The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:7383 advisory.

    Cockpit enables users to administer GNU/Linux servers using a web browser. It     offers network configuration, log inspection, diagnostic reports, SELinux     troubleshooting, interactive command-line sessions, and more.

    Security Fix(es):

    * cockpit: ws: be more explicit when handling hostnames on cli (CVE-2026-4631)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE page(s)     listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:8547 advisory.

    libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C.

    Security Fix(es):

    * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination     (CVE-2026-27135)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:8546 advisory.

    libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C.

    Security Fix(es):

    * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination     (CVE-2026-27135)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:8311 advisory.

    This module provides a Perl interface to the libsyck data serialization library. It exports the Dump and     Load functions for converting Perl data structures to YAML strings, and the other way around.

    Security Fix(es):

    * perl-YAML-Syck: YAML::Syck versions through 1.36 for Perl has several potential security vulnerabilities     including a high-severity heap buffer overflow in the YAML emitter (CVE-2026-4177)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:8578 advisory.

    This module provides ways to parse XML documents. It is built on top of XML::Parser::Expat, which is a     lower level interface to James Clark's expat library. Each call to one of the parsing methods creates a     new instance of XML::Parser::Expat which is then used to parse the document. Expat options may be provided     when the XML::Parser object is created. These options are then passed on to the Expat object on each parse     call. They can also be given as extra arguments to the parse methods, in which case they override options     given at XML::Parser creation time.

    Security Fix(es):

    * perl-xml-parser: XML::Parser: Memory corruption via deeply nested XML files (CVE-2006-10003)

    * perl-xml-parser: XML::Parser for Perl: Heap corruption and denial of service from crafted XML input     (CVE-2006-10002)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:8577 advisory.

    This module provides ways to parse XML documents. It is built on top of XML::Parser::Expat, which is a     lower level interface to James Clark's expat library. Each call to one of the parsing methods creates a     new instance of XML::Parser::Expat which is then used to parse the document. Expat options may be provided     when the XML::Parser object is created. These options are then passed on to the Expat object on each parse     call. They can also be given as extra arguments to the parse methods, in which case they override options     given at XML::Parser creation time.

    Security Fix(es):

    * perl-xml-parser: XML::Parser: Memory corruption via deeply nested XML files (CVE-2006-10003)

    * perl-xml-parser: XML::Parser for Perl: Heap corruption and denial of service from crafted XML input     (CVE-2006-10002)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:8545 advisory.

    libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C.

    Security Fix(es):

    * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination     (CVE-2026-27135)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:8610 advisory.

    This module provides ways to parse XML documents. It is built on top of XML::Parser::Expat, which is a     lower level interface to James Clark's expat library. Each call to one of the parsing methods creates a     new instance of XML::Parser::Expat which is then used to parse the document. Expat options may be provided     when the XML::Parser object is created. These options are then passed on to the Expat object on each parse     call. They can also be given as extra arguments to the parse methods, in which case they override options     given at XML::Parser creation time.

    Security Fix(es):

    * perl-xml-parser: XML::Parser: Memory corruption via deeply nested XML files (CVE-2006-10003)

    * perl-xml-parser: XML::Parser for Perl: Heap corruption and denial of service from crafted XML input     (CVE-2006-10002)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:8540 advisory.

    libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C.

    Security Fix(es):

    * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination     (CVE-2026-27135)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:8538 advisory.

    libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C.

    Security Fix(es):

    * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination     (CVE-2026-27135)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:8475 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 9.0.116 and .NET Runtime 9.0.15.Security Fix(es):

    * dotnet: .NET: Security Bypass and Denial of Service Vulnerability (CVE-2026-26171)

    * dotnet: .NET: Denial of Service via stack overflow (CVE-2026-32203)

    * dotnet: .NET: Denial of Service via Infinite Recursion in XmlDecryptionTransform (CVE-2026-33116)

    * dotnet: Dotnet: SMTP Command Injection and Header Injection via MailAddress parsing flaw     (CVE-2026-32178)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:8539 advisory.

    libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C.

