Oracle Linux 10 : kernel (ELSA-2026-38492)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-38492 advisory. - crypto: ccp - copy IV using skcipher ivsize CKI Backport Bot RHEL-188463 CVE-2026-53016 - futex/requeue: Revert 'Prevent NULL pointer dereference i...

Photon OS 5.0: Postgresql15 PHSA-2026-5.0-92-0959

An update of the postgresql15 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-92-0959. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

MiracleLinux 8 : kernel-4.18.0-553.151.1.el8_10 (AXSA:2026-1562:63)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1562:63 advisory. kernel: ipc: limit nextid allocation to the valid ID range CVE-2026-52923 Tenable has extracted the preceding description block directly from the MiracleLinu...

Linux Distros Unpatched Vulnerability : CVE-2026-74303

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: hciqca: fix NULL pointer dereference in qcadmphdr for non-serdev device hu-serdev is NULL for hciuart attached via non-serdev paths, but qcadmphdr...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-101989)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101989 advisory. In the Linux kernel, the following vulnerability has been resolved: writeback: fix race between cgroupwritebackumount and inodeswitchwbs When a container exits, the...

RockyLinux 8 : kernel-rt (RLSA-2026:55765)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:55765 advisory. kernel: mm/slub: avoid accessing metadata when pointer is invalid in objecterr CVE-2025-39902 kernel: drm/amdkfd: Fix out-of-bounds write in...

AlmaLinux 8 : kernel (ALSA-2026:55764)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:55764 advisory. kernel: mm/slub: avoid accessing metadata when pointer is invalid in objecterr CVE-2025-39902 kernel: drm/amdkfd: Fix out-of-bounds write in...

AlmaLinux 8 : kernel-rt (ALSA-2026:55765)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:55765 advisory. kernel: mm/slub: avoid accessing metadata when pointer is invalid in objecterr CVE-2025-39902 kernel: drm/amdkfd: Fix out-of-bounds write in...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102001)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102001 advisory. In the Linux kernel, the following vulnerability has been resolved: selinux: allow multiple opens of /sys/fs/selinux/policy Currently there can only be a single open...

Amazon Linux 2023 : aspnetcore-runtime-9.0, aspnetcore-runtime-dbg-9.0, aspnetcore-targeting-pack-9.0 (ALAS2023-2026-2048)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2048 advisory. Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network. CVE-2026-47303 Improper verification of cryptographic...

Photon OS 5.0: Dotnet PHSA-2026-5.0-92-0961

An update of the dotnet package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-92-0961. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102137)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102137 advisory. In the Linux kernel, the following vulnerability has been resolved: net/sched: schred: Replace direct dequeue call with peek and qdiscdequeuepeeked When red qdisc ha...

AlmaLinux 10 : nodejs22 (ALSA-2026:55541)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:55541 advisory. brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand function CVE-2026-14257 brace-expansion: brace-expansion: Denial of...

Mozilla Firefox ESR < 140.14

The version of Firefox ESR installed on the remote Windows host is prior to 140.14. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-76 advisory. - Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14...

Mozilla Firefox ESR < 153.1

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 153.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-77 advisory. - Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 154, Firefox E...

Joomla 1.0.x < 5.4.8 / 6.0.x < 6.1.3 Joomla 6.1.3 & 5.4.8 Security & Bugfix Release (joomla-6-1-3-5-4-8-security-bugfix-release)

According to its self-reported version, the instance of Joomla! running on the remote web server is 1.0.x prior to 5.4.8 or 6.0.x prior to 6.1.3. It is, therefore, affected by a vulnerability. - Joomla! Core - 20260810 - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 - The...

Amazon Linux 2 : thunderbird, --advisory ALAS2-2026-3868 (ALAS-2026-3868)

The version of thunderbird installed on the remote host is prior to 140.13.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3868 advisory. The code to parse MIME headers for display when forwarding a message if the setting to view all headers was enabled...

Linux Distros Unpatched Vulnerability : CVE-2026-72360

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/xe/pf: Don't attempt to process FASTREQ or EVENT relays Currently defined VF/PF relay actions use regular REQUEST messages only and the PF shouldn't attempt...

Linux Distros Unpatched Vulnerability : CVE-2026-62982

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Glances is an open-source system cross-platform monitoring tool. From 4.5.2 until 4.5.6, sanitizemustachedict in glances/actions.py skips nested list and...

Debian dsa-6447 : amqp-tools - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6447 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6447-1 [email protected] https://www.debian.org/securit...

Linux Distros Unpatched Vulnerability : CVE-2026-72037

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: lan743x: Initialize ethsyslock spinlock before use lan743xhardwareinit calls pci11x1xstrapgetstatus during the PCI11x1x probe sequence. That helper acquire...

Linux Distros Unpatched Vulnerability : CVE-2026-72287

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: nVMX: Move vTPR vs. TPR Threshold consistency check into normal checks Move the off-by-default consistency check for vmcs12.tprthreshold vs. the virtual AP...

Oracle Linux 9 : .NET / 9.0 (ELSA-2026-55856)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-55856 advisory. 9.0.120-1.0.1 - Add support for Oracle Linux 9.0.120-1 - Update to .NET SDK 9.0.120 and Runtime 9.0.19 - Resolves: RHEL-235476 Tenable has extracted t...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102130)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102130 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/amd/pp: Fix potential NULL pointer dereference in atomctrlinitializemcregtable The function...

