Fedora 45 : roundcubemail (2026-6ab831c1c5)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-6ab831c1c5 advisory. Release 1.7.4 - Use X-Content-Type-Options:nosniff for attachment previews and downloads 10308 - zipdownload: Fix attachment filename sanitisation of backsla...

Linux Distros Unpatched Vulnerability : CVE-2026-92238

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A maliciously constructed mail header could lead to multiple fields being parsed as one, or potential memory safety violations. This vulnerability was fixed in...

Linux Distros Unpatched Vulnerability : CVE-2026-89985

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: memcg: keep folio's objcg same as its node memcgreparentobjcgs has an inherent assumption th...

MiracleLinux 8 : perl-YAML-Syck-1.30-7.el8_10 (AXSA:2026-1847:02)

The remote MiracleLinux 8 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1847:02 advisory. YAML-Syck: YAML::Syck: Denial of Service via crafted YAML document CVE-2026-13713 Tenable has extracted the preceding description block directly from the...

Linux Distros Unpatched Vulnerability : CVE-2026-89795

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PCI: Allow per function PCI slots to fix slot reset on s390 On s390 systems, which use a machine level hypervisor, PCI devices are always accessed through a for...

Arista Networks EOS 4.36.1F Multiple Vulnerabilities (SA0150)

The version of Arista Networks EOS running on the remote device is affected by multiple vulnerabilities as referenced in security advisory SA0150. - On Arista EOS 4.36.1F configured as an 802.1X authenticator with per-supplicant access control lists, an adjacent attacker can trigger an unexpected...

TencentOS Server 4: tesseract (TSSA-2026:1010)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1010 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

Linux Distros Unpatched Vulnerability : CVE-2026-89836

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - f2fs: fix folionrpages race after put in large folio invalidate Our v6.18 based Android system is continuely suffering livelock and bad page stat as shown in1...

Linux Distros Unpatched Vulnerability : CVE-2026-46498

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Open Access Management OpenAM is an access management solution. Prior to 16.1.1, OAuthTokenStore reads caller-supplied token identifiers from the shared Core...

Linux Distros Unpatched Vulnerability : CVE-2026-89982

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - i2c: mux: Fix channel node leak on adapter add failure i2cmuxaddadapter takes a reference to the Device Tree channel node before registering the new adapter. If...

Oracle Linux 9 : corosync (ELSA-2026-67873)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-67873 advisory. 3.1.10-1.2 - Resolves: RHEL-251542 - totempg: Replace assert with check in deliverfn fixes CVE-2026-81665 Tenable has extracted the preceding description block...

RHEL 9 : gstreamer1-plugins-base (RHSA-2026:67892)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:67892 advisory. GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-base packages contain a...

Linux Distros Unpatched Vulnerability : CVE-2026-77860

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In NLnetLabs Unbound 1.20.0 up to and including 1.26.0, a vulnerability on the 'serve-expired' code path can cause a double decrement on the 'wait-limit' count...

Linux Distros Unpatched Vulnerability : CVE-2026-89967

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mm/migratedevice: avoid out-of-bounds writes for compound folios migratedevicerange and migratedevicepfns clear the entries following a compound folio so that t...

Linux Distros Unpatched Vulnerability : CVE-2026-92054

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Privilege escalation in the Memory component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3...

RHEL 9 : corosync (RHSA-2026:67879)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:67879 advisory. The corosync packages provide the Corosync Cluster Engine and C APIs for Red Hat Enterprise Linux cluster software. Security Fixes: corosync:...

RHEL 10 : libsoup3 (RHSA-2026:68235)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:68235 advisory. Libsoup is an HTTP library implementation in C. It was originally part of a SOAP Simple Object Access Protocol implementation called Soup,...

Linux Distros Unpatched Vulnerability : CVE-2026-92056

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3...

RHEL 9 : libsoup (RHSA-2026:68234)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:68234 advisory. The libsoup packages provide an HTTP client and server library for GNOME. Security Fixes: SoupWebsocketExtensionDeflate: libsoup: libsoup:...

Linux Distros Unpatched Vulnerability : CVE-2026-62263

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Open Access Management OpenAM is an access management solution. Prior to 16.1.2, WebAuthnAuthentication.deserialize applies an ObjectInputFilter that allows eve...

Fedora 45 : python-jwcrypto (2026-6d094c5360)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-6d094c5360 advisory. Low severity security fixes Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested...

Linux Distros Unpatched Vulnerability : CVE-2026-92073

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Privilege escalation in the Enterprise Policies component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153....

Oracle Linux 10 : rsyslog (ELSA-2026-67584)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-67584 advisory. 8.2510.0-5.1 - Backport: guard regex-framing match against iCurrLine == 0 to fix crash Resolves: RHEL-212700 Tenable has extracted the preceding description...

Oracle Linux 10 : .NET / 8.0 (ELSA-2026-67525)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-67525 advisory. 8.0.131-1.0.1 - Add support for Oracle Linux 8.0.131-1 - Update to .NET SDK 8.0.131 and Runtime 8.0.31 - Resolves: RHEL-252248 Tenable has extracted the...

Jenkins plugins Multiple Vulnerabilities (2026-09-16)

According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities: - Jenkins Gitee Plugin 1301.v8957053c7902 and earlier does not escape the sender name from Gitee push webhook payloads in build causes,...

Linux Distros Unpatched Vulnerability : CVE-2026-89885

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - media: platform: mtk-mdp3: Fix SCP device refcounting mdpprobe first tries to get the SCP handle with scpget. When that fails, it falls back to looking up the S...

Linux Distros Unpatched Vulnerability : CVE-2026-89793

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ublk: clear VMMAYWRITE on read-only ublk char device mmap ublkchmmap rejects mmap requests with VMWRITE set, but never clears VMMAYWRITE on the resulting...

