Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : NTFS-3G vulnerabilities (USN-8554-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8554-1 advisory. It was discovered that NTFS-3G had a heap buffer overflow when reading certain NTFS images. A local attacker could possibly use...

Oracle Linux 10 : .NET / 10.0 (ELSA-2026-22145)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-22145 advisory. 10.0.109-1.0.1 - Add support for Oracle Linux 10.0.109-1 - Update to .NET SDK 10.0.109 and Runtime 10.0.9 - Resolves: RHEL-181559 10.0.108-1 - Update to .NET...

Oracle Linux 10 : perl-HTTP-Daemon (ELSA-2026-36189)

The remote Oracle Linux 10 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-36189 advisory. - Fix CVE-2026-8450: sendfile shell-magic via 2-arg open Tenable has extracted the preceding description block directly from the Oracle Linux security advisor...

Linux Distros Unpatched Vulnerability : CVE-2026-47082

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The vacation fcc feature skips the destination-mailbox ACL. A user whose vacation Sieve...

SAP NetWeaver Enterprise Portal XSS (3746678)

The version of SAP NetWeaver Application Server Java detected on the remote host is affected by a cross-site scripting vulnerability as referenced in SAP Security Note 3746678: - SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. T...

Rockwell Studio 5000 Logix Designer Incorrect Authorization RCE (SD1783)

The version of Rockwell Studio 5000 Logix Designer installed on the remote Windows host is affected by a remote code execution vulnerability. Due to incorrect authorization on a configuration file, any authenticated user can modify the paths of external tools configured within the application. An...

Photon OS 4.0: Mysql PHSA-2026-4.0-1058

An update of the mysql package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-4.0-1058. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Oracle Linux 10 : post (ELSA-2026-25930)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-25930 advisory. 2:3.8.5-10 - Fix for CVE-2026-43964: buffer over-read via malformed enhanced status code. Resolves: RHEL-176554 Tenable has extracted the preceding descriptio...

RabbitMQ 3.13.x < 3.13.14 / 4.0.x < 4.0.19 / 4.1.x < 4.1.10 / 4.2.x < 4.2.5 Multiple Vulnerabilities

The version of RabbitMQ installed on the remote host is affected by multiple vulnerabilities: - The rabbitmqmanagement HTTP API accepts oversized valid JSON bodies on withdecode and directrequest paths because readcompletebody checks the accumulated size before the final chunk but not the final...

Cisco IP and Video Phone Multiple Vulnerabilities (cisco-sa-ipphone-multi-vulns-cXAhCvS)

According to its self-reported version, the remote Cisco IP or Video Phone running SIP Software is affected by multiple vulnerabilities: - A vulnerability in the web-based management interface of Cisco IP Phone firmware could allow an unauthenticated, remote attacker to cause an affected device t...

Fedora 43 : rust-cargo-rpmstatus (2026-6d5a7be3b9)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-6d5a7be3b9 advisory. Update to 0.2.5 with dependency updates only, and further update some dependencies. Particularly, quick- xml 0.41 fixes RUSTSEC-2026-0194 and...

Security Updates for Microsoft Office Products C2R (July 2026)

The Microsoft Office Products are missing security updates. It is, therefore, affected by multiple vulnerabilities: - Out-of-bounds read in Microsoft Office allows an unauthorized attacker to execute code locally. CVE-2026-55045 - Use after free in Microsoft Office allows an unauthorized attacker...

SUSE SLES16: tomcat10 / tomcat10-admin-webapps / tomcat10-doc / etc (SUSE-SU-2026:22647-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:22647-1 advisory. This update for tomcat10 fixes the following issues Update to Tomcat 10.1.56. Security issues fixed: - CVE-2026-50229: improper...

Linux Distros Unpatched Vulnerability : CVE-2026-46377

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.10.1, the escape sequence handler in...

Oracle Linux 10 : ruby (ELSA-2026-33565)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-33565 advisory. - Fix DoS via crafted IMAP responses in net-imap. CVE-2026-42245 Resolves: RHEL-181687 - Fix information disclosure via MITM attack bypassing TLS in...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : Authlib vulnerabilities (USN-8557-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8557-1 advisory. Jay Neiva and Mauro Carrillo discovered that Authlib did not properly validate cryptographic keys embedded in JWT headers. An...