    Security Fix(es):

    * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination     (CVE-2026-27135)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:8467 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 10.0.106 and .NET Runtime 10.0.6.Security Fix(es):

    * dotnet: .NET: Security Bypass and Denial of Service Vulnerability (CVE-2026-26171)

    * dotnet: .NET: Denial of Service via stack overflow (CVE-2026-32203)

    * dotnet: .NET: Denial of Service via Infinite Recursion in XmlDecryptionTransform (CVE-2026-33116)

    * dotnet: Dotnet: SMTP Command Injection and Header Injection via MailAddress parsing flaw     (CVE-2026-32178)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:8521 advisory.

    The libarchive programming library can create and read several different streaming archive formats,     including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility,     scripting language bindings such as python-libarchive, and several popular desktop file managers.

    Security Fix(es):

    * libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing     (CVE-2026-4424)

    * libarchive: libarchive: Arbitrary code execution via integer overflow in ISO9660 image processing     (CVE-2026-5121)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:8609 advisory.

    This module provides ways to parse XML documents. It is built on top of XML::Parser::Expat, which is a     lower level interface to James Clark's expat library. Each call to one of the parsing methods creates a     new instance of XML::Parser::Expat which is then used to parse the document. Expat options may be provided     when the XML::Parser object is created. These options are then passed on to the Expat object on each parse     call. They can also be given as extra arguments to the parse methods, in which case they override options     given at XML::Parser creation time.

    Security Fix(es):

    * perl-xml-parser: XML::Parser: Memory corruption via deeply nested XML files (CVE-2006-10003)

    * perl-xml-parser: XML::Parser for Perl: Heap corruption and denial of service from crafted XML input     (CVE-2006-10002)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:8541 advisory.

    libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C.

    Security Fix(es):

    * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination     (CVE-2026-27135)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:8473 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 10.0.106 and .NET Runtime 10.0.6.Security Fix(es):

    * dotnet: .NET: Security Bypass and Denial of Service Vulnerability (CVE-2026-26171)

    * dotnet: .NET: Denial of Service via stack overflow (CVE-2026-32203)

    * dotnet: .NET: Denial of Service via Infinite Recursion in XmlDecryptionTransform (CVE-2026-33116)

    * dotnet: Dotnet: SMTP Command Injection and Header Injection via MailAddress parsing flaw     (CVE-2026-32178)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:8534 advisory.

    The libarchive programming library can create and read several different streaming archive formats,     including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility,     scripting language bindings such as python-libarchive, and several popular desktop file managers.

    Security Fix(es):

    * libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing     (CVE-2026-4424)

    * libarchive: libarchive: Arbitrary code execution via integer overflow in ISO9660 image processing     (CVE-2026-5121)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:8517 advisory.

    The libarchive programming library can create and read several different streaming archive formats,     including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility,     scripting language bindings such as python-libarchive, and several popular desktop file managers.

    Security Fix(es):

    * libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing     (CVE-2026-4424)

    * libarchive: libarchive: Arbitrary code execution via integer overflow in ISO9660 image processing     (CVE-2026-5121)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:8457 advisory.

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

    Security Fix(es):

    * FreeRDP: FreeRDP: Heap buffer overflow allows arbitrary code execution via crafted pixel data     (CVE-2026-33984)

    * FreeRDP: FreeRDP: Denial of Service via specially crafted Remote Desktop Protocol messages     (CVE-2026-33983)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:8548 advisory.

    libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C.

    Security Fix(es):

    * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination     (CVE-2026-27135)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:8608 advisory.

    This module provides ways to parse XML documents. It is built on top of XML::Parser::Expat, which is a     lower level interface to James Clark's expat library. Each call to one of the parsing methods creates a     new instance of XML::Parser::Expat which is then used to parse the document. Expat options may be provided     when the XML::Parser object is created. These options are then passed on to the Expat object on each parse     call. They can also be given as extra arguments to the parse methods, in which case they override options     given at XML::Parser creation time.

    Security Fix(es):

    * perl-xml-parser: XML::Parser: Memory corruption via deeply nested XML files (CVE-2006-10003)

    * perl-xml-parser: XML::Parser for Perl: Heap corruption and denial of service from crafted XML input     (CVE-2006-10002)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:8510 advisory.

    The libarchive programming library can create and read several different streaming archive formats,     including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility,     scripting language bindings such as python-libarchive, and several popular desktop file managers.

