Linux Distros Unpatched Vulnerability : CVE-2026-63824

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KEYS: fix overflow in keyctlpkeyparamsget2 The length for the internal output buffer is calculated incorrectly, which can result overflow when a too small buffe...

Linux Distros Unpatched Vulnerability : CVE-2026-63826

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fbdev: fix use-after-free in storemodes storemodes replaces a framebuffer's modelist with modes from userspace. On success it frees the old modelist with...

Linux Distros Unpatched Vulnerability : CVE-2026-63793

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ntfs: serialize volume label accesses Protect vol-volumelabel with a mutex and snaphost the label before copytouser. This prevent a use-after-free when...

Linux Distros Unpatched Vulnerability : CVE-2026-63816

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - f2fs: atomic: fix UAF issue on f2fsinodeinfo.atomicinode - ioctlF2FSIOCGARBAGECOLLECTRANGE - shrink - f2fsgc - gcdatasegment - radatablockcowinode - mapping =...

Linux Distros Unpatched Vulnerability : CVE-2026-63847

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amdgpu/jpeg: set nouserfence for JPEG v2.5 ring JPEG rings do not support 64-bit user fence writes, reject CS submissions with user fences. cherry picked fr...

Linux Distros Unpatched Vulnerability : CVE-2026-53398

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NFSD: Fix SECINFONONAME decode error cleanup nfsd4decodesecinfononame currently initializes sinexp after decoding sinstyle. If the XDR stream is truncated, the...

Linux Distros Unpatched Vulnerability : CVE-2026-63806

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: Replace guest-triggerable BUGON in ioeventfd datamatch with getunaligned Drop a BUGON that has been reachable since it was first added, way back in 2009, a...

Linux Distros Unpatched Vulnerability : CVE-2026-63855

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amdgpu/vcn: set nouserfence for VCN v2.5 enc/dec rings VCN encoder and decoder rings do not support 64-bit user fence writes, reject CS submissions with use...

MiracleLinux 9 : golang-1.26.3-1.el9_8 (AXSA:2026-1288:06)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1288:06 advisory. net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 cmd/go: golang: Go command cmd/go: Integrity...

Fedora 44 : python-django5 (2026-595d35a4d1)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-595d35a4d1 advisory. Update python-django5 to version 5.2.16 Fixes three low-severity CVEs - CVE-2026-48588: Potential exposure of private data via cached Set-Cookie...

FreeBSD : phpmyfaq -- multiple vulnerabilities (0a0aca9f-8290-11f1-a93b-50ebf6bdf8e9)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 0a0aca9f-8290-11f1-a93b-50ebf6bdf8e9 advisory. phpMyFAQ team reports: An authenticated administrator can supply an untrusted update-package path to th...

SUSE SLES15 Security Update : joe (SUSE-SU-2026:3108-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2026:3108-1 advisory. This update for joe fixes the following issue - CVE-2026-13412: arbitrary command execution via malicious tags file bsc1269379. Tenable has extracted t...

Oracle Linux 8 : kernel (ELSA-2026-39179)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-39179 advisory. - xfrm: defensively unhash xfrmstate lists in xfrmstatedelete Sabrina Dubroca RHEL-180170 CVE-2026-46116 Tenable has extracted the preceding descripti...

Fedora 44 : chromium (2026-7437330b17)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-7437330b17 advisory. Update to 150.0.7871.124 CVE-2026-15764: Use after free in Ozone CVE-2026-15765: Use after free in Ozone CVE-2026-15766: Uninitialized Use in Skia...

Linux Distros Unpatched Vulnerability : CVE-2026-47086

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. GENURLAUTH-issued tokens can bypass ACLs. Any authenticated user could mint a URLAUTH token...

Oracle Linux 10 : httpd (ELSA-2026-21433)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-21433 advisory. - Resolves: RHEL-186221 - httpd: Apache HTTP Server: Heap-based Buffer Overflow via malicious backend servers CVE-2026-34356 - Resolves: RHEL-186195 ...

