XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected cross-site scripting (XSS) vulnerability in the error page component.

alma_linux ALSA-2026:64772: ALSA-2026:64772: xmlrpc-c security update (High)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:64772 advisory.

    XML-RPC is a remote procedure call (RPC) protocol that uses XML to encode its calls and HTTP as a     transport mechanism. The xmlrpc-c packages provide a network protocol to allow a client program to make a     simple RPC (remote procedure call) over the Internet. It converts an RPC into an XML document, sends it to     a remote server using HTTP, and gets back the response in XML.

    Security Fix(es):

    * xmlrpc-c: XMLRPC-C Library: Cross-Site Scripting in error page component (CVE-2026-15928)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1743:01 advisory.

    * xmlrpc-c: XMLRPC-C Library: Cross-Site Scripting in error page component (CVE-2026-15928)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:61316 advisory.

    * xmlrpc-c: XMLRPC-C Library: Cross-Site Scripting in error page component (CVE-2026-15928)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-613160 advisory.

    [1.51.0-17]
    - Fix HTML injection in Abyss error responses and directory listings
    - Resolves: CVE-2026-15928

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:61316 advisory.

    * xmlrpc-c: XMLRPC-C Library: Cross-Site Scripting in error page component (CVE-2026-15928)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:61315 advisory.

    XML-RPC is a remote procedure call (RPC) protocol that uses XML to encode its calls and HTTP as a     transport mechanism. The xmlrpc-c packages provide a network protocol to allow a client program to make a     simple RPC (remote procedure call) over the Internet. It converts an RPC into an XML document, sends it to     a remote server using HTTP, and gets back the response in XML.

    Security Fix(es):

    * xmlrpc-c: XMLRPC-C Library: Cross-Site Scripting in error page component (CVE-2026-15928)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:61233 advisory.

    XML-RPC is a remote procedure call (RPC) protocol that uses XML to encode its calls and HTTP as a     transport mechanism. The xmlrpc-c packages provide a network protocol to allow a client program to make a     simple RPC (remote procedure call) over the Internet. It converts an RPC into an XML document, sends it to     a remote server using HTTP, and gets back the response in XML.

    Security Fix(es):

    * xmlrpc-c: XMLRPC-C Library: Cross-Site Scripting in error page component (CVE-2026-15928)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:61316 advisory.

    XML-RPC is a remote procedure call (RPC) protocol that uses XML to encode its calls and HTTP as a     transport mechanism. The xmlrpc-c packages provide a network protocol to allow a client program to make a     simple RPC (remote procedure call) over the Internet. It converts an RPC into an XML document, sends it to     a remote server using HTTP, and gets back the response in XML.

    Security Fix(es):

    * xmlrpc-c: XMLRPC-C Library: Cross-Site Scripting in error page component (CVE-2026-15928)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:61235 advisory.

    XML-RPC is a remote procedure call (RPC) protocol that uses XML to encode its calls and HTTP as a     transport mechanism. The xmlrpc-c packages provide a network protocol to allow a client program to make a     simple RPC (remote procedure call) over the Internet. It converts an RPC into an XML document, sends it to     a remote server using HTTP, and gets back the response in XML.

    Security Fix(es):

    * xmlrpc-c: XMLRPC-C Library: Cross-Site Scripting in error page component (CVE-2026-15928)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:61234 advisory.

    XML-RPC is a remote procedure call (RPC) protocol that uses XML to encode its calls and HTTP as a     transport mechanism. The xmlrpc-c packages provide a network protocol to allow a client program to make a     simple RPC (remote procedure call) over the Internet. It converts an RPC into an XML document, sends it to     a remote server using HTTP, and gets back the response in XML.

    Security Fix(es):

    * xmlrpc-c: XMLRPC-C Library: Cross-Site Scripting in error page component (CVE-2026-15928)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:61231 advisory.

    XML-RPC is a remote procedure call (RPC) protocol that uses XML to encode its calls and HTTP as a     transport mechanism. The xmlrpc-c packages provide a network protocol to allow a client program to make a     simple RPC (remote procedure call) over the Internet. It converts an RPC into an XML document, sends it to     a remote server using HTTP, and gets back the response in XML.

    Security Fix(es):

    * xmlrpc-c: XMLRPC-C Library: Cross-Site Scripting in error page component (CVE-2026-15928)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:61236 advisory.