    Security Fix(es):

    * libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing     (CVE-2026-4424)

    * libarchive: libarchive: Arbitrary code execution via integer overflow in ISO9660 image processing     (CVE-2026-5121)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:8471 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 10.0.106 and .NET Runtime 10.0.6.Security Fix(es):

    * dotnet: .NET: Security Bypass and Denial of Service Vulnerability (CVE-2026-26171)

    * dotnet: .NET: Denial of Service via stack overflow (CVE-2026-32203)

    * dotnet: .NET: Denial of Service via Infinite Recursion in XmlDecryptionTransform (CVE-2026-33116)

    * dotnet: Dotnet: SMTP Command Injection and Header Injection via MailAddress parsing flaw     (CVE-2026-32178)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:8434 advisory.

    rhc is a client tool and daemon that connects the system to Red Hat hosted services enabling system and     subscription management.

    Security Fix(es):

    * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:8474 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 9.0.116 and .NET Runtime 9.0.15.Security Fix(es):

    * dotnet: .NET: Security Bypass and Denial of Service Vulnerability (CVE-2026-26171)

    * dotnet: .NET: Denial of Service via stack overflow (CVE-2026-32203)

    * dotnet: .NET: Denial of Service via Infinite Recursion in XmlDecryptionTransform (CVE-2026-33116)

    * dotnet: Dotnet: SMTP Command Injection and Header Injection via MailAddress parsing flaw     (CVE-2026-32178)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:8470 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 8.0.126 and .NET Runtime 8.0.26.Security Fix(es):

    * dotnet: .NET: Security Bypass and Denial of Service Vulnerability (CVE-2026-26171)

    * dotnet: .NET: Denial of Service via stack overflow (CVE-2026-32203)

    * dotnet: .NET: Denial of Service via Infinite Recursion in XmlDecryptionTransform (CVE-2026-33116)

    * dotnet: Dotnet: SMTP Command Injection and Header Injection via MailAddress parsing flaw     (CVE-2026-32178)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:8456 advisory.

    A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild     under the hood. Besides building images for local usage, it can also upload images directly to cloud.  It     is compatible with composer-cli and cockpit-composer clients.

    Security Fix(es):

    * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:8469 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 8.0.126 and .NET Runtime 8.0.26.Security Fix(es):

    * dotnet: .NET: Security Bypass and Denial of Service Vulnerability (CVE-2026-26171)

    * dotnet: .NET: Denial of Service via stack overflow (CVE-2026-32203)

    * dotnet: .NET: Denial of Service via Infinite Recursion in XmlDecryptionTransform (CVE-2026-33116)

    * dotnet: Dotnet: SMTP Command Injection and Header Injection via MailAddress parsing flaw     (CVE-2026-32178)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:7238 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution     designed for on-premise or private cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.13.65. See the     following advisory for the container images for this release:

    https://access.redhat.com/errata/RHSA-2026:7252

    Security Fix(es):

    None

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    All OpenShift Container Platform 4.13 users are advised to upgrade to these updated packages and images     when they are available in the appropriate release channel. To check for available updates, use the     OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at     https://docs.redhat.com/en/documentation/openshift_container_platform/4.13/html-     single/updating_clusters/index#updating-cluster-within-minor.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:8468 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK SDK_VERSION and .NET Runtime RUNTIME_VERSION.Security Fix(es):

    * dotnet: .NET: Security Bypass and Denial of Service Vulnerability (CVE-2026-26171)

    * dotnet: .NET: Denial of Service via stack overflow (CVE-2026-32203)

    * dotnet: .NET: Denial of Service via Infinite Recursion in XmlDecryptionTransform (CVE-2026-33116)

    * dotnet: Dotnet: SMTP Command Injection and Header Injection via MailAddress parsing flaw     (CVE-2026-32178)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:8492 advisory.

    The libarchive programming library can create and read several different streaming archive formats,     including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility,     scripting language bindings such as python-libarchive, and several popular desktop file managers.

    Security Fix(es):

    * libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing     (CVE-2026-4424)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:8459 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    Security Fix(es):

    * libpng: libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416)

    * libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon     palette expansion (CVE-2026-33636)

    * thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox     149.0.2 and Thunderbird 149.0.2 (CVE-2026-5734)

    * thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird     ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVE-2026-5731)

    * firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics: Text component     (CVE-2026-5732)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:8472 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 9.0.116 and .NET Runtime 9.0.15.Security Fix(es):

    * dotnet: .NET: Security Bypass and Denial of Service Vulnerability (CVE-2026-26171)

    * dotnet: .NET: Denial of Service via stack overflow (CVE-2026-32203)

    * dotnet: .NET: Denial of Service via Infinite Recursion in XmlDecryptionTransform (CVE-2026-33116)

    * dotnet: Dotnet: SMTP Command Injection and Header Injection via MailAddress parsing flaw     (CVE-2026-32178)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:8458 advisory.