SUSE SLES12 Security Update : shibboleth-sp (SUSE-SU-2026:3098-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:3098-1 advisory. This update for shibboleth-sp fixes the following issue: - CVE-2025-9943: SQL injection in the 'ID' attribute of the SAML response when the replay cach...

Linux Distros Unpatched Vulnerability : CVE-2026-54171

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Excon is usable, fast, simple HTTP 1.1 for Ruby. Prior to 1.5.0, Excon's RedirectFollower middleware failed to strip additional sensitive headers when following...

Linux Distros Unpatched Vulnerability : CVE-2026-54464

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Impact If this library is used in tandem with the permessage-deflate extension, a WebSocket server or client can be made to accept messages that are larger than...

SUSE SLES15 Security Update : libssh2_org (SUSE-SU-2026:3082-1)

The remote SUSE Linux SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:3082-1 advisory. This update for libssh2org fixes the following issue - CVE-2026-55199: pre-Authentication DoS via SSHMSGEXTINFO Handler bsc1268530. Tenable has extract...

Linux Distros Unpatched Vulnerability : CVE-2026-47180

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.5, DNSIncoming.decodelabelsatoffset recurses once per DNS-name...

SUSE SLES15 Security Update : openssl-3 (SUSE-SU-2026:3094-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3094-1 advisory. This update for openssl-3 fixes the following issues - CVE-2026-34182: CMS AuthEnvelopedData Processing May Accept Forged Messages...

SUSE SLES15: tomcat10 / tomcat10-admin-webapps / tomcat10-el-5_0-api / etc (SUSE-SU-2026:3112-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3112-1 advisory. This update for tomcat10 fixes the following issues Update to Tomcat 10.1.56. Security issues fixed: - CVE-2026-50229: improper...

Linux Distros Unpatched Vulnerability : CVE-2026-52584

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Buffer Overflow vulnerability in libjxl v.0.11.2 and before allows a local attacker to obtain sensitive information via the DecodeImageAPNG function...

Fedora 43 : log4cxx (2026-31a8569c4b)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-31a8569c4b advisory. Update to log4cxx 1.7.0. Fixes CVE-2026-40023: XMLLayout did not escape characters forbidden by the XML 1.0 specification, which could cause conforming XML...

Fedora 44 : python-libcst (2026-17c484fafa)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-17c484fafa advisory. Update to 1.8.6. Build with PyO3 fixes RUSTSEC-2026-0176, RUSTSEC-2026-0177. Tenable has extracted the preceding description block directly from the Fedora...

Oracle Linux 10 : ruby4.0 (ELSA-2026-20606)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-20606 advisory. - Fix Net::IMAP ResponseReader quadratic complexity vulnerability CVE-2026-42245 Includes core fix plus additional performance optimizations Resolves...

SUSE SLED15: libruby3_4-3_4 / ruby3.4 / ruby3.4-devel / ruby3.4-devel-extra / etc (SUSE-SU-2026:3090-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3090-1 advisory. This update for ruby3.4 fixes the following issues - CVE-2026-42258: Net:IMAP: Command Injection via Symbol...

Linux Distros Unpatched Vulnerability : CVE-2026-54163

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - secureheaders manages application of security headers with many safe defaults. Prior to 7.3.0, secureheaders builds the Content-Security-Policy value by stitchi...

Linux Distros Unpatched Vulnerability : CVE-2026-49284

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SimpleSAMLphp versions before 1.18.6 contain an information disclosure vulnerability. Prior to 2.4.7 and 2.5.2, SimpleSAMLphp's SAML SP ACS path does not enforc...

FreeBSD : traefik -- Multiple vulnerabilities (9645fcd7-82a1-11f1-8c96-5404a68ad561)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 9645fcd7-82a1-11f1-8c96-5404a68ad561 advisory. The traefik project releases a new version addressing multiple vulnerabilities: Tenable has extracted t...

openSUSE 16: freetype2-devel / freetype2-profile-tti35 / ft2demos / ftbench / etc (openSUSE-SU-2026:21362-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21362-1 advisory. This update for freetype2 fixes the following issues - Update to version 2.14.3 - CVE-2026-23865: Integer overflow in the...

