RockyLinux 9 : mrtg (RLSA-2026:57600)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:57600 advisory. mrtg: MRTG daemon symlink-following chown allows local privilege escalation via PID file path manipulation CVE-2026-72694 Tenable has extracted the preceding...

Unity Linux 20.1070a Security Update: attr (UTSA-2026-102708)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102708 advisory. attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by...

Linux Distros Unpatched Vulnerability : CVE-2026-19685

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NetworkManager did not apply the privateuser restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix fo...

openSUSE 16 Security Update : python-unearth (openSUSE-SU-2026:21606-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21606-1 advisory. Changes in python-unearth: - CVE-2026-73030: iswithindirectory function fails to normalize paths before validation and allows ../ sequences to bypass...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: postgresql (UTSA-2026-099437)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099437 advisory. Stack buffer overflow in PostgreSQL module refint allows an unprivileged database user to execute arbitrary code as the operating system user running the database. A...

openSUSE 16: kubevirt1.8-container-disk / kubevirt1.8-libguestfs-tools / etc (openSUSE-SU-2026:21590-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21590-1 advisory. Update to version 1.8.4. Security issues fixed: - CVE-2026-13201: virt-handler-rhel9: kubevirt: safepath OpenAtNoFollow symlink following via...

Linux Distros Unpatched Vulnerability : CVE-2026-18300

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GIMP HDR File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2024-002902)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2024-002902 advisory. In the Linux kernel, the following vulnerability has been resolved: KVM: s390: fix setting of fpc register kvmarchvcpuioctlsetfpu allows to set the floating point...

Python Library sqlparse < 0.6.0 Multiple Vulnerabilities

The version of the sqlparse Python library installed on the remote host is prior to 0.6.0. It is, therefore, affected by multiple vulnerabilities: - A denial of service vulnerability exists in sqlparse due to the regular expressions used by the lexer to match dollar-quoted strings and multiline...

Unity Linux 20.1050e / 20.1070e Security Update: kernel (UTSA-2025-001417)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-001417 advisory. In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential out-of-bounds memory access in nilfsfindentry Syzbot reported that when...

Fedora 44 : php-phpseclib3 (2026-d2d58edf7d)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-d2d58edf7d advisory. Update to v3.0.56 - contains fixes for CVE-2026-40194 and CVE-2026-44167 Tenable has extracted the preceding description block directly from the...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-001490)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-001490 advisory. In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: always wait for both firmware loading attempts In 'rtwwaitfirmwarecompletion', alway...

Kibana 8.x < 8.19.20 / 9.0.x < 9.3.8 / 9.4.x < 9.4.5 Denial of Service (ESA-2026-101)

The version of Kibana installed on the remote host is 8.x prior to 8.19.20, 9.0.x prior to 9.3.8, or 9.4.x prior to 9.4.5. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-101 advisory. - Uncaught Exception CWE-248, resulting from Improper Input Validation CWE-20, in...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102040)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102040 advisory. In the Linux kernel, the following vulnerability has been resolved: sound: ua101: fix division by zero at probe Add a missing sanity check for bNrChannels in...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102073)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102073 advisory. In the Linux kernel, the following vulnerability has been resolved: btrfs: avoid potential out-of-bounds in btrfsencodefh The function btrfsencodefh does not properl...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: skopeo (UTSA-2026-102706)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102706 advisory. Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web...

FreeBSD : qt6-webengine -- multiple vulnerabilities (a188c081-9ce8-11f1-8fc6-cb9659fdabad)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the a188c081-9ce8-11f1-8fc6-cb9659fdabad advisory. Qt qtwebengine-chromium repo reports: Backports for 747 security bugs in Chromium: Tenable has...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-001498)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-001498 advisory. In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix kernel bug due to missing clearing of checked flag Syzbot reported that in directory...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102039)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102039 advisory. In the Linux kernel, the following vulnerability has been resolved: tipc: fix use-after-free of the discoverer in tipcdiscrcv bearerdisable frees b-disc with...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102017)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102017 advisory. In the Linux kernel, the following vulnerability has been resolved: crypto: jitterentropy - replace long-held spinlock with mutex jentkcapirandom serializes the shar...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102081)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102081 advisory. In the Linux kernel, the following vulnerability has been resolved: crypto: asymmetrickeys - prevent overflow in asymmetrickeygenerateid Use checkaddoverflow to guar...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102050)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102050 advisory. In the Linux kernel, the following vulnerability has been resolved: RDMA/vmwpvrdma: Fix double free on pvrdmaallocucontext error path Sashiko points out that...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102048)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102048 advisory. In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Add sanity check for OOB writes at silencing At silencing the playback URB packe...

Linux Distros Unpatched Vulnerability : CVE-2026-18296

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GStreamer MRF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code ...

