Linux Distros Unpatched Vulnerability : CVE-2026-99101

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ntfs: move attribute payload before shrinking its record ntfsnewattrflags resizes the non-resident attribute record before moving its name and mapping pairs to...

Linux Distros Unpatched Vulnerability : CVE-2026-118009

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Integer overflow, use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 159 and Thunderbird 159. CVE-2026-118009 Note that...

Linux Distros Unpatched Vulnerability : CVE-2026-105608

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in service mesh proxy registration. This may allow a user with service write...

Linux Distros Unpatched Vulnerability : CVE-2026-117870

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and...

Amazon Linux 2 : kernel (ALASKERNEL-5.10-2026-136)

The version of kernel installed on the remote host is prior to 5.10.271-272.1120. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2026-136 advisory. In the Linux kernel, the following vulnerability has been resolved: fou: Fix use-after-free in foucreat...

MiracleLinux 8 : perl-DBI:1.641 (AXSA:2026-2184:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-2184:01 advisory. perl-DBI: perl-DBI: Denial of Service via invalid memory read during numeric type casting CVE-2026-88815 Tenable has extracted the preceding description bloc...

Linux Distros Unpatched Vulnerability : CVE-2026-99210

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - accel/rocket: clear rdev on device init failure rocketprobe stores the return value from rocketdeviceinit in the file-scoped rdev pointer before checking whethe...

Linux Distros Unpatched Vulnerability : CVE-2026-117955

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird...

Linux Distros Unpatched Vulnerability : CVE-2026-116726

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Gbsplay through 0.0.103 contains a heap out-of-bounds read vulnerability in gbropen in gbs.c that fails to verify file length before scanning the GBR ROM title...

Linux Distros Unpatched Vulnerability : CVE-2026-107147

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The twofactorgauthenticator plugin for Roundcube is vulnerable to 2fa authentication bypass by spoofed client address headers. Due to the lack of validation of...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-146639)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146639 advisory. In the Linux kernel, the following vulnerability has been resolved: ftrace: Take tracearray reference before accessing its ftraceops The trace instance files...

Linux Distros Unpatched Vulnerability : CVE-2026-99177

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Fix page dirtying in sevgmempostpopulate setpagedirty requires that the caller hol...

Linux Distros Unpatched Vulnerability : CVE-2026-82389

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Bluetooth Classic Hands-Free Profile Audio Gateway role, hfpagcreate in subsys/bluetooth/host/classic/hfpag.c starts an SDP discovery toward the peer,...

Linux Distros Unpatched Vulnerability : CVE-2026-117890

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird...

Linux Distros Unpatched Vulnerability : CVE-2026-116725

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gbsplay through 0.0.103 contains an out-of-bounds read vulnerability in mappermap in mapper.c that fails to reject ROM bank indexes beyond the ROM size, causing...

Rocky Linux 9.6 [TuxCare] Security Update: libical / libical-devel / libical-glib / libical-glib-devel / etc (ALMALINUX9.6:CLSA-2026:1793175419)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793175419 advisory. - libical through 4.0.6 contains a heap-based out-of-bounds read in icalvaluedecodeicalstring in src/libical/icalvalue.c when decoding inpu...

Rocky Linux 8 [CIQ] Security Update: kernel-rt / kernel-rt-core / kernel-rt-debug / kernel-rt-debug-core / etc (crlsa-2026_89814)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202689814 advisory. kernel: KVM: s390: pci: Reject adapter interrupt forwarding if already enabled CVE-2026-74515 Tenable has extracted the preceding description block directly from t...

FreeBSD : py-svglib -- Multiple vulnerabilities (bdac753c-d1d5-11f1-985e-901b0edee044)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the bdac753c-d1d5-11f1-985e-901b0edee044 advisory. Dinu Gherman reports: The SVG elliptical-arc parser in svglib.utils.splitarcvalues builds a...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-146632)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146632 advisory. In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during closelru reaping An nfs4openowner left on nn-closelru...

Oracle Linux 8 : flute, / libbase, / libfonts, / libformula, / liblayout, / libloader, / libreoffice, / librepository, / libserializer, / pentaho-libxml, / pentaho-reporting-flow-engine, / and / sac (ELSA-2026-88164)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-88164 advisory. - Resolves: RHEL-269267 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269190 CVE-2026-63275 stack buffer overflow...

Oracle Linux 8 : kernel (ELSA-2026-85773)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-85773 advisory. - smb: client: reject a tree connect response whose byte count is too small CKI Backport Bot RHEL-271288 CVE-2026-89631 - netfilter: flowtable: hold...

MiracleLinux 8 : perl-DBI:1.641 (AXSA:2026-2188:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-2188:01 advisory. perl-DBI: perl-DBI: Denial of Service via invalid memory read during numeric type casting CVE-2026-88815 Tenable has extracted the preceding description bloc...