    XML-RPC is a remote procedure call (RPC) protocol that uses XML to encode its calls and HTTP as a     transport mechanism. The xmlrpc-c packages provide a network protocol to allow a client program to make a     simple RPC (remote procedure call) over the Internet. It converts an RPC into an XML document, sends it to     a remote server using HTTP, and gets back the response in XML.

    Security Fix(es):

    * xmlrpc-c: XMLRPC-C Library: Cross-Site Scripting in error page component (CVE-2026-15928)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:61232 advisory.

    XML-RPC is a remote procedure call (RPC) protocol that uses XML to encode its calls and HTTP as a     transport mechanism. The xmlrpc-c packages provide a network protocol to allow a client program to make a     simple RPC (remote procedure call) over the Internet. It converts an RPC into an XML document, sends it to     a remote server using HTTP, and gets back the response in XML.

    Security Fix(es):

    * xmlrpc-c: XMLRPC-C Library: Cross-Site Scripting in error page component (CVE-2026-15928)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21633-1 advisory.

    This update for xmlrpc-c fixes the following issue

    - CVE-2026-15928: Xreflected cross-site scripting (XSS) vulnerability in the error page component     (bsc#1272769).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102697 advisory.

    XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected cross-site scripting (XSS)     vulnerability in the error page component.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3572-1 advisory.

    This update for xmlrpc-c fixes the following issue:

    - CVE-2026-15928: reflected cross-site scripting (XSS) via HTML injection in the error page component     (bsc#1272769).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected cross-site scripting (XSS)     vulnerability in the error page component. (CVE-2026-15928)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
343766	RHEL 8 : xmlrpc-c (RHSA-2026:64772)	Nessus	Red Hat Local Security Checks	Local	high
342595	MiracleLinux 9 : xmlrpc-c-1.51.0-17.el9_8 (AXSA:2026-1743:01)	Nessus	Miracle Linux Local Security Checks	Local	high
342331	AlmaLinux 9 : xmlrpc-c (ALSA-2026:61316)	Nessus	Alma Linux Local Security Checks	Local	high
342291	Oracle Linux 9 : ELSA-2026-61316-0: / xmlrpc-c (ELSA-2026-613160)	Nessus	Oracle Linux Local Security Checks	Local	high
342224	RockyLinux 9 : xmlrpc-c (RLSA-2026:61316)	Nessus	Rocky Linux Local Security Checks	Local	high
341718	RHEL 9 : xmlrpc-c (RHSA-2026:61315)	Nessus	Red Hat Local Security Checks	Local	high
341714	RHEL 8 : xmlrpc-c (RHSA-2026:61233)	Nessus	Red Hat Local Security Checks	Local	high
341713	RHEL 9 : xmlrpc-c (RHSA-2026:61316)	Nessus	Red Hat Local Security Checks	Local	high
341707	RHEL 8 : xmlrpc-c (RHSA-2026:61235)	Nessus	Red Hat Local Security Checks	Local	high
341703	RHEL 7 : xmlrpc-c (RHSA-2026:61234)	Nessus	Red Hat Local Security Checks	Local	high
341700	RHEL 9 : xmlrpc-c (RHSA-2026:61231)	Nessus	Red Hat Local Security Checks	Local	high
341635	RHEL 8 : xmlrpc-c (RHSA-2026:61236)	Nessus	Red Hat Local Security Checks	Local	high
341631	RHEL 9 : xmlrpc-c (RHSA-2026:61232)	Nessus	Red Hat Local Security Checks	Local	high
341161	openSUSE 16: libxmlrpc++8 / libxmlrpc3 / libxmlrpc_abyss++8 / libxmlrpc_abyss3 / etc (openSUSE-SU-2026:21633-1)	Nessus	SuSE Local Security Checks	Local	high
338580	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: xmlrpc-c (UTSA-2026-102697)	Nessus	Unity Linux Local Security Checks	Local	high
335099	SUSE SLED15: libxmlrpc++8 / libxmlrpc3 / libxmlrpc_abyss++8 / libxmlrpc_abyss3 / etc (SUSE-SU-2026:3572-1)	Nessus	SuSE Local Security Checks	Local	high
330133	Linux Distros Unpatched Vulnerability : CVE-2026-15928	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-15928

high

Tenable Plugins

Coming Soon

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high