Oracle Business Intelligence Publisher (August 2026 CSPU)

The 8.2.0.0.0 and 26.01.0.0.0 versions of Oracle Business Intelligence Publisher installed on the remote host are affected by multiple vulnerabilities as referenced in the August 2026 CSPU advisory. - Vulnerability in the Oracle BI Publisher product of Oracle Analytics component: Web Service API...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-001484)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-001484 advisory. In the Linux kernel, the following vulnerability has been resolved: f2fs: compress: fix to cover reserve,releasecompressblocks w/ cprwsem lock It needs to cover...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102085)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102085 advisory. In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix divide-by-zero in setupgeo with zero farcopies setupgeo extracts nearcopies nc and...

Linux Distros Unpatched Vulnerability : CVE-2026-18295

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GStreamer MRF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on...

RHEL 9 : mod_md (RHSA-2026:57844)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:57844 advisory. This module manages common properties of domains for one or more virtual hosts. Specifically it can use the ACME protocol to automate certificate...

AlmaLinux 10 : kbd (ALSA-2026:57597)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:57597 advisory. kbd: Local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login CVE-2026-72693 Tenable has extracted the...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-001466)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-001466 advisory. In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix dfs radar event locking The ath11k active pdevs are protected by RCU but the DF...

Photon OS 5.0: Nss PHSA-2026-5.0-92-0965

An update of the nss package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-92-0965. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2025-002625)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-002625 advisory. In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: Fix BT enable failure again for QCA6390 after warm reboot Commit 272970be3dab...

Linux Distros Unpatched Vulnerability : CVE-2026-63381

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a use-after-free in buffer.c when evbufferaddbufferreference processes ...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: php (UTSA-2026-102698)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102698 advisory. Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process,in PHP versionsfrom 8.2. before 8.2.3...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102024)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102024 advisory. In the Linux kernel, the following vulnerability has been resolved: ip6vti: set netnsimmutable on the fallback device. john1988 and Noam Rathaus reported that...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102094)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102094 advisory. In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad KVM: x86:...

Kibana 8.x < 8.19.20 / 9.x < 9.4.4 Incorrect Authorization (ESA-2026-90)

The version of Kibana installed on the remote host is 8.x prior to 8.19.20, or 9.x prior to 9.4.4. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-90 advisory. - Incorrect Authorization CWE-863 in Kibana can lead to unauthorized deletion of Synthetics private locations...

Linux Distros Unpatched Vulnerability : CVE-2026-18309

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GIMP APNG File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected...

openSUSE 16: libpython3_13-1_0 / libpython3_13-1_0-x86-64-v3 / libpython3_13t1_0 / etc (openSUSE-SU-2026:21595-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21595-1 advisory. - CVE-2025-15366: user-controlled command can allow additional commands injected using newlines bsc1257044. - CVE-2025-15367: control characters...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102053)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102053 advisory. In the Linux kernel, the following vulnerability has been resolved: dm cache: fix write hang in passthrough mode The invalidateremove function has incomplete logic f...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102070)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102070 advisory. In the Linux kernel, the following vulnerability has been resolved: net: bridge: use a stable FDB dst snapshot in RCU readers Local FDB entries can be rewritten in...

RockyLinux 8 : gstreamer1-plugins-good (RLSA-2026:56966)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:56966 advisory. gst-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay RTP depayloaders CVE-2026-18649 gstreamer1-plugins-good:...

Elasticsearch 8.11.x < 8.18.0 DoS (ESA-2026-111)

The version of Elasticsearch installed on the remote host is 8.11.x prior to 8.18.0. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-111 advisory. - Memory Allocation with Excessive Size Value CWE-789 in the ES|QL query processing of Elasticsearch can lead to denial of...

JetBrains YouTrack < 2026.2.18068 Stored XSS (CVE-2026-75048)

The version of JetBrains YouTrack installed on the remote host is prior to 2026.2.18068. It is, therefore, affected by a stored cross-site scripting vulnerability: - Stored XSS via the fenced code-block language label was possible. CVE-2026-75048 Note that Nessus has not tested for this issue but...

AlmaLinux 8 : kernel-rt (ALSA-2026:57254)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:57254 advisory. kernel: net: ieee802154: do not leave a dangling sk pointer in ieee802154create CVE-2024-56602 kernel: ip6gre: Use cached t-net in ip6erspanchangelink...

Debian dla-4747 : python3-httplib2 - security update

The remote Debian 11 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-4747 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4747-1 [email protected]...

Oracle Linux 10 : yggdrasil (ELSA-2026-57126)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-57126 advisory. 0.4.9.2-2 - Rebuild yggdrasil against updated golang Tenable has extracted the preceding description block directly from the Oracle Linux security advisory...

Linux Distros Unpatched Vulnerability : CVE-2026-71116

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.14. Difficult to explo...

RHEL 8 : webkit2gtk3 (RHSA-2026:57348)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:57348 advisory. WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fixes: Mozilla: Arbitrary JavaScript...