Linux Distros Unpatched Vulnerability : CVE-2026-116802

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSERMEDIATYPE is...

Linux Distros Unpatched Vulnerability : CVE-2026-118347

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML...

MiracleLinux 8 : python-urllib3-1.24.2-11.el8_10 (AXSA:2026-2181:06)

The remote MiracleLinux 8 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-2181:06 advisory. urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser CVE-2026-97689 Tenable has extracted the preceding description block...

Linux Distros Unpatched Vulnerability : CVE-2026-99123

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - vsock/virtio: validate packet source for connected sockets virtiotransportrecvpkt looks up sockets first by the full source and destination tuple, then by...

Linux Distros Unpatched Vulnerability : CVE-2026-117962

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Sandbox escape due to incorrect boundary conditions in the Storage: Quota Manager component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6,...

Linux Distros Unpatched Vulnerability : CVE-2026-99120

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: x86/mmu: Cope with the SS bit being set in NPF exit codes When running Hyper-V from Windows 11, KVM is seeing the SS bit set in nested page fault error cod...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-146820)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146820 advisory. In the Linux kernel, the following vulnerability has been resolved: greybus: audio: bound the topology section sizes against the fetched size gbaudiogbgettopology...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-146658)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146658 advisory. In the Linux kernel, the following vulnerability has been resolved: dm array: reject an array block whose value size is not the caller's arrayblockcheck can only...

Linux Distros Unpatched Vulnerability : CVE-2026-118024

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 159 and Thunderbird 159. CVE-2026-118024 Note that Nessus relies on the...

Linux Distros Unpatched Vulnerability : CVE-2026-116773

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.65.0, the client Session::processpacket path in...

Linux Distros Unpatched Vulnerability : CVE-2026-116774

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.60.0 until 0.65.0, channel-open parsing accepts a...

Linux Distros Unpatched Vulnerability : CVE-2026-118305

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-146815)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146815 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: hold reference on ct until flow is released nfctput releases the ct-ext are...

Linux Distros Unpatched Vulnerability : CVE-2026-116134

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HTTP::Body versions before 1.2301 for Perl allow memory exhaustion via an unbounded multipart part header block. The multipart parser takes everything up to the...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-146672)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146672 advisory. In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Validate numsge/cursge before indexing wqe-dma.sge For a user QP, qp-sq.queue is a rin...

Linux Distros Unpatched Vulnerability : CVE-2026-118338

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Observable discrepancy in Animation in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to obtain cross-origin data via a crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-117603

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Electrum before 4.7.2 contains a spending limit bypass vulnerability in the Nostr Wallet Connect plugin that allows malicious NWC clients to exceed dailylimitsa...

Linux Distros Unpatched Vulnerability : CVE-2026-116576

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - systeminformation is a System and OS information library for node.js. Prior to 5.33.16, services in lib/processes.js inserts a caller-supplied service name into...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-146610)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146610 advisory. In the Linux kernel, the following vulnerability has been resolved: slip: fix use-after-free in slsync slipdevs stores bare netdevice pointers and takes no referenc...

AlmaLinux 8 : webkit2gtk3 (ALSA-2026:91636)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:91636 advisory. chromium-browser: angle: Use after free in ANGLE CVE-2026-95325 chromium-browser: angle: Out of bounds write in ANGLE CVE-2026-95331 chromium-browser:...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-146821)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146821 advisory. In the Linux kernel, the following vulnerability has been resolved: openvswitch: avoid reallocating confirmed conntrack labels ovsctgetconnlabels adds the labels...

Fedora 44 : mingw-freetype (2026-ce03acf998)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-ce03acf998 advisory. Backport fix for CVE-2026-95512. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-146826)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146826 advisory. In the Linux kernel, the following vulnerability has been resolved: i2c: smbus: reject oversized block transfers in the common path The SMBus block transfer length...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-146613)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146613 advisory. In the Linux kernel, the following vulnerability has been resolved: orangefs: skip leading spaces before parsing client debug masks orangefspreparecdmarray sizes eac...

Unity Linux 20.1050a / 20.1070a Security Update: kernel (UTSA-2026-146246)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146246 advisory. In the Linux kernel, the following vulnerability has been resolved: sctp: clear control chunk transport if it is being removed sctpmakeheartbeatack caches the...

Linux Distros Unpatched Vulnerability : CVE-2026-117950

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect boundary conditions in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird...

Linux Distros Unpatched Vulnerability : CVE-2026-117943

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and...

Rocky Linux 10.2 [CIQ] Security Update: libreswan / libreswan-debugsource / libreswan-minimal / etc Multiple Vulnerabilities (crlsa-2026_89923)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202689923 advisory. libreswan: IKEv2 Use-After-Free bug when using IKE-over-TCP CVE-2026-94453 libreswan: Denial of Service via sending bogus X.509 certificates...