EulerOS 2.0 SP15 : nfs-utils (EulerOS-SA-2026-3811)

According to the versions of the nfs-utils packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A vulnerability was recently discovered in the rpc.mountd daemon in the nfs-utils package for Linux, that allows a NFSv3 client to escalate...

AlmaLinux 10 : postgresql18 (ALSA-2026:67280)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:67280 advisory. postgresql: PostgreSQL: SQL injection in pgcreatesubscriber allows arbitrary SQL execution as superuser CVE-2026-6476 postgresql: PostgreSQL: Arbitrary...

Linux Distros Unpatched Vulnerability : CVE-2026-83408

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM product of Oracle Java SE component: Compiler. The supported version that is affected is Oracle...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python3 (UTSA-2026-109828)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-109828 advisory. The tarfile module would still apply normalization of AREGTYPE blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPELONGNAME or...

RHEL 9 : RHELAI 3.6: mariadb-connector-c 3.4.9 CVE-2026-44172 (Critical) (RHSA-2026:68567)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:68567 advisory. RPM packages are internal build artifacts and not supported on their own. They are only supported as part of the Red Hat AI application platform...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: coredns (UTSA-2026-109796)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-109796 advisory. CoreDNS is a DNS server written in Go. In versions prior to 1.14.3, the gRPC, QUIC, DoH, and DoH3 transport implementations incorrectly handle TSIG authentication. F...

Linux Distros Unpatched Vulnerability : CVE-2026-84501

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted addauthensemble, ... request...

Linux Distros Unpatched Vulnerability : CVE-2026-87272

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.16. Easily exploitable...

RHEL 9 : opentelemetry-collector (RHSA-2026:68527)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:68527 advisory. Collector with the supported components for a Red Hat build of OpenTelemetry Security Fixes: net/mail: golang: net/mail: Denial of Service...

EulerOS 2.0 SP15 : qemu (EulerOS-SA-2026-3820)

According to the versions of the qemu packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in QEMU's virtio-blk device. The issue arises because the device does not properly validate the size of input descriptors before...

RockyLinux 8 : .NET 9.0 (RLSA-2026:68233)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:68233 advisory. dotnet10.0: dotnet9.0: dotnet8.0: .NET Information Disclosure Vulnerability CVE-2026-58649 dotnet10.0: dotnet9.0: .NET Elevation of Privilege...

SUSE SLES15: corosync / corosync-qdevice / corosync-qnetd / corosync-testagents / etc (SUSE-SU-2026:4202-1)

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4202-1 advisory. - CVE-2026-81665: heap-based buffer overflow in totempg assembly buffer during fragmented message reassembly bsc1278738. - CVE-2026-81666:...

SUSE SLES15 Security Update : google-cloud-sap-agent (SUSE-SU-2026:4206-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4206-1 advisory. Security issues fixed: - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input bsc1272128....

RockyLinux 8 : python-lxml (RLSA-2026:67943)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:67943 advisory. lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href CVE-2026-49825 Tenable has extracted the preceding description block...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python3 (UTSA-2026-109800)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-109800 advisory. Element.findall and fully-consumed Element.iterfind exhibit On^2 time complexity when using XPath index predicates e.g. 1, last, last-N on XML documents with many...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: freerdp (UTSA-2026-109809)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-109809 advisory. FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the entire CLI parser surface to untrusted files...

RHEL 8 : kernel (RHSA-2026:68531)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:68531 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: ipvlan: Make the addrslock be...

FreeBSD : Unbound -- multiple vulnerabilities (3f4d285d-b1f6-11f1-8f5e-3c7c3fba4204)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 3f4d285d-b1f6-11f1-8f5e-3c7c3fba4204 advisory. NLnet Labs reports: This release consolidates security fixes for issues reported over a period...

SUSE SLES15 Security Update : containerized-data-importer (SUSE-SU-2026:4209-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4209-1 advisory. - CVE-2025-58058: github.com/ulikunitz/xz: github.com/ulikunitz/xz leaks memory bsc1248946. - CVE-2026-25680: golang.org/x/net/html...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: freerdp (UTSA-2026-109827)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-109827 advisory. FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, FreeRDP's planar bitmap decoder has an out-of-bounds heap write when decoding RLE...

EulerOS 2.0 SP15 : python-paramiko (EulerOS-SA-2026-3817)

According to the versions of the python-paramiko packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : In Paramiko through 4.0.0 before a448945, rsakey.py allows the SHA-1 algorithm.CVE-2026-44405 Tenable has extracted the preceding...

EulerOS 2.0 SP15 : perl (EulerOS-SA-2026-3788)

According to the versions of the perl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds.x000D x00...

Oracle Linux 8 : firefox (ELSA-2026-68549)

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-68549 advisory. 140.15.0-1.0.1 - Fix firefox-oracle-default-prefs.js for new nss Orabug: 37079789 - diable wasisdk to prevent build failure with newer llvm 140.15.0 -...

MiracleLinux 9 : nginx-1.20.1-28.el9_8.6.ML.1 (AXSA:2026-1857:08)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1857:08 advisory. nginx: NGINX: Arbitrary code execution via crafted HTTP requests CVE-2026-42533 Tenable has extracted the preceding description block directly from the...

