Linux Distros Unpatched Vulnerability : CVE-2026-46572

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - ntfs-3g - None Ubuntu Linux - In NTFS-3G through 2026.2.25, a heap buffer overflow exists in ntfsibcuttail in libntfs-3g/index.c that allows an...

Amazon Linux 2023 : ansible (ALAS2023-2026-1932)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1932 advisory. A local privilege escalation vulnerability was found in the ansible.posix authorizedkey module. The module's keyfile function uses os.chown instead of os.lchown and opens files without ONOFOLLOW when...

Linux Distros Unpatched Vulnerability : CVE-2026-43663

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, vision...

RHEL 9 : Red Hat OpenStack Services on OpenShift 18.0 (openstack-keystone) (RHSA-2026:39808)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:39808 advisory. Keystone is a Python implementation of the OpenStack http://www.openstack.org identity service API. Security Fixes: Keystone: OpenStack...

SUSE SLES15: helm / helm-bash-completion / helm-fish-completion / etc (SUSE-SU-2026:3050-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3050-1 advisory. This update for helm rebuilds it against the current go security release. Tenable has extracted the preceding description block directly fro...

Linux Distros Unpatched Vulnerability : CVE-2026-61872

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the TIFF encoder when an invalid tiff:tile-geometry is specified. Supplying malformed tile...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : libslirp vulnerability (USN-8550-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8550-1 advisory. It was discovered that libslirp incorrectly handled TCP urgent data. A privileged attacker inside a guest VM could possibly use this issue...

Linux Distros Unpatched Vulnerability : CVE-2026-49854

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, the optional native extension tornado.speedups implemented websocketmask...

RHEL 8 : maven:3.8 (RHSA-2026:40841)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:40841 advisory. Maven is a software project management and comprehension tool. Based on the concept of a project object model POM, Maven can manage a project's buil...

JetBrains TeamCity < 2026.1.2 Multiple Vulnerabilities

The version of JetBrains TeamCity installed on the remote host is prior to 2026.1.2. It is, therefore, affected by multiple vulnerabilities, including: - Arbitrary file access was possible via the Perforce VCS integration. CVE-2026-59793 - Stored XSS via unauthenticated agent registration was...

Fedora 43 : roundcubemail (2026-c3351f4ae4)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-c3351f4ae4 advisory. Release 1.6.17 - Enigma: Support automatic public key lookup import using HKP v1 protocol 5314 - Enigma: Kolab WOAT Support 8626 - Security: Fix an...

AlmaLinux 10 : kernel (ALSA-2026:39494)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:39494 advisory. kernel: crypto: ccp - copy IV using skcipher ivsize CVE-2026-53016 kernel: XFS data corruption using reflink Bug Fixes and Enhancements: Exploits KEV kernel: XFS...

Amazon Linux 2023 : opensc (ALAS2023-2026-1898)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1898 advisory. A flaw has been found in OpenSC up to 0.26.1. This affects the function testkpgencertwrite of the file src/tools/pkcs11-tool.c of the component pkcs11-tool Key Generation Module. This manipulation caus...

Linux Distros Unpatched Vulnerability : CVE-2026-59203

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Pillow is a Python imaging library. From 12.0.0 through 12.2.0, Pillow's EPS parser in PIL/EpsImagePlugin.py accepts a negative byte count in the %%BeginBinary...

Linux Distros Unpatched Vulnerability : CVE-2026-49978

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.7, DOMPurify INPLACE sanitization could skip shadow contents...

RockyLinux 9 : python3.9 (RLSA-2026:39798)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:39798 advisory. python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations CVE-2026-15308 Bug Fixes and Enhancements: python3.9 testssl...

Linux Distros Unpatched Vulnerability : CVE-2026-43726

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tv...

Debian dla-4686 : dhcpcd5 - security update

The remote Debian 11 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-4686 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4686-1 [email protected]...

Amazon Linux 2023 : heif-pixbuf-loader, libheif, libheif-devel (ALAS2023-2026-1919)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1919 advisory. A critical heap-based buffer overflow vulnerability exists in libheif v1.21.2 and likely earlier versions within the handling of uncompressed HEIF images ISO/IEC 23001-17, unci item type. When...

MiracleLinux 8 : openssl-1.1.1k-17.el8_6 (AXSA:2026-1267:12)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1267:12 advisory. openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing CVE-2026-28390 Tenable has extracted the preceding...

RockyLinux 9 : perl-XML-LibXML (RLSA-2026:39553)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:39553 advisory. perl-XML-LibXML: XML::LibXML: Denial of Service via truncated UTF-8 in XML node names CVE-2026-8177 Tenable has extracted the preceding description block directl...

Fedora 44 : rust-opendal (2026-e465328a8d)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-e465328a8d advisory. Update quick-xml to 0.41 RUSTSEC-2026-0194, RUSTSEC-2026-0195 Tenable has extracted the preceding description block directly from the Fedora security advisor...

Linux Distros Unpatched Vulnerability : CVE-2026-50528

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in .NET allows an unauthorized attacker to bypass a security feature over a network. CVE-2026-50528 Note that Nessus relies on the...

Linux Distros Unpatched Vulnerability : CVE-2026-59204

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Pillow is a Python imaging library. From 8.2.0 through 12.2.0, src/libImaging/Jpeg2KDecode.c accumulates totalcomponentwidth across every tile in a JPEG2000 ima...

AlmaLinux 9 : perl-XML-LibXML (ALSA-2026:39553)

The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:39553 advisory. perl-XML-LibXML: XML::LibXML: Denial of Service via truncated UTF-8 in XML node names CVE-2026-8177 Tenable has extracted the preceding description block directly...