Linux Distros Unpatched Vulnerability : CVE-2026-74311

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - virtio: rtc: tear down old virtqueues before restore virtiodevicerestore resets the device and restores the negotiated features before calling -restore...

Linux Distros Unpatched Vulnerability : CVE-2026-72401

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Fix insnauxdata leak on verifier errfreeenv path When bpfcheck allocates env-insnauxdata successfully but later fails to allocate env-succ, it jumps direct...

Linux Distros Unpatched Vulnerability : CVE-2026-72167

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mtd: rawnand: pl353: fix probe resource allocation During probe, the devmioremap is called with the parent device instead of the current one. So when the module...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102136)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102136 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Validate command header size against SVGACMDMAXDATASIZE This data originates from...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102129)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102129 advisory. In the Linux kernel, the following vulnerability has been resolved: xfrm: clear trailing padding in buildpolexpire buildexpire clears the trailing padding bytes of...

Linux Distros Unpatched Vulnerability : CVE-2026-72187

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid self-deadlock during inode eviction An attribute-list update performed while...

MiracleLinux 8 : bind9.16-9.16.23-0.22.el8_10.12 (AXSA:2026-1555:03)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1555:03 advisory. bind9: bind: Potential wildcard CNAME RPZ policy bypass CVE-2026-11331 bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field...

Linux Distros Unpatched Vulnerability : CVE-2026-74382

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/sched: clsbpf: prevent unbounded recursion in offload rollback Quan Sun reported 1 a stack overflow in clsbpfoffloadcmd. Reproducer on netdevsim: add a skip...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-101982)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101982 advisory. In the Linux kernel, the following vulnerability has been resolved: isofs: bound Rock Ridge symlink components to the SL record getsymlinkchunk and the SL handling i...

Linux Distros Unpatched Vulnerability : CVE-2026-72218

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - lockd: Plug nlmfile refcount leak on cached nlmdofopen failure The cached-file path in nlmlookupfile reaches the found: label unconditionally, even when...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-101968)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101968 advisory. In the Linux kernel, the following vulnerability has been resolved: net: afkey: initialize algkeylen for IPComp states pfkeymsg2xfrmstate handles the IPComp...

Linux Distros Unpatched Vulnerability : CVE-2026-72350

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfilter: xtu32: reject invalid shift counts u32matchit executes rule-supplied shift operands on a 32-bit value. A malformed u32 rule can provide a shift count...

Linux Distros Unpatched Vulnerability : CVE-2026-72122

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - can: bcm: fix lockless bound/ifindex race and silent RXSETUP failure bcmsendmsg reads bo-ifindex and checks bo-bound before taking locksock, while bcmnotify,...

Linux Distros Unpatched Vulnerability : CVE-2026-72231

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - batman-adv: tt: avoid request storms during pending request batadvsendttrequest allocates a ttreqnode when none exists for the destination originator node. This...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-101973)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101973 advisory. In the Linux kernel, the following vulnerability has been resolved: crypto: qat - validate RSA CRT component lengths The generic RSA key parser rsahelper.c bounds ea...

Linux Distros Unpatched Vulnerability : CVE-2026-74256

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf, sockmap: fix integer overflow in bpfmsgpopdata bounds check start and len are u32, so u64 last = start + len; evaluates start + len in 32-bit and wraps...

Linux Distros Unpatched Vulnerability : CVE-2026-74346

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RDMA/irdma: Fix OOB read during CQ MR registration Sashiko pointed out an unrelated bug during a previous patch:...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-101990)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101990 advisory. In the Linux kernel, the following vulnerability has been resolved: udf: validate VAT header length against the VAT inode size udfloadvat takes the virtual...

Linux Distros Unpatched Vulnerability : CVE-2026-72160

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ocfs2: reject dinodes with non-canonical imode type Patch series ocfs2: harden inode validators against forged metadata, v2. This series adds three structural...

Linux Distros Unpatched Vulnerability : CVE-2026-72247

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfilter: nfconncount: fix zone comparison in tuple dedup The already exists dedup logic in nfconncountadd decides whether a connection has already been counte...

Linux Distros Unpatched Vulnerability : CVE-2026-72400

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - seg6: validate SRH length before reading fixed fields seg6validatesrh reads fixed SRH fields such as srh-type and srh-hdrlen before checking that the supplied...

Linux Distros Unpatched Vulnerability : CVE-2026-74320

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fbdev: sm501fb: Fix buffer errors in OF binding code The code that gets the frame buffer mode from OF has 'use after free', 'buffer overrun' and memory leaks...

Linux Distros Unpatched Vulnerability : CVE-2026-74340

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: wcn36xx: fix OOB read from firmware count in PRINTREGINFO indication The firmware-controlled rsp-count field is used as the loop bound for indexing into t...

Linux Distros Unpatched Vulnerability : CVE-2026-74327

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - vmalloc: fix NULL pointer dereference in isvmareahugepages findvmarea can return NULL if the given address is not a valid vmalloc area. Check the return value...

Linux Distros Unpatched Vulnerability : CVE-2026-72322

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipv6: mcast: Fix potential UAF in MLD delayed work A race condition exists between device teardown and incoming MLD query processing, leading to a Use-After-Fre...

Amazon Linux 2 : kernel, --advisory ALAS2-2026-3862 (ALAS-2026-3862)

The version of kernel installed on the remote host is prior to 4.14.152-124.171. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3862 advisory. In the Linux kernel, the following vulnerability has been resolved: USB: iowarrior: fix use-after-free on disconnect...