Linux Distros Unpatched Vulnerability : CVE-2026-47183

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.6, DNSIncoming.logexceptiondebug and the four QuietLogger...

Linux Distros Unpatched Vulnerability : CVE-2026-49834

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.0, a verifier configured with WithTransparencyLogN1 or...

Linux Distros Unpatched Vulnerability : CVE-2026-15902

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Cast in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page...

SUSE SLED15: libmariadb-devel / libmariadb3 / libmariadb_plugins / etc (SUSE-SU-2026:3110-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3110-1 advisory. This update for mariadb-connector-c fixes the following issue: - CVE-2026-44172: mysqlrealescapestring incorrectly...

Oracle Linux 10 : pcs (ELSA-2026-19008)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-19008 advisory. - Fixed CVE-2026-4800 by updating HA Cluster Management add-on to 0.1.24.3 Resolves: RHEL-164079 Tenable has extracted the preceding description block directl...

Linux Distros Unpatched Vulnerability : CVE-2026-50163

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/utils.go:262-275 validates a hardlink target relative to the...

SUSE SLED15 / SLES15 Security Update : wpa_supplicant (SUSE-SU-2026:3103-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3103-1 advisory. - CVE-2025-24912: hostapd RADIUS authentication of wi-fi devices allows a user in between the hostapd and the...

SUSE SLES15 Security Update : kernel (Live Patch 16 for SUSE Linux Enterprise 15 SP7) (SUSE-SU-2026:3083-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3083-1 advisory. This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.53.60 fixes various security issues The following security issues were fixed: -...

Linux Distros Unpatched Vulnerability : CVE-2026-50650

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper control of generation of code 'code injection' in .NET Framework allows an unauthorized attacker to elevate privileges locally. CVE-2026-50650 Note tha...

SUSE SLES12: libxml2-2 / libxml2-2-32bit / libxml2-devel / libxml2-doc / etc (SUSE-SU-2026:3111-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:3111-1 advisory. This update for libxml2 fixes the following issue - CVE-2026-11979: stack-based buffer overflows in the xmlcatalog utility when running in --shell mode...

FreeBSD : nginx -- multiple vulnerabilities (56feeac6-8263-11f1-92ba-bc24110523fe)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 56feeac6-8263-11f1-92ba-bc24110523fe advisory. The nginx development team reports: Buffer overflow when using map and regex CVE-2026-42533...

SUSE SLES15: libxml2-2 / libxml2-2-32bit / libxml2-devel / libxml2-tools / etc (SUSE-SU-2026:3095-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3095-1 advisory. This update for libxml2 fixes the following issue - CVE-2026-11979: stack-based buffer overflows in the xmlcatalog utility when running in...

SUSE SLES15: libxml2-2 / libxml2-2-32bit / libxml2-devel / libxml2-tools / etc (SUSE-SU-2026:3096-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3096-1 advisory. This update for libxml2 fixes the following issue - CVE-2026-11979: stack-based buffer overflows in the xmlcatalog utility when running in...

SUSE SLES15 Security Update : python-Pillow (SUSE-SU-2026:3084-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3084-1 advisory. This update for python-Pillow fixes the following issues - CVE-2026-54058: out-of-bounds read via attacker-controlled row stride on mmap path...

Oracle Linux 8 : container-tools:ol8 (ELSA-2026-38504)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-38504 advisory. - bump golang.org/x/crypto to v0.53.0 to fix CVE-2026-39829, CVE-2026-39830, CVE-2026-39832 cockpit-podman - rebuild for CVE-2025-68121 - update to th...

SUSE SLED15 / SLES15 Security Update : go1.26-openssl (SUSE-SU-2026:3102-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3102-1 advisory. This update for go1.26-openssl fixes the following issues - Update to version go1.26.5 bsc1255111. -...

SUSE SLES12 Security Update : python-dulwich (SUSE-SU-2026:3117-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3117-1 advisory. This update for python-dulwich fixes the following issue - CVE-2026-47734: Unbounded memory allocation in receive-pack from crafted thin pac...

RHEL 8 : kernel (RHSA-2026:41229)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:41229 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: KVM: x86: Fix shadow paging...