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

    Security Fix(es):

    * FreeRDP: FreeRDP: Heap buffer overflow allows arbitrary code execution via crafted pixel data     (CVE-2026-33984)

    * FreeRDP: FreeRDP: Denial of Service via specially crafted Remote Desktop Protocol messages     (CVE-2026-33983)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:8427 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    Security Fix(es):

    * firefox: thunderbird: Use-after-free in the JavaScript Engine component (CVE-2026-4701)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR     140.9, Firefox 149 and Thunderbird 149 (CVE-2026-4721)

    * firefox: thunderbird: Privilege escalation in the Netmonitor component (CVE-2026-4717)

    * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component     (CVE-2026-4688)

    * firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4706)

    * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Web Codecs component     (CVE-2026-4695)

    * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM     component (CVE-2026-4689)

    * firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-4698)

    * firefox: thunderbird: Incorrect boundary conditions, uninitialized memory in the JavaScript Engine     component (CVE-2026-4716)

    * firefox: thunderbird: Race condition, use-after-free in the Graphics: WebRender component     (CVE-2026-4684)

    * firefox: thunderbird: Undefined behavior in the WebRTC: Signaling component (CVE-2026-4705)

    * firefox: thunderbird: Uninitialized memory in the Graphics: Canvas2D component (CVE-2026-4715)

    * firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4685)

    * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video component (CVE-2026-4714)

    * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-4709)

    * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video component (CVE-2026-4710)

    * firefox: thunderbird: Information disclosure in the Widget: Cocoa component (CVE-2026-4712)

    * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Web Codecs component     (CVE-2026-4697)

    * firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-4713)

    * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM     component (CVE-2026-4690)

    * firefox: thunderbird: Use-after-free in the Widget: Cocoa component (CVE-2026-4711)

    * firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4686)

    * firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-4708)

    * firefox: thunderbird: Use-after-free in the CSS Parsing and Computation component (CVE-2026-4691)

    * firefox: thunderbird: Incorrect boundary conditions in the Layout: Text and Fonts component     (CVE-2026-4699)

    * firefox: thunderbird: Use-after-free in the Layout: Text and Fonts component (CVE-2026-4696)

    * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Playback component     (CVE-2026-4693)

    * firefox: thunderbird: Undefined behavior in the WebRTC: Signaling component (CVE-2026-4718)

    * firefox: thunderbird: JIT miscompilation in the JavaScript Engine component (CVE-2026-4702)

    * firefox: thunderbird: Incorrect boundary conditions in the Graphics: Text component (CVE-2026-4719)

    * firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics component     (CVE-2026-4694)

    * firefox: thunderbird: Sandbox escape in the Responsive Design Mode component (CVE-2026-4692)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149     and Thunderbird 149 (CVE-2026-4720)

    * firefox: thunderbird: Mitigation bypass in the Networking: HTTP component (CVE-2026-4700)

    * firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4707)

    * firefox: thunderbird: Denial-of-service in the WebRTC: Signaling component (CVE-2026-4704)

    * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Telemetry component     (CVE-2026-4687)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:1241 advisory.

    The resource-agents packages provide the Pacemaker and RGManager service managers with a set of scripts.
    These scripts interface with several services to allow operating in a high-availability (HA) environment.

    Security Fix(es):

    * urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion (CVE-2025-66418)

    * urllib3: urllib3 Streaming API improperly handles highly compressed data (CVE-2025-66471)

    * urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects     (streaming API) (CVE-2026-21441)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:1240 advisory.

    The fence-agents packages provide a collection of scripts for handling remote power management for cluster     devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.

    Security Fix(es):

    * urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion (CVE-2025-66418)

    * urllib3: urllib3 Streaming API improperly handles highly compressed data (CVE-2025-66471)

    * urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects     (streaming API) (CVE-2026-21441)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:8352 advisory.

