excessiv...

Linux Distros Unpatched Vulnerability : CVE-2026-76924

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Kerberos protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service CVE-2026-76924 Note that Nessus relies on the presence of the...

Linux Distros Unpatched Vulnerability : CVE-2026-17183

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side...

Linux Distros Unpatched Vulnerability : CVE-2018-1000644

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Eclipse RDF4j version 2.4.0 Milestone 2 contains a XML External Entity XXE vulnerability in RDF4j XML parser parsing RDF files that can result in the disclosure...

JetBrains YouTrack < 2025.3.156085 / 2026.1.x < 2026.1.13914 / 2026.2.x < 2026.2.18095 Missing Authorization (CVE-2026-75044)

The version of JetBrains YouTrack installed on the remote host is prior to 2025.3.156085, 2026.1.x prior to 2026.1.13914, or 2026.2.x prior to 2026.2.18095. It is, therefore, affected by a missing authorization vulnerability: - Missing authorisation allowed an authenticated user to delete arbitra...

Linux Distros Unpatched Vulnerability : CVE-2026-76918

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SSH protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service CVE-2026-76918 Note that Nessus relies on the presence of the packag...

Fedora 44 : firefox (2026-fc11919789)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-fc11919789 advisory. Implement buffer stride support for PipeWire camera. ---- - Update to latest upstream 154.0 - Enabled Wayland session restore on KDE. Tenable has...

MiracleLinux 8 : nodejs:22 (AXSA:2026-1596:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1596:01 advisory. sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data CVE-2026-11822 sqlite: SQLite: Arbitrary code execution and crash vi...

MiracleLinux 8 : dotnet10.0-10.0.111-1.el8_10 (AXSA:2026-1582:17)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1582:17 advisory. .NET: .NET Core: .NET Security Feature Bypass Vulnerability CVE-2026-62899 .NET: .NET Information Disclosure Vulnerability CVE-2026-62900 .NET: .NET...

Debian dla-4749 : chromium - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4749 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4749-1 [email protected]...

Slackware Linux 15.0 / current mozilla-firefox Multiple Vulnerabilities (SSA:2026-231-01)

The version of mozilla-firefox installed on the remote host is prior to 140.14.0esr. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2026-231-01 advisory. New mozilla-firefox packages are available for Slackware 15.0 and -current to fix security issues. Tenable has...

Linux Distros Unpatched Vulnerability : CVE-2026-59949

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash implementations fail to validate the byte array object and the off and len...

Fedora 43 : roundcubemail (2026-914a40b4fd)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-914a40b4fd advisory. Release 1.6.18 - Password: Fix fatal error Class 'Zxcvbn' not found 10274 - Fix out-of-bounds string reads on truncated compressed-RTF in the TNEF...

RockyLinux 9 : perl-Date-Manip (RLSA-2026:56970)

The remote RockyLinux 9 host has a package installed that is affected by a vulnerability as referenced in the RLSA-2026:56970 advisory. perl-Date-Manip: Date::Manip for Perl: Denial of Service via CPU exhaustion in date parsing CVE-2026-60075 Tenable has extracted the preceding description block...

Linux Distros Unpatched Vulnerability : CVE-2026-65610

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nnn stores homelen variable as uchart, which can only represent values in the range 0-255. An attacker who can influence the victim's execution environment can...

Linux Distros Unpatched Vulnerability : CVE-2026-73196

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in FreeIPA. A low-privilege authenticated user can exploit this vulnerability by submitting an oversized One-Time Password OTP key value. This...

Linux Distros Unpatched Vulnerability : CVE-2026-71135

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.14. Easily exploitable...

Oracle Linux 8 : perl:5.32 (ELSA-2026-48225)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-48225 advisory. - Fix CVE-2025-40909 - Clone dirhandles without fchdir perl-Algorithm-Diff - Fix CVE-2026-9538: Denial of Service via crafted tar header with large entry size...

