FreeBSD : podman -- podman quadlet install --replace does not fully replace the old file (01c15468-9b7b-11f1-a75c-589cfc10a551)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 01c15468-9b7b-11f1-a75c-589cfc10a551 advisory. The Podman developers report: When running podman quadlet install --replace to replace a Quadlet file, ...

Photon OS 5.0: Coreutils PHSA-2026-5.0-91-0960

An update of the coreutils package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-91-0960. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

SUSE SLED15 / SLES15 Security Update : go1.25 (SUSE-SU-2026:3640-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3640-1 advisory. Security issues fixed: - CVE-2026-33818: encoding/asn1: enforce maximum recursion depth bsc1275034. -...

Linux Distros Unpatched Vulnerability : CVE-2026-17106

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The tar extraction routines in moby/go-archive Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers do not confine filesystem operations to...

Oracle MySQL ODBC Connector 26.7.0 < 26.7.1 (August 2026 CSPU)

The 26.7.0 versions of MySQL Connector/ODBC installed on the remote host are affected by multiple vulnerabilities as referenced in the August 2026 CSPU advisory. - Vulnerability in the MySQL Connectors product of Oracle MySQL component: Connector/ODBC. The supported version that is affected is...

Linux Distros Unpatched Vulnerability : CVE-2026-68939

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Pyenv provides simple Python version management. Prior to 2.8.0, isversionsafe in libexec/pyenv- version-file-read accepts shell glob metacharacters in...

RHEL 9 : php:8.2 (RHSA-2026:40416)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:40416 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: PHP OpenSSL extension: Denial of Service...

Oracle Linux 8 : sg3_utils (ELSA-2026-56130)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-56130 advisory. 1.44-6.1 - sginq output conformance for SCSI name string and ATA fields RHEL-188162 Tenable has extracted the preceding description block directly from the...

Linux Distros Unpatched Vulnerability : CVE-2026-18691

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in MongoDB Server's intra-cluster connection setup could allow a party with suitable network access to influence which authentication mechanism is used...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libssh2 (UTSA-2026-102688)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102688 advisory. libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that allows a malicious SSH server to trigger an arbitrary-length heap...

Linux Distros Unpatched Vulnerability : CVE-2026-74414

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: hfsplus: Remove the duplicate attr inode dirty marking action Syzbot reported a null-ptr-der...

RHEL 8 : gstreamer1-plugins-good (RHSA-2026:56966)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:56966 advisory. GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages conta...

Linux Distros Unpatched Vulnerability : CVE-2026-23930

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend...

Oracle Linux 8 : nghttp2 (ELSA-2026-55804)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-55804 advisory. 1.33.0-6.3 - fix HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests CVE-2026-58055 Tenable has extracted the...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: php (UTSA-2026-102686)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102686 advisory. Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versionsfrom 8.2. before 8.2.33, from 8.3. before 8.3.3...

RHEL 9 : kernel (RHSA-2026:56574)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:56574 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: scsi: core: Wake up the error...

Linux Distros Unpatched Vulnerability : CVE-2026-74952

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 154, Thunderbird 154, Firefox ESR 153.2, and Thunderbird 153.2...

Linux Distros Unpatched Vulnerability : CVE-2026-63639

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload th...

Linux Distros Unpatched Vulnerability : CVE-2026-23931

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The frontend validatate.api.exists action can be exploited by authenticated users to extract plaintext user macro values leading to potential loss of...

Oracle Linux 8 : attr (ELSA-2026-56133)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-56133 advisory. - rebase to 2.6.0 to fix the following CVEs: - CVE-2026-54371 - Symlink Traversal Privilege Escalation via getfattr RHEL-186121 Tenable has extracted the...

MiracleLinux 8 : unbound-1.16.2-5.14.el8_10 (AXSA:2026-1573:10)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1573:10 advisory. unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes CVE-2026-44690 Tenable has extracted the preceding...

MiracleLinux 8 : perl-DBI:1.641 (AXSA:2026-1570:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1570:01 advisory. DBI: Heap overflow when preparsing SQL statements with excessive placeholders CVE-2026-14739 DBI: Arbitrary code execution via caller-influenced...

Linux Distros Unpatched Vulnerability : CVE-2026-18688

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in MongoDB Server's aggregation framework could allow an authenticated user to trigger an out-of- bounds memory read by providing a specially formed...

Fedora 44 : libgit2 (2026-86684eb696)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-86684eb696 advisory. Update to version 1.9.7. Release notes: https://github.com/libgit2/libgit2/releases/tag/v1.9.7 Tenable has extracted the preceding description block directly...

AlmaLinux 10 : mysql8.4 (ALSA-2026:56007)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:56007 advisory. mysql: Performance Schema unspecified vulnerability CPU Jul 2026 CVE-2026-61081 mysql: Optimizer unspecified vulnerability CPU Jul 2026 CVE-2026-47064...