MiracleLinux 9 : firefox-140.10.2-1.el9_8.ML.1 (AXSA:2026-1283:16)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1283:16 advisory. firefox: Other issue in the WebRTC component CVE-2026-8094 firefox: Memory safety bugs fixed in Firefox ESR 115.35.2, Firefox ESR 140.10.2 and Firef...

Oracle Linux 10 : frr (ELSA-2026-24347)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-24347 advisory. 10.4.4-1 - Resolves: RHEL-166035 - Bump FRR to 10.4.3 to fix EVPN problems Tenable has extracted the preceding description block directly from the...

SUSE SLES15 Security Update : kernel (Live Patch 15 for SUSE Linux Enterprise 15 SP7) (SUSE-SU-2026:3075-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3075-1 advisory. This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.53.55 fixes various security issues The following security issues were fixed: -...

Oracle Linux 10 : mod_md (ELSA-2026-30845)

The remote Oracle Linux 10 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-30845 advisory. - Resolves: RHEL-175647 - modmd: OCSP response limits CVE-2026-29168 - Resolves: RHEL-134484 - httpd: Apache HTTP Server: modmd ACME, unintended retry interva...

7-Zip < 26.01 NTFS Heap Buffer Overflow (GHSL-2026-140)

The version of 7-Zip installed on the remote Windows host is prior to 26.01. It is, therefore, affected by a vulnerability: - A heap buffer overflow vulnerability exists in the NTFS archive handler. The CInStream::GetCuSize function computes the compression-unit buffer size using a 32-bit shift...

Oracle Linux 10 : httpd (ELSA-2026-34109)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-34109 advisory. - Resolves: RHEL-186221 - httpd: Apache HTTP Server: Heap-based Buffer Overflow via malicious backend servers CVE-2026-34356 - Resolves: RHEL-186195 ...

ImageMagick 7.x < 7.1.2-19 Heap Buffer Overflow

The remote host has a version of ImageMagick installed that is 7.x prior to 7.1.2-19. It is, therefore, affected by a heap buffer overflow vulnerability: - ImageMagick before 7.1.2-19 contains a heap buffer overflow vulnerability in the FTXT encoder due to missing boundary checks when parsing...

Oracle Linux 10 : skopeo (ELSA-2026-29035)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-29035 advisory. - Rebuild for CVE-2026-25679 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus...

Fedora 43 : mingw-glib2 (2026-8e39f35701)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-8e39f35701 advisory. Backport fix for CVE-2026-58016. ---- Update to glib-2.86.5. Tenable has extracted the preceding description block directly from the Fedora security...

Oracle Linux 10 : glib2 (ELSA-2026-19148)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-19148 advisory. 2.80.4-13 - Fix CVE-2025-14087 and CVE-2025-14512 Tenable has extracted the preceding description block directly from the Oracle Linux security...

WordPress 7.0 < 7.0.2

WordPress versions 7.0 7.0.2 are affected by one or more vulnerabilities %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from WordPress Security Advisory wordpress-7-0-2-release. include'compat.inc'; if description scriptid327666;...

Oracle Linux 10 : perl-Archive-Tar (ELSA-2026-30857)

The remote Oracle Linux 10 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-30857 advisory. - Fix CVE-2026-42496: validate symlink and hardlink targets in secure extract mode Tenable has extracted the preceding description block directly from the...

RHEL 7 : kernel-rt (RHSA-2026:41236)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:41236 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism...

Oracle Linux 10 : kernel (ELSA-2026-39494)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-39494 advisory. - crypto: ccp - copy IV using skcipher ivsize CKI Backport Bot RHEL-188463 CVE-2026-53016 - futex/requeue: Revert 'Prevent NULL pointer dereference i...

SUSE SLES16 Security Update : go1.25-openssl (SUSE-SU-2026:22638-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:22638-1 advisory. This update for go1.25-openssl fixes the following issues - Update to version go1.25.12 bsc1244485. - CVE-2025-61732: cmd/cgo:...

openSUSE 16: gimp / gimp-devel / gimp-extension-goat-excercises / gimp-lang / etc (openSUSE-SU-2026:21359-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21359-1 advisory. Changes in gimp: - CVE-2026-58379: Fix PSP File Parsing Heap Buffer Overflow bsc1270299 - CVE-2026-58380: Fix buffer overflow in...

