Amazon Linux 2023 : libnetapi, libnetapi-devel, libsmbclient (ALAS2023-2026-1899)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1899 advisory. If the certificate auto-enrollment GPO is enabled on domain membersboth in Samba's smb.conf and using Windows GPME tool, a CAcertificate may be fetched using a plain HTTP connection and installedin the...

Linux Distros Unpatched Vulnerability : CVE-2026-15718

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox...

Linux Distros Unpatched Vulnerability : CVE-2026-61871

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the ICON decoder that occurs when a memory allocation fails. Processing a crafted ICON file...

openSUSE 16 Security Update : jq (openSUSE-SU-2026:21318-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21318-1 advisory. This update for jq fixes the following issues - CVE-2026-43896: unbounded recursion in jvobjectmergerecursive can lead to C stack exhaustion and...

Oracle Linux 8 : gegl (ELSA-2026-38485)

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-38485 advisory. 0.2.0-40 - Fix buffer overflow in rgbereadnewrle CVE-2026-2050 Resolves: RHEL-188260 Tenable has extracted the preceding description block directly from the...

Fedora 44 : roundcubemail (2026-517daa8d64)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-517daa8d64 advisory. Release 1.7.2 - Add HEAD request handler to the static.php - Fix so the oauthpasswordclaim claim is retrieved via token or userinfo request 9631 - F...

SUSE SLES15 Security Update : kernel (Live Patch 55 for SUSE Linux Enterprise 15 SP4) (SUSE-SU-2026:2993-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2993-1 advisory. This update for the SUSE Linux Enterprise Kernel 5.14.21-150400.24.222 fixes various security issues The following security issues were fixed: ...

openSUSE 16 Security Update : python-mistune (openSUSE-SU-2026:21339-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21339-1 advisory. This update for python-mistune fixes the following issues - CVE-2026-59922: quadratic-time parsing on long runs of some markers in formatting.py...

SUSE SLED15 / SLES15 Security Update : sccache (SUSE-SU-2026:3022-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3022-1 advisory. Update to version 0.15.017. - CVE-2023-26964: hyper,h2: high resource consumption due to stream stacking when ...

Amazon Linux 2023 : python3.13, python3.13-devel, python3.13-freethreading (ALAS2023-2026-1910)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1910 advisory. tarfile.extractall with the 'data' or 'tar'filter could be bypassed by a crafted archive where a hardlinkreferences a symlink stored at a deeper name than the hardlink itself.The extraction...

Python Library yt-dlp < 2026.7.4 Command Injection

The detected version of the yt-dlp Python package is prior to 2026.7.4. It is, therefore, affected by a command injection vulnerability. yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to 2026.7.4, the --write-link, --write-url-link, and --write-desktop-link options can writ...

MiracleLinux 9 : jmc-8.2.0-19.el9_8.2 (AXSA:2026-1271:02)

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-1271:02 advisory. lz4-java: lz4-java: Information Disclosure via Insufficient Output Buffer Clearing CVE-2025-66566 org.eclipse.jetty/jetty-http: HTTP request smuggli...

openSUSE 16 Security Update : grafana (openSUSE-SU-2026:21351-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21351-1 advisory. Changes in grafana: - Add UI web assets as additional source tarball - Update to version 12.4.5 jscPED-16512: Datasources: return 400 when paylo...

Oracle Linux 9 : python3.9 (ELSA-2026-39798)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-39798 advisory. - Security fix for CVE-2026-15308 Resolves: RHEL-193786 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory...

Notepad++ < 8.9.7 Multiple Vulnerabilities

The version of Notepad++ installed on the remote host is prior to 8.9.7. It is, therefore, affected by multiple vulnerabilities: - A security bypass vulnerability exists in session.xml backupFilePath handling due to an incomplete startswith check. An attacker could exploit this to bypass path...

Linux Distros Unpatched Vulnerability : CVE-2026-48125

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - UAParser.js is a JavaScript library to detect browsers, operating systems, CPUs, and devices from user- agent data. From 2.0.1 until 2.0.10, a regular expressio...

SUSE SLES15 Security Update : distribution (SUSE-SU-2026:3049-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3049-1 advisory. This update for distribution rebuilds it against the current go security release. Tenable has extracted the preceding description block...

Linux Distros Unpatched Vulnerability : CVE-2026-43727

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2,...

openSUSE 16: tomcat / tomcat-admin-webapps / tomcat-el-3_0-api / tomcat-embed / etc (openSUSE-SU-2026:21327-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21327-1 advisory. This update for tomcat fixes the following issues Update to Tomcat 9.0.119. Security issues fixed: - CVE-2026-50229: improper neutralization of...

Linux Distros Unpatched Vulnerability : CVE-2026-51105

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Buffer Overflow vulnerability in aMULE-Project aMule v.2.3.3 allows a remote attacker to cause a denial of service via the OPSERVERMESSAGE Handler. CVE-2026-511...

SUSE SLED15: ImageMagick / ImageMagick-config-7-SUSE / etc (SUSE-SU-2026:3053-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3053-1 advisory. This update for ImageMagick fixes the following issues - CVE-2026-53466: integer overflow in the XCF decoder c...

SUSE SLED15 / SLES15 Security Update : runc (SUSE-SU-2026:3051-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3051-1 advisory. This update for runc rebuilds it against the current go security release. Tenable has extracted the preceding descripti...