Linux Distros Unpatched Vulnerability : CVE-2026-90030

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: dwc3: clear forceRM when issuing EndTransfer The forceRM bit of the DEPCMD register controls the behavior of the EndTransfer command used to stop an active...

Drupal 10.6.x < 10.6.17 / 11.3.x < 11.3.17 / 11.4.x < 11.4.7 Drupal Vulnerability (SA-CORE-2026-013)

According to its self-reported version, the instance of Drupal running on the remote web server is 10.6.x prior to 10.6.17, 11.3.x prior to 11.3.17, or 11.4.x prior to 11.4.7. It is, therefore, affected by a vulnerability. - The Drupal project uses the CKEditor library for WYSIWYG editing. CKEdit...

Linux Distros Unpatched Vulnerability : CVE-2026-90049

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: skbuff: don't skbtxerror the source skb in skbzerocopy skbzerocopy copies frags from @from into @to. On an skborphanfrags failure it calls skbtxerror@from,...

Linux Distros Unpatched Vulnerability : CVE-2026-19662

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An attacker may be able to cause a named resolver to abort. The attack requires inducing the victim resolver to send multiple queries for a DNSSEC-signed zone...

Linux Distros Unpatched Vulnerability : CVE-2026-89995

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - dma-direct: return struct page from dmadirectallocfrompool Commit 5b138c534fda dma-direct: factor out a dmadirectallocfrompool helper changed...

Linux Distros Unpatched Vulnerability : CVE-2026-89993

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - dmaengine: dw-edma: Initialize IRQ data before requesting IRQs dwedmairqrequest passes struct dwedmairq to requestirq before dwedmachannelsetup fills the back...

Arista Networks EOS 802.1X Per-Supplicant ACL Bypass (SA0150) (CVE-2026-75943)

The version of Arista Networks EOS running on the remote device is affected by an access control bypass vulnerability as referenced in security advisory SA0150. - On affected releases of Arista EOS configured as an 802.1X authenticator with per-supplicant access control lists, traffic from an...

SUSE SLES15 Security Update : NetworkManager (SUSE-SU-2026:4144-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4144-1 advisory. - CVE-2026-10805: Local privilege escalation via malformed MUD URLs in dhclient backend bsc1267696. - CVE-2026-19685: missing user...

Linux Distros Unpatched Vulnerability : CVE-2026-89916

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: arm64: Make VNCR invalidation participate in MMU invalidation retry A VNCR TLB invalidation can occur on one vcpu while another vcpu is faulting in this sa...

Linux Distros Unpatched Vulnerability : CVE-2026-91839

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in NetworkManager-fortisslvpn, the FortiSSLVPN plugin for NetworkManager. The nm- fortisslvpn-service improperly handles...

Linux Distros Unpatched Vulnerability : CVE-2026-89926

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: s390: Fix length check importwpinfo struct kvmhwbreakpoint::len is a u64 that is fully controlled by user space. This is then assigned to wpinfo-len, whic...

SUSE SLED15: ffmpeg-4 / ffmpeg-4-libavcodec-devel / ffmpeg-4-libavdevice-devel / etc (SUSE-SU-2026:4149-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4149-1 advisory. - CVE-2026-58049: incorrect validation in the RASC video decoder can lead to an out-of-bounds heap write and...

Linux Distros Unpatched Vulnerability : CVE-2026-89899

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - media: cec: disable delayed work before freeing an interrupted transmit cectransmitmsgfh drops adap-lock to wait for a blocking transmit in...

Linux Distros Unpatched Vulnerability : CVE-2026-89817

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/gud: NUL-terminate TV mode names read from the device gudconnectoraddtvmode reads a buffer of fixed-size mode names from the USB device and passes pointers...

GitLab 18.2.7 < 19.1.8 / 19.2 < 19.2.6 / 19.3 < 19.3.2 (CVE-2026-3855)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an...

Oracle Coherence (September 2026 CSPU)

The 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 versions of Coherence installed on the remote host are affected by multiple vulnerabilities as referenced in the September 2026 CSPU advisory. - Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware component: Core...

Oracle Linux 9 : .NET / 9.0 (ELSA-2026-67614)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-67614 advisory. 9.0.121-1.0.1 - Add support for Oracle Linux 9.0.121-1 - Update to .NET SDK 9.0.121 and Runtime 9.0.20 - Resolves: RHEL-252278 Tenable has extracted t...

Linux Distros Unpatched Vulnerability : CVE-2026-90036

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NFSD: Prevent client use-after-free during blocked-lock reaping A bare lock owner -- its only remaining reference a blocked lock on nn-blockedlockslru -- holds ...

Linux Distros Unpatched Vulnerability : CVE-2026-89825

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/panthor: fix firmware control interface bounds checks panthorinitcsiface and panthorinitcsgiface validate firmware control interface offsets with 32-bit...

Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : SRT vulnerabilities (USN-8764-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8764-1 advisory. It was discovered that SRT did not authenticate certain encryption control messages. A remote attacker could possibly...

Linux Distros Unpatched Vulnerability : CVE-2026-90011

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scsi: target: iscsi: Reserve a terminator byte for the login payload iscsitargetcheckloginrequest rejects a login PDU whose DataSegmentLength exceeds...

Linux Distros Unpatched Vulnerability : CVE-2026-92035

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Sandbox escape due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156,...

Linux Distros Unpatched Vulnerability : CVE-2026-90018

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - staging: rtl8723bs: fix OOB read / stack overflow in rtwgetwpsattr rtwgetwpsattr walks WPS attributes inside a WPS IE taken from a wireless management frame. F...