Oracle Linux 10 : libcap (ELSA-2026-19130)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-19130 advisory. 2.69-7.1 - Fix TOCTOU race condition in capsetfile CVE-2026-4878 Resolves: RHEL-169302 Tenable has extracted the preceding description block directly from the...

Linux Distros Unpatched Vulnerability : CVE-2026-57075

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via a signed-char lookup-table index in syckbase64dec. The base64 decoder in the bundled...

Oracle Linux 10 : giflib (ELSA-2026-33502)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-33502 advisory. - fix CVE-2026-26740: buffer overflow in EGifGCBToExtension RHEL-157086 Tenable has extracted the preceding description block directly from the Oracle Linux...

Security Updates for Microsoft SharePoint Server 2019 (July 2026)

The Microsoft SharePoint Server 2019 installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network. CVE-2026-505...

Alibaba Cloud Linux 3 : 0209: kernel (ALINUX3-SA-2026:0209)

"The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2026:0209 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-43499: In the Linux kernel, the...

SUSE SLES12 Security Update : rpcbind (SUSE-SU-2026:3078-1)

The remote SUSE Linux SLES12 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2026:3078-1 advisory. This update for rpcbind fixes the following issue - Fix several memory leaks and buffer overflow bsc1267212. Tenable has extracted the preceding...

Oracle Linux 10 : libsoup3 (ELSA-2026-19143)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-19143 advisory. - Add patches for CVE-2026-4271 and CVE-2026-5119 - Add patch for CVE-2026-1761 - Fix CVE-2026-0719 - Fix CVE-2025-14523 - Add patch for CVE-2025-121...

RockyLinux 9 : jackson-annotations, jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base (RLSA-2026:40895)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:40895 advisory. jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution CVE-2026-54513 jackson-databind: jackson-databind: Arbitrary code...

SUSE SLES16: cryptsetup / cryptsetup-doc / cryptsetup-lang / cryptsetup-ssh / etc (SUSE-SU-2026:22645-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:22645-1 advisory. Changes in cryptsetup: - Fix for bsc1270254 to avoid undesired pinning of all volume keys via the thread keyring through the caller's...

Security Updates for Microsoft SharePoint Server Subscription Edition (July 2026)

The Microsoft SharePoint Server Subscription Edition installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a...

SUSE SLES15 Security Update : python-urllib3 (SUSE-SU-2026:2854-2)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:2854-2 advisory. This update for python-urllib3 fixes the following issue - Regression introduced by CVE-2025-66471 fix during file download with pySSL...

RHEL 8 : nodejs:24 (RHSA-2026:39868)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:39868 advisory. Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language...

Linux Distros Unpatched Vulnerability : CVE-2026-47302

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network. CVE-2026-47302 Note that Nessus...

Alibaba Cloud Linux 3 : 0204: libxml2 (ALINUX3-SA-2026:0204)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2026:0204 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2025-6170: A flaw was found in the interactive...

Mitel 6800 / 6900 / 6900w Series SIP Phone Argument Injection Vulnerability (CVE-2024-41710)

According to its self-reported version, the remote Mitel IP Phone running SIP Software is affected by an argument injection vulnerability: - A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, through R6.4.0.HF1 R6.4.0.136 could allow an authenticated attacker with...

Linux Distros Unpatched Vulnerability : CVE-2026-62321

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - netatalk - None Ubuntu Linux - Unknown description CVE-2026-62321 Note that Nessus relies on the presence of the package as reported by the vendo...

Linux Distros Unpatched Vulnerability : CVE-2026-45363

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ruby-jwt is a Ruby implementation of the RFC 7519 OAuth JSON Web Token standard. Prior to 2.10.3 and 3.2.0, JWT.decodetoken, '', true, algorithm: 'HS256' accept...

RHEL 9 : gimp (RHSA-2026:40751)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:40751 advisory. The GIMP GNU Image Manipulation Program is an image composition and editing program. GIMP provides a large image manipulation toolbox,...