Fedora 44 : xrdp (2026-05c06fa0a8)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-05c06fa0a8 advisory. Release notes for xrdp v0.10.6.1 2026/07/06 General announcements This release fixes 10 vulnerabilities and 1 regression introduced by a vulnerabili...

Linux Distros Unpatched Vulnerability : CVE-2026-59889

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1,...

Linux Distros Unpatched Vulnerability : CVE-2026-61862

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick before 7.1.2-26 and 6.9.13-51 contains an information disclosure vulnerability: when a profile is displayed with the identify command and the profil...

Linux Distros Unpatched Vulnerability : CVE-2026-15775

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to bypass same origin policy via a crafted HTML page...

Google Chrome < 150.0.7871.128 Multiple Vulnerabilities

The version of Google Chrome installed on the remote macOS host is prior to 150.0.7871.128. It is, therefore, affected by multiple vulnerabilities as referenced in the 202607stable-channel-update-for-desktop049796704 advisory. - Use after free in Aura. CVE-2026-15905 - Use after free in...

Linux Distros Unpatched Vulnerability : CVE-2026-43699

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tv...

Ubuntu 16.04 LTS / 18.04 LTS : Tomcat vulnerabilities (USN-8551-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8551-1 advisory. It was discovered that Tomcat incorrectly handled authorization when multiple method constraints defined the same HTTP method. A remote...

RHEL 8 : python3.12 (RHSA-2026:39893)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:39893 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic da...

Linux Distros Unpatched Vulnerability : CVE-2026-47767

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 5.4.46 until 5.4.52, 6.4.40, 7.4.12, and 8.0.12, the...

Linux Distros Unpatched Vulnerability : CVE-2026-47300

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network. CVE-2026-47300 Note tha...

Linux Distros Unpatched Vulnerability : CVE-2026-50527

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Stack-based buffer overflow in .NET Framework allows an unauthorized attacker to deny service over a network. CVE-2026-50527 Note that Nessus relies on the...

Debian dsa-6390 : chromium - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6390 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6390-1 [email protected] https://www.debian.org/securit...

Linux Distros Unpatched Vulnerability : CVE-2026-49853

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed only...

SUSE SLED15: qemu / qemu-SLOF / qemu-accel-qtest / qemu-accel-tcg-x86 / qemu-arm / etc (SUSE-SU-2026:3038-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3038-1 advisory. This update for qemu fixes the following issues - CVE-2026-3886: QEMU calcimagehostmem Integer Overflow Local...

Linux Distros Unpatched Vulnerability : CVE-2026-15774

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Skia in Google Chrome prior to 150.0.7871.125 allowed a remote attacker who had compromised the renderer process to potentially perform a...

Linux Distros Unpatched Vulnerability : CVE-2026-38753

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A use-after-free in the awksub function editors/awk.c of Busybox v1.38.0 allows attackers to cause a Denial of Service DoS via supplying a crafted AWK script...

Fedora 44 : mingw-glib2 (2026-7bf2937528)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-7bf2937528 advisory. Backport fix for CVE-2026-58016. ---- Update to glib-2.88.2. Tenable has extracted the preceding description block directly from the Fedora security...

Linux Distros Unpatched Vulnerability : CVE-2026-59732

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone archive extract can write...

Debian dsa-6389 : libntfs-3g89t64 - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6389 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6389-1 [email protected] https://www.debian.org/securit...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : idna vulnerability (USN-8549-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-8549-1 advisory. It was discovered that idna did not properly reject oversized inputs before performing expensive processing. An attacker could possibly us...

SUSE SLED15 / SLES15 Security Update : python-paramiko (SUSE-SU-2026:3031-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3031-1 advisory. - CVE-2026-44405: data integrity compromise due to allowed SHA-1 algorithm use bsc1264225. Tenable has extracted the...

Linux Distros Unpatched Vulnerability : CVE-2026-42617

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - ntfs-3g - None Ubuntu Linux - In NTFS-3G through 2026.2.25, a heap buffer overflow exists in ntfsirtoib in index.c that allows an attacker to...

RockyLinux 10 : hplip (RLSA-2026:39976)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:39976 advisory. HPLIP: Incomplete Fix for CVE-2026-8631 CVE-2026-14544 Tenable has extracted the preceding description block directly from the RockyLinux security advisory. Not...

Linux Distros Unpatched Vulnerability : CVE-2026-56135

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - ntfs-3g - None Ubuntu Linux - In NTFS-3G through 2026.2.25, a heap-based buffer overflow exists in the function buildinheritedid in...

Alibaba Cloud Linux 3 : 0199: libtasn1 (ALINUX3-SA-2026:0199)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2026:0199 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2025-13151: Stack-based buffer overflow in...

RockyLinux 9 : python3.12 (RLSA-2026:39771)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:39771 advisory. python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations CVE-2026-15308 Tenable has extracted the preceding description...

Amazon Linux 2023 : python3.14, python3.14-devel, python3.14-freethreading (ALAS2023-2026-1929)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1929 advisory. tarfile.extractall with the 'data' or 'tar'filter could be bypassed by a crafted archive where a hardlinkreferences a symlink stored at a deeper name than the hardlink itself.The extraction...

Linux Distros Unpatched Vulnerability : CVE-2026-43720

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tv...