Linux Distros Unpatched Vulnerability : CVE-2026-99104

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: schedext: Fix the bypass dispatch claim for schedulers bypassed by an ancestor scxbypass...

Oracle Linux 8 : libXtst (ELSA-2026-91294)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-91294 advisory. 1.2.3-8 - CVE-2026-94286 libXtst: libXtst: Denial of Service via out-of-bounds read in RECORD reply parser in RECORD reply parser Tenable has extracted the...

Linux Distros Unpatched Vulnerability : CVE-2026-117864

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Sandbox escape in the Form Manager component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-146833)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146833 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: nflog: unregister loggers before per-net teardown nflogsyslog and nfnetlinklog...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-146851)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146851 advisory. In the Linux kernel, the following vulnerability has been resolved: ALSA: us122l: Prevent write upgrades for read mappings The hwdep mmap callback rejects read-buffe...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-146689)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146689 advisory. In the Linux kernel, the following vulnerability has been resolved: iio: chemical: atlas-sensor: use iiotriggerpollnested to fix remove UAF The atlas driver request...

Linux Distros Unpatched Vulnerability : CVE-2026-99116

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: psp: do not inherit the Rx association on clone sk-pspassoc sits past skdontcopyend, so sockcopy copies it into every socket accepted from a listener witho...

Oracle Linux 10 : libX11 (ELSA-2026-91366)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-91366 advisory. 1.8.10-1.1 - CVE-2026-88806 libX11: libX11: Heap-based buffer overflow via malicious X server X server Resolves: https://issues.redhat.com/browse/RHEL-267123...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-146811)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146811 advisory. In the Linux kernel, the following vulnerability has been resolved: net: mpls: clear innerprotocol when the last label is popped skbmplspush records the...

Rocky Linux 8 [CIQ] Security Update: cpp / cpp-debuginfo / gcc / gcc-c++ / gcc-c++-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_89830)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202689830 advisory. gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: Denial of Service via use-after-free in binary heap eraseif CVE-2026-102010 gcc: libstdc++ integer overflow ...

Linux Distros Unpatched Vulnerability : CVE-2026-117937

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Invalid pointer in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and...

Linux Distros Unpatched Vulnerability : CVE-2026-118008

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 159 and Thunderbird 159. CVE-2026-118008 Note that Nessus relies ...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-146813)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146813 advisory. In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: Fix srptallocrwctxs unwind counters When srptallocrwctxs fails partway through a...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-146819)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146819 advisory. In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Skip vport under deletion in report ID acquisition qla24xxreportidacquisition...

Linux Distros Unpatched Vulnerability : CVE-2026-118015

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159 and Thunderbird 159. CVE-2026-118015 Note that Nessus relies on th...

Linux Distros Unpatched Vulnerability : CVE-2026-118009

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Integer overflow, use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 159 and Thunderbird 159. CVE-2026-118009 Note that...

Linux Distros Unpatched Vulnerability : CVE-2026-99169

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - futex: Fix mm reuse handling for FUTOFFMMSHARED A FUTOFFMMSHARED futex is a shared futex that refers to an MM. It is possible for a process to wait on a shared...

Linux Distros Unpatched Vulnerability : CVE-2026-99125

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - s390/pai: Handle multiple PMU stop callback invocations Handle the following scenario: The kernel protects itself against a very high sampling load and throttle...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-146667)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146667 advisory. In the Linux kernel, the following vulnerability has been resolved: HID: sensor: custom: Fix field sysfs group cleanup on failure hidsensorcustomaddattributes create...

Linux Distros Unpatched Vulnerability : CVE-2026-99192

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: bcmgenet: unshare the skb before writing the control block bcmgenet stores firstcb, lastcb and bytessent in the skb control block and reads them back on...

Linux Distros Unpatched Vulnerability : CVE-2026-117974

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6...

Linux Distros Unpatched Vulnerability : CVE-2026-117987

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. CVE-2026-11798...

Linux Distros Unpatched Vulnerability : CVE-2026-99184

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - accel/rocket: search every core slot when a core is removed rocketremove decrements rdev-numcores for each core it removes, while findcorefordev searches slots ...

Linux Distros Unpatched Vulnerability : CVE-2026-116674

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - systeminformation is a System and OS information library for node.js. Prior to 5.33.13, networkStatsifaces in lib/network.js on FreeBSD, OpenBSD, and NetBSD...

Linux Distros Unpatched Vulnerability : CVE-2026-99189

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gpio: mxc: fix race between chained IRQ handler install and probe completion mxcupdateirqchainedhandler is called before the IRQ domain, the generic IRQ chip, a...