    The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols.
    BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing     with DNS); and tools for verifying that the DNS server is operating correctly.

    Security Fix(es):

    * bind: BIND: Denial of Service via maliciously crafted DNSSEC-validated zone (CVE-2026-1519)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:8315 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    Security Fix(es):

    * firefox: thunderbird: Use-after-free in the JavaScript Engine component (CVE-2026-4701)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR     140.9, Firefox 149 and Thunderbird 149 (CVE-2026-4721)

    * firefox: thunderbird: Privilege escalation in the Netmonitor component (CVE-2026-4717)

    * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component     (CVE-2026-4688)

    * firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4706)

    * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Web Codecs component     (CVE-2026-4695)

    * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM     component (CVE-2026-4689)

    * firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-4698)

    * firefox: thunderbird: Incorrect boundary conditions, uninitialized memory in the JavaScript Engine     component (CVE-2026-4716)

    * firefox: thunderbird: Race condition, use-after-free in the Graphics: WebRender component     (CVE-2026-4684)

    * firefox: thunderbird: Undefined behavior in the WebRTC: Signaling component (CVE-2026-4705)

    * firefox: thunderbird: Uninitialized memory in the Graphics: Canvas2D component (CVE-2026-4715)

    * firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4685)

    * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video component (CVE-2026-4714)

    * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-4709)

    * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video component (CVE-2026-4710)

    * firefox: thunderbird: Information disclosure in the Widget: Cocoa component (CVE-2026-4712)

    * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Web Codecs component     (CVE-2026-4697)

    * firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-4713)

    * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM     component (CVE-2026-4690)

    * firefox: thunderbird: Use-after-free in the Widget: Cocoa component (CVE-2026-4711)

    * firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4686)

    * firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-4708)

    * firefox: thunderbird: Use-after-free in the CSS Parsing and Computation component (CVE-2026-4691)

    * firefox: thunderbird: Incorrect boundary conditions in the Layout: Text and Fonts component     (CVE-2026-4699)

    * firefox: thunderbird: Use-after-free in the Layout: Text and Fonts component (CVE-2026-4696)

    * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Playback component     (CVE-2026-4693)

    * firefox: thunderbird: Undefined behavior in the WebRTC: Signaling component (CVE-2026-4718)

    * firefox: thunderbird: JIT miscompilation in the JavaScript Engine component (CVE-2026-4702)

    * firefox: thunderbird: Incorrect boundary conditions in the Graphics: Text component (CVE-2026-4719)

    * firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics component     (CVE-2026-4694)

    * firefox: thunderbird: Sandbox escape in the Responsive Design Mode component (CVE-2026-4692)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149     and Thunderbird 149 (CVE-2026-4720)

    * firefox: thunderbird: Mitigation bypass in the Networking: HTTP component (CVE-2026-4700)

    * firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4707)

    * firefox: thunderbird: Denial-of-service in the WebRTC: Signaling component (CVE-2026-4704)

    * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Telemetry component     (CVE-2026-4687)

    * thunderbird: Out of bounds read in IMAP parsing (CVE-2026-4371)

    * thunderbird: Spoofing issue in Thunderbird (CVE-2026-3889)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:8317 advisory.

    Squid is a high-performance proxy caching server for web clients, supporting FTP, and HTTP data objects.

    Security Fix(es):

    * squid: Squid: Denial of Service via heap Use-After-Free vulnerability in ICP handling (CVE-2026-33526)

    * Squid: Squid: Denial of Service via crafted ICP traffic (CVE-2026-32748)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:8339 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

    * minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions     (CVE-2026-27904)

    * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination     (CVE-2026-27135)

    * Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:8342 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: Linux kernel: Local denial of service and memory leak in DAMON sysfs via setup failure     (CVE-2026-23144)

    * kernel: Linux kernel: Use-after-free in bonding module can cause system crash or arbitrary code     execution (CVE-2026-23171)

    * kernel: net/sched: cls_u32: use skb_header_pointer_careful() (CVE-2026-23204)

    * kernel: Linux kernel (qla2xxx): Double free vulnerability leads to denial of service and potential     privilege escalation. (CVE-2025-71238)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:8325 advisory.