Linux Distros Unpatched Vulnerability : CVE-2026-71136

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.14. Easily exploitable...

Debian dsa-6455 : chromium - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6455 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6455-1 [email protected] https://www.debian.org/securit...

RHEL 8 : cups-filters (RHSA-2026:57451)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:57451 advisory. The cups-filters package contains back ends, filters, and other software that was once part of the core Common UNIX Printing System CUPS distributio...

Linux Distros Unpatched Vulnerability : CVE-2026-71113

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.14. Easily exploitable...

RockyLinux 9 : mysql:8.4 (RLSA-2026:56973)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:56973 advisory. mysql: Performance Schema unspecified vulnerability CPU Jul 2026 CVE-2026-61081 mysql: Optimizer unspecified vulnerability CPU Jul 2026 CVE-2026-47064...

Linux Distros Unpatched Vulnerability : CVE-2026-49283

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. Prior to versions 4.19.3, 4.20.2, 5.0.6, and 6.2.1, the HTTPArtifact::receive...

MiracleLinux 9 : perl-DBI-1.643-9.el9_8.3 (AXSA:2026-1593:02)

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-1593:02 advisory. DBI: DBI: Arbitrary code execution via caller-influenced Profile attribute CVE-2026-14380 DBI: DBI: Heap overflow when preparsing SQL statements wit...

Linux Distros Unpatched Vulnerability : CVE-2026-76919

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ESS protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service CVE-2026-76919 Note that Nessus relies on the presence of the packag...

Elasticsearch 8.x < 8.19.20 / 9.0.x < 9.4.5 Multiple Vulnerabilities (ESA-2026-76 / ESA-2026-77 / ESA-2026-118 / ESA-2026-119 / ESA-2026-133)

The version of Elasticsearch installed on the remote host is 8.x prior to 8.19.20, or 9.0.x prior to 9.4.5. It is, therefore, affected by multiple vulnerabilities as referenced in the ESA-2026-76, ESA-2026-77, ESA-2026-118, ESA-2026-119, and ESA-2026-133 advisories. - Uncontrolled Recursion CWE-6...

GLSA-202608-19 : quickjs-ng: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202608-19 quickjs-ng: Multiple Vulnerabilities Multiple vulnerabilities have been discovered in quickjs-ng. Please review the CVE identifiers referenced below for details. Tenable has extracted the preceding description block...

NetScaler ADC and NetScaler Gateway Multiple Vulnerabilities (CTX696939)

The remote NetScaler ADC formerly Citrix ADC or NetScaler Gateway formerly Citrix Gateway device is 13.1 prior to 13.1-63.21, or 14.1 prior to 14.1-73.32, or 13.1-FIPS/NDcPP prior to 13.1-37.277, or 14.1-FIPS prior to 14.1-73.32. It is, therefore, affected by multiple vulnerabilities: -...

RHEL 10 : kernel (RHSA-2026:57251)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:57251 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: drm/amdkfd: Fix out-of-bound...

AlmaLinux 8 : kernel-rt (ALSA-2026:57254)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:57254 advisory. kernel: net: ieee802154: do not leave a dangling sk pointer in ieee802154create CVE-2024-56602 kernel: ip6gre: Use cached t-net in ip6erspanchangelink...

RHEL 8 : kernel-rt (RHSA-2026:57254)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:57254 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism...

Oracle Linux 9 : ansible-core (ELSA-2026-57149)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-57149 advisory. 1:2.14.18-3.1 - Fix CVE-2026-11332 prevent arbitrary git configuration via role requirements RHEL-194134 Tenable has extracted the preceding description block...

RockyLinux 10 : php8.4 (RLSA-2026:56969)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:56969 advisory. php: ext-pgsql: PHP: SQL injection via improper backslash escaping CVE-2026-17543 php: PHP: Arbitrary code execution via out-of-bounds write in bccomp...