Linux Distros Unpatched Vulnerability : CVE-2026-61864

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in color transformation to the log colorspace: when the operation fails, a small amount of memo...

Golang 1.25.x < 1.25.12 / 1.26.x < 1.26.5 Multiple Vulnerabilities

The version of Golang running on the remote host is 1.25.x prior to 1.25.12 or 1.26.x prior to 1.26.5. It is, therefore, affected by multiple vulnerabilities: - On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component...

Slackware Linux 15.0 / current netatalk Multiple Vulnerabilities (SSA:2026-197-01)

The version of netatalk installed on the remote host is prior to 4.5.1. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2026-197-01 advisory. New netatalk packages are available for Slackware 15.0 and -current to fix security issues. Tenable has extracted the...

Linux Distros Unpatched Vulnerability : CVE-2026-57108

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Access of resource using incompatible type 'type confusion' in .NET Core allows an unauthorized attacker to deny service over a network. CVE-2026-57108 Note tha...

MiracleLinux 9 : tigervnc-1.15.0-7.el9_8.1.ML.1 (AXSA:2026-1265:06)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1265:06 advisory. xorg: xwayland: X.Org X server: Denial of Service via integer underflow in XKB compatibility map handling CVE-2026-33999 xwayland: xorg: X.Org X...

Linux Distros Unpatched Vulnerability : CVE-2026-56136

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - ntfs-3g - None Ubuntu Linux - In NTFS-3G through 2026.2.25, an out-of-bounds read exists in ntfsirnill in libntfs-3g/index.c that allows an...

Fedora 44 : ImageMagick (2026-b45924b5e5)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-b45924b5e5 advisory. Update to 7.1.2.27 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested...

SUSE SLES15 Security Update : rootlesskit (SUSE-SU-2026:3045-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3045-1 advisory. This update for rootlesskit rebuilds it against the current go security release. Tenable has extracted the preceding description block...

Amazon Linux 2023 : haproxy (ALAS2023-2026-1915)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1915 advisory. HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpackdhtinsert within src/hpack-tbl.c that fails to validate the return value of hpackdhtdefrag when...

AlmaLinux 9 : libreoffice (ALSA-2026:36832)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:36832 advisory. libreoffice: LibreOffice Calc: Arbitrary code execution via heap buffer overflow in formula compilation CVE-2026-8357 Tenable has extracted the preceding...

Linux Distros Unpatched Vulnerability : CVE-2026-54572

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, with -l/--links, rclone serialize...

Linux Distros Unpatched Vulnerability : CVE-2026-61869

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the MIFF encoder that occurs when a memory allocation fails during MIFF image processing,...

Alibaba Cloud Linux 3 : 0207: unbound (ALINUX3-SA-2026:0207)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2026:0207 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-40622: NLnet Labs Unbound 1.16.2 ...

Linux Distros Unpatched Vulnerability : CVE-2026-15777

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in UI in Google Chrome on Linux prior to 150.0.7871.125 allowed a remote attacker who convinced a user to engage in specific UI gestures to...

openSUSE 16: tomcat11 / tomcat11-admin-webapps / tomcat11-el-6_0-api / etc (openSUSE-SU-2026:21329-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21329-1 advisory. This update for tomcat11 fixes the following issues Update to Tomcat 11.0.23. Security issues fixed: - CVE-2026-50229: improper neutralization o...

SUSE SLES15 Security Update : terraform-provider-susepubliccloud (SUSE-SU-2026:3057-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3057-1 advisory. This update for terraform-provider-susepubliccloud fixes the following issues - CVE-2022-41723: go1.19,go1.20: net/http2: quadratic...

Amazon Linux 2023 : python3, python3-devel, python3-idle (ALAS2023-2026-1933)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1933 advisory. The tarfile module would still apply normalization of AREGTYPE \x00 blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPELONGNAME or GNUTYPELONGLINK. This could result ...

Amazon Linux 2023 : nodejs24, nodejs24-devel, nodejs24-full-i18n (ALAS2023-2026-1920)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1920 advisory. When undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather than the case-insensitive exact match specified by RFC...

RHEL 8 : nodejs:24 (RHSA-2026:39868)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:39868 advisory. Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language...

Amazon Linux 2023 : nodejs22, nodejs22-devel, nodejs22-full-i18n (ALAS2023-2026-1921)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1921 advisory. When undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather than the case-insensitive exact match specified by RFC...

Linux Distros Unpatched Vulnerability : CVE-2026-47302

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network. CVE-2026-47302 Note that Nessus...

Alibaba Cloud Linux 3 : 0204: libxml2 (ALINUX3-SA-2026:0204)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2026:0204 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2025-6170: A flaw was found in the interactive...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS : LuaJIT vulnerabilities (USN-8544-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8544-1 advisory. It was discovered that LuaJIT incorrectly handled certain inputs. An attacker could possibly...

Mitel 6800 / 6900 / 6900w Series SIP Phone Argument Injection Vulnerability (CVE-2024-41710)

According to its self-reported version, the remote Mitel IP Phone running SIP Software is affected by an argument injection vulnerability: - A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, through R6.4.0.HF1 R6.4.0.136 could allow an authenticated attacker with...

Linux Distros Unpatched Vulnerability : CVE-2026-62321

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - netatalk - None Ubuntu Linux - Unknown description CVE-2026-62321 Note that Nessus relies on the presence of the package as reported by the vendo...