Oracle Linux 9 : curl (ELSA-2026-55439)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-55439 advisory. - fix HTTP Negotiate connection reuse auth bypass CVE-2026-1965 - fix OAuth2 bearer token leak via redirect and netrc CVE-2026-3783 - fix SSH host key...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: bind (UTSA-2026-103699)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-103699 advisory. It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. This...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: gstreamer1-plugins-good (UTSA-2026-102691)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102691 advisory. A flaw was found in GStreamer's gst-plugins-good. A heap-based out-of-bounds read of 4 bytes can occur when parsing FLAC audio stream headers embedded in a Matroska ...

Linux Distros Unpatched Vulnerability : CVE-2026-18687

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - MongoDB Server's handling of a Queryable Encryption maintenance operation did not properly validate certain request parameters against the collection's encrypte...

SUSE SLES12 Security Update : rsync (SUSE-SU-2026:3629-1)

The remote SUSE Linux SLES12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3629-1 advisory. - CVE-2026-29518: Symlink-Race TOCTOU in Daemon bsc1264511. - CVE-2026-43619: Symlink Race Condition via Path-Based Syscalls bsc1264514. Tenabl...

Linux Distros Unpatched Vulnerability : CVE-2025-71405

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - chi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that uses the Host header to construct redirect URL...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: ffmpeg (UTSA-2026-102684)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102684 advisory. Buffer Overflow vulnerability exists in FFmpeg 4.1 via apngdoinverseblend in libavcodec/pngenc.c, which could let a remote malicious user cause a Denial of Service...

Fedora 44 : lemonldap-ng (2026-55e1334aed)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-55e1334aed advisory. Update to 2.23.3 Fixes CVE-2026-19349 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has...

RHEL 8 : mysql:8.4 (RHSA-2026:56936)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:56936 advisory. MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon mysqld and many client programs and...

Linux Distros Unpatched Vulnerability : CVE-2026-23937

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Zabbix API host.get action can be exploited by authenticated users to extract a host's PSK key leading to potential loss of data integrity. CVE-2026-23937...

RHEL 9 : gegl04 (RHSA-2026:56963)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:56963 advisory. GEGL Generic Graphics Library is a graph-based image processing framework. Security Fixes: gimp: GIMP: Arbitrary code execution via heap-based buffe...

AlmaLinux 8 : php:7.4 (ALSA-2026:47750)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:47750 advisory. php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD CVE-2026-14355 Bug Fixes and Enhancements: Backport fix for...

CentOS 9 : nghttp2-1.43.0-8.el9

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the nghttp2-1.43.0-8.el9 build changelog. - nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content- Length header and body onto reusable...

AlmaLinux 8 : sg3_utils (ALSA-2026:56130)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:56130 advisory. sg3utils: sg3utils: arbitrary command execution via udev property injection in sginq --export CVE-2026-16313 Bug Fixes and Enhancements: sginq output conformance...

Oracle Linux 8 : gstreamer1-plugins-good (ELSA-2026-56966)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-56966 advisory. - Fix CVE-2026-73434: out-of-bounds read in AVI demuxer vprp handling Resolves: RHEL-239048 - Fix CVE-2026-18649 in H.264/H.265 RTP depayloaders...

RHEL 9 : perl-Date-Manip (RHSA-2026:56970)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:56970 advisory. Date::Manip is a series of modules designed to make any common date/time operation easy to do. Operations such as comparing two times, determining a...

Linux Distros Unpatched Vulnerability : CVE-2026-68765

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - hashcat master branch builds after v7.1.2 contain a heap buffer overflow vulnerability in the KeePass AESKDF/KDBX v4 module module 34301 that allows attackers t...

RockyLinux 9 : .NET 10.0 (RLSA-2026:55857)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:55857 advisory. .NET: .NET Core: .NET Security Feature Bypass Vulnerability CVE-2026-62899 .NET: .NET Information Disclosure Vulnerability CVE-2026-62900 .NET: .NET...

Fedora 44 : radsecproxy (2026-099bb42b08)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-099bb42b08 advisory. radsecproxy 1.11.4 2026-08-10 Bug Fixes - Fix potential crash when rewrite is too big - Fix Message-Authenticator verification for CoA/Disconnect-Request - F...

Linux Distros Unpatched Vulnerability : CVE-2026-72889

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Net::OAuth versions before 0.33 for Perl allow the sender to choose the signature algorithm in verify. verify resolves the signature method class from the...

Linux Distros Unpatched Vulnerability : CVE-2026-75589

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non- constant-time comparison in verify. Each of the three...

RHEL 9 : gstreamer1-plugins-bad-free (RHSA-2026:56658)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:56658 advisory. GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package...

Linux Distros Unpatched Vulnerability : CVE-2026-76039

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect reference resolution in Core in Google Chrome on on Android prior to 151.0.7922.169 allowed a remote attacker leveraging social engineering to obtain...

MiracleLinux 8 : perl-DBI:1.641 (AXSA:2026-1572:02)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1572:02 advisory. DBI: Heap overflow when preparsing SQL statements with excessive placeholders CVE-2026-14739 DBI: Arbitrary code execution via caller-influenced...

Oracle WebLogic Server Remote Takeover (August 2026 CPU) (12.2.1.4.0 / 14.1.1.0.0 / 14.1.2.0.0)

The 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0 versions of WebLogic Server installed on the remote host are affected by a vulnerability as referenced in the August 2026 CPU advisory. - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: WLS Core Components...