    The buildah package provides a tool for facilitating building OCI container images. Among other things,     buildah enables you to: Create a working container, either from scratch or using an image as a starting     point; Create an image, either from a working container or using the instructions in a Dockerfile; Build     both Docker and OCI images.

    Security Fix(es):

    * runc: container escape via 'masked path' abuse due to mount race conditions (CVE-2025-31133)

    * runc: container escape with malicious config due to /dev/console mount and related races     (CVE-2025-52565)

    * runc: container escape and denial of service due to arbitrary write gadgets and procfs write redirects     (CVE-2025-52881)

    * golang: archive/tar: Unbounded allocation when parsing GNU sparse map (CVE-2025-58183)

    * golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected     SSH_AGENT_SUCCESS (CVE-2025-47913)

    * github.com/sirupsen/logrus: github.com/sirupsen/logrus: Denial-of-Service due to large single-line     payload (CVE-2025-65637)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:8312 advisory.

    The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols.
    BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing     with DNS); and tools for verifying that the DNS server is operating correctly.

    Security Fix(es):

    * bind: BIND: Denial of Service via maliciously crafted DNSSEC-validated zone (CVE-2026-1519)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:8259 advisory.

    Vim (Vi IMproved) is an updated and improved version of the vi editor.

    Security Fix(es):

    * vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin (CVE-2026-28417)

    * vim: Vim: Denial of service and information disclosure via crafted swap file (CVE-2026-28421)

    * vim: Vim: Arbitrary code execution via command injection in glob() function (CVE-2026-33412)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:8324 advisory.

    rhc is a client tool and daemon that connects the system to Red Hat hosted services enabling system and     subscription management.

    Security Fix(es):

    * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:8287 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    Security Fix(es):

    * firefox: thunderbird: Use-after-free in the JavaScript Engine component (CVE-2026-4701)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR     140.9, Firefox 149 and Thunderbird 149 (CVE-2026-4721)

    * firefox: thunderbird: Privilege escalation in the Netmonitor component (CVE-2026-4717)

    * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component     (CVE-2026-4688)

    * firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4706)

    * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Web Codecs component     (CVE-2026-4695)

    * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM     component (CVE-2026-4689)

    * firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-4698)

    * firefox: thunderbird: Incorrect boundary conditions, uninitialized memory in the JavaScript Engine     component (CVE-2026-4716)

    * firefox: thunderbird: Race condition, use-after-free in the Graphics: WebRender component     (CVE-2026-4684)

    * firefox: thunderbird: Undefined behavior in the WebRTC: Signaling component (CVE-2026-4705)

    * firefox: thunderbird: Uninitialized memory in the Graphics: Canvas2D component (CVE-2026-4715)

    * firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4685)

    * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video component (CVE-2026-4714)

    * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-4709)

    * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video component (CVE-2026-4710)

    * firefox: thunderbird: Information disclosure in the Widget: Cocoa component (CVE-2026-4712)

    * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Web Codecs component     (CVE-2026-4697)

    * firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-4713)

    * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM     component (CVE-2026-4690)

    * firefox: thunderbird: Use-after-free in the Widget: Cocoa component (CVE-2026-4711)

    * firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4686)

    * firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-4708)

    * firefox: thunderbird: Use-after-free in the CSS Parsing and Computation component (CVE-2026-4691)

    * firefox: thunderbird: Incorrect boundary conditions in the Layout: Text and Fonts component     (CVE-2026-4699)

    * firefox: thunderbird: Use-after-free in the Layout: Text and Fonts component (CVE-2026-4696)

    * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Playback component     (CVE-2026-4693)

    * firefox: thunderbird: Undefined behavior in the WebRTC: Signaling component (CVE-2026-4718)

    * firefox: thunderbird: JIT miscompilation in the JavaScript Engine component (CVE-2026-4702)

    * firefox: thunderbird: Incorrect boundary conditions in the Graphics: Text component (CVE-2026-4719)

    * firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics component     (CVE-2026-4694)

    * firefox: thunderbird: Sandbox escape in the Responsive Design Mode component (CVE-2026-4692)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149     and Thunderbird 149 (CVE-2026-4720)

    * firefox: thunderbird: Mitigation bypass in the Networking: HTTP component (CVE-2026-4700)

    * firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4707)

    * firefox: thunderbird: Denial-of-service in the WebRTC: Signaling component (CVE-2026-4704)

    * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Telemetry component     (CVE-2026-4687)

    * thunderbird: Out of bounds read in IMAP parsing (CVE-2026-4371)

    * thunderbird: Spoofing issue in Thunderbird (CVE-2026-3889)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:8314 advisory.