AlmaLinux 8 : python-lxml (ALSA-2026:67943)

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:67943 advisory. lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href CVE-2026-49825 Tenable has extracted the preceding description block...

Linux Distros Unpatched Vulnerability : CVE-2026-90439

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpv3module module. When using HTTP/3 with OpenSSL versions = OpenSSL 3.5.0 under certain...

Linux Distros Unpatched Vulnerability : CVE-2026-92064

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird...

Linux Distros Unpatched Vulnerability : CVE-2026-89857

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject qlanvmelsrejectiocb allocates from and advances the request ring through qla2x00allociocbs which...

Linux Distros Unpatched Vulnerability : CVE-2026-89843

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak Several bsg handlers stage their request/reply in an uninitialized 256-byte on-stack buffer uint8t...

Fedora 43 : sblim-sfcb (2026-dff163317a)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-dff163317a advisory. Fix CVE-2026-73583 and CVE-2026-73584 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...

GitLab 17.1 < 19.1.8 / 19.2 < 19.2.6 / 19.3 < 19.3.2 (CVE-2026-86341)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab EE affecting all versions from 17.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an authenticated user with Owner ...

Linux Distros Unpatched Vulnerability : CVE-2026-89855

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scsi: qla2xxx: Serialize flash version read in reset handler The update cache versions without reset sysfs reset operation 0x20261 calls getflashversion, which...

Linux Distros Unpatched Vulnerability : CVE-2026-89962

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - powerpc/kexecfile: Prevent kexec range truncation Sashiko AI review pointed out the following issue. The mergememoryranges function incorrectly handles...

Linux Distros Unpatched Vulnerability : CVE-2026-89975

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nvme-fabrics: fix DHCHAP secret leak on parse failure nvmfparseoptions duplicates dhchapsecret and dhchapctrlsecret with matchstrdup before validating the DHHC-...

Linux Distros Unpatched Vulnerability : CVE-2026-89940

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iio: buffer: Tie IIO dma fence lock lifetime to the fence The iiodmafence implementation currently uses a lock embedded in the iiodmabufpriv. But the iiodmafenc...

SUSE SLED15 / SLES15 Security Update : libpcap (SUSE-SU-2026:4188-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4188-1 advisory. - CVE-2026-0799: the BPF interpreter does not validate values in BPF instructions that load/store a value...

RHEL 8 : kernel (RHSA-2026:68131)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:68131 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: KVM: x86: Don't recheck L1 intercepts...

Linux Distros Unpatched Vulnerability : CVE-2026-90002

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ftrace: Take tracearray reference before accessing its ftraceops The trace instance files setftracefilter and setftracenotrace was updated to work with specific...

Linux Distros Unpatched Vulnerability : CVE-2026-92075

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3...

Linux Distros Unpatched Vulnerability : CVE-2026-44203

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the OAuth 2.0 and OpenID Connect authorization endpoint does not sufficiently...

Linux Distros Unpatched Vulnerability : CVE-2026-89980

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: harmony: initialize locks before requesting IRQ sndharmonycreate registers the IRQ before initializing h-lock and h-mixerlock. A pending interrupt can...

Linux Distros Unpatched Vulnerability : CVE-2026-89805

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/pagemap: Fix folio allocation fallback and use-after-put drmpagemapmigratepopulaterampfn had two issues when populating RAM PFNs with higher-order folios: 1...

Oracle Linux 10 : tesseract (ELSA-2026-67830)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-67830 advisory. 5.3.4-7 - Resolves: CVE-2026-73066 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus ha...

RHEL 9 : postgresql:18 (RHSA-2026:67848)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:67848 advisory. PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL: SQL injection in...

Linux Distros Unpatched Vulnerability : CVE-2026-90007

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scsi: pm8001: Use rollback index when freeing MSI-X vectors pm8001requestmsix unwinds previously registered handlers with freeirq when requestirq fails. The...

SUSE SLED15: acl / attr / libacl-devel / libacl1 / libacl1-32bit / libattr-devel / etc (SUSE-SU-2026:4176-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4176-1 advisory. This update for acl, attr fixes the following issue: - CVE-2026-54369,CVE-2026-54370,CVE-2026-54371: Symlink...

Linux Distros Unpatched Vulnerability : CVE-2026-92078

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Denial-of-service in the Security component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3...

Linux Distros Unpatched Vulnerability : CVE-2026-89888

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - media: i2c: ov02a10: fix endpoint parsing use-after-free The ov02a10checkhwcfg function calls fwnodehandleputep immediately after allocating and parsing the...

SUSE SLES15: helm / helm-bash-completion / helm-fish-completion / etc (SUSE-SU-2026:4175-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4175-1 advisory. - CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST request through...

MiracleLinux 9 : python-tornado-6.5.8-0.el9_8.1 (AXSA:2026-1848:03)

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-1848:03 advisory. tornado: Tornado: Information disclosure via improper handling of credentials during HTTP redirects CVE-2026-49853 tornado: Tornado: Denial of Servi...