MiracleLinux 9 : libreswan-4.15-11.el9_8 (AXSA:2026-2176:03)

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-2176:03 advisory. libreswan: IKEv2 Use-After-Free bug when using IKE-over-TCP CVE-2026-94453 libreswan: IKEv2 pre-authentication Null Pointer deref in EAP code...

Linux Distros Unpatched Vulnerability : CVE-2026-99164

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - spi: imx: fix slab corruption from undersized DMA bounce buffers Since commit faa8e404ad8e spi: imx: support dynamic burst length for ECSPI DMA mode, the driver...

Linux Distros Unpatched Vulnerability : CVE-2026-117926

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-146677)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146677 advisory. In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: fix response resource leak on queue teardown When an nvme target with rdma transport ...

Oracle Linux 10 : libXi (ELSA-2026-91004)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-91004 advisory. 1.8.1-7.1 - CVE fix for CVE-2026-93541, CVE-2026-93542, CVE-2026-93543 Resolves: RHEL-270054 Tenable has extracted the preceding description block directly fr...

Linux Distros Unpatched Vulnerability : CVE-2026-117899

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free in the Networking: HTTP component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and...

Linux Distros Unpatched Vulnerability : CVE-2026-118180

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When logging in to a Matrix account, Thunderbird used the homeserver address provided in the server's login response without validating it. A malicious or...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-146690)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146690 advisory. In the Linux kernel, the following vulnerability has been resolved: nfsd: validate symlink target length in NFSv4 CREATE nfsd4decodecreate accepts an unbounded...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-146903)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146903 advisory. In the Linux kernel, the following vulnerability has been resolved: net: qrtr: fix 32-bit integer overflow in qrtrendpointpost qrtrendpointpost validates an incoming...

SUSE SLES15 Security Update : podman (SUSE-SU-2026:4921-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4921-1 advisory. This update for podman rebuilds it against the current go security release. Tenable has extracted the preceding description block directly...

Linux Distros Unpatched Vulnerability : CVE-2026-118327

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in Media in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a...

Linux Distros Unpatched Vulnerability : CVE-2026-117991

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect boundary conditions in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and...

Linux Distros Unpatched Vulnerability : CVE-2026-99096

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iouring/register: don't exempt disabled rings from task restrictions A ring created with IORINGSETUPRDISABLED is exempt from its register restrictions until it ...

Linux Distros Unpatched Vulnerability : CVE-2026-118311

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in Media in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a...

Oracle Linux 8 : gcc-toolset-15-gcc (ELSA-2026-90915)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-90915 advisory. 15.2.1-7.2 - fix CVE-2026-102010, PR libstdc++/127656 RHEL-272113 Tenable has extracted the preceding description block directly from the Oracle Linux security...

Linux Distros Unpatched Vulnerability : CVE-2026-99190

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gpiolib: fix memory leak in gpiodsetarrayvaluecomplex on error paths A drive-by review by Sashiko reports that, after a failed call to gpiochipsetmultiple,...

Fedora 43 : libinstpatch (2026-7f1bcc426b)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-7f1bcc426b advisory. Update to 1.1.8, including fixes for CVE-2026-111136 and for a memory leak. Tenable has extracted the preceding description block directly from the Fedora...

Linux Distros Unpatched Vulnerability : CVE-2026-117945

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect boundary conditions in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6...

Linux Distros Unpatched Vulnerability : CVE-2026-99112

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/sched: clsflower: validate mask pointer after nlanext flsetencopt iterates the key's nested tunnel-option attributes with nlaforeachattr while advancing a...

Linux Distros Unpatched Vulnerability : CVE-2026-116688

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 45.0.0 until 47.7.4 and 48.5.1, the engine uses a vulnerable es-toolkit versio...

Linux Distros Unpatched Vulnerability : CVE-2026-99153

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scsi: libiscsi: Validate the ITT reflected in a Reject PDU A Reject PDU carries a copy of the header it rejects, and iscsihandlereject takes the ITT out of tha...

Fedora 43 : stargz-snapshotter (2026-75361a79cf)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-75361a79cf advisory. Release of stargz snapshotter v0.19.0, containing fixes for CVE-2026-71482 and CVE-2026-77395. Release note is available on...

Fedora 44 : mingw-freetype (2026-ce03acf998)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-ce03acf998 advisory. Backport fix for CVE-2026-95512. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

Linux Distros Unpatched Vulnerability : CVE-2026-99111

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb: client: fix data corruption with concurrent writes and OTRUNC cifsdotruncate flushes dirty pages with filemapwriteandwait and truncates the file on the...

Linux Distros Unpatched Vulnerability : CVE-2026-116726

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Gbsplay through 0.0.103 contains a heap out-of-bounds read vulnerability in gbropen in gbs.c that fails to verify file length before scanning the GBR ROM title...