    Delve is a debugger for the Go programming language. The goal of the project is to provide a simple, full     featured debugging tool for Go. Delve should be easy to invoke and easy to use. Chances are if you're     using a debugger, things aren't going your way. With that in mind, Delve should stay out of your way as     much as possible.

    Security Fix(es):

    * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:8322 advisory.

    rhc is a client tool and daemon that connects the system to Red Hat hosted services enabling system and     subscription management.

    Security Fix(es):

    * golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)     (CVE-2023-39325)

    * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Severity
307025	RHEL 10 : cockpit: Unauthenticated remote code execution due to SSH command-line argument injection (Critical) (RHSA-2026:7383)	critical
306860	RHEL 9 : nghttp2 (RHSA-2026:8547)	high
306859	RHEL 9 : nghttp2 (RHSA-2026:8546)	high
306858	RHEL 7 : perl-YAML-Syck (RHSA-2026:8311)	critical
306857	RHEL 7 : perl-XML-Parser (RHSA-2026:8578)	critical
306797	RHEL 8 : perl-XML-Parser (RHSA-2026:8577)	critical
306796	RHEL 9 : nghttp2 (RHSA-2026:8545)	high
306795	RHEL 8 : perl-XML-Parser (RHSA-2026:8610)	critical
306794	RHEL 8 : nghttp2 (RHSA-2026:8540)	high
306793	RHEL 8 : nghttp2 (RHSA-2026:8538)	high
306792	RHEL 8 : .NET 9.0 (RHSA-2026:8475)	high
306791	RHEL 8 : nghttp2 (RHSA-2026:8539)	high
306790	RHEL 10 : .NET 10.0 (RHSA-2026:8467)	high
306789	RHEL 8 : libarchive (RHSA-2026:8521)	critical
306788	RHEL 8 : perl-XML-Parser (RHSA-2026:8609)	critical
306787	RHEL 8 : nghttp2 (RHSA-2026:8541)	high
306786	RHEL 8 : .NET 10.0 (RHSA-2026:8473)	high
306785	RHEL 8 : libarchive (RHSA-2026:8534)	critical
306784	RHEL 7 : libarchive (RHSA-2026:8517)	critical
306783	RHEL 9 : freerdp (RHSA-2026:8457)	high
306782	RHEL 9 : nghttp2 (RHSA-2026:8548)	high
306781	RHEL 8 : perl-XML-Parser (RHSA-2026:8608)	critical
306774	RHEL 9 : libarchive (RHSA-2026:8510)	critical
306773	RHEL 9 : .NET 10.0 (RHSA-2026:8471)	high
306772	RHEL 8 : rhc (RHSA-2026:8434)	high
306771	RHEL 9 : .NET 9.0 (RHSA-2026:8474)	high
306770	RHEL 10 : .NET 8.0 (RHSA-2026:8470)	high
306769	RHEL 8 : osbuild-composer (RHSA-2026:8456)	high
306768	RHEL 9 : .NET 8.0 (RHSA-2026:8469)	high
306767	RHEL 8 / 9 : OpenShift Container Platform 4.13.65 (RHSA-2026:7238)	high
306766	RHEL 8 : .NET 8.0 (RHSA-2026:8468)	high
306765	RHEL 10 : libarchive (RHSA-2026:8492)	high
306764	RHEL 9 : thunderbird (RHSA-2026:8459)	critical
306763	RHEL 10 : .NET 9.0 (RHSA-2026:8472)	high
306762	RHEL 10 : freerdp (RHSA-2026:8458)	high
306725	RHEL 7 : firefox (RHSA-2026:8427)	critical
306715	RHEL 8 : resource-agents (RHSA-2026:1241)	high
306714	RHEL 8 : fence-agents (RHSA-2026:1240)	high
306710	RHEL 8 : bind (RHSA-2026:8352)	high
306646	RHEL 10 : thunderbird (RHSA-2026:8315)	critical
306645	RHEL 8 : squid:4 (RHSA-2026:8317)	critical
306644	RHEL 8 : nodejs:20 (RHSA-2026:8339)	high
306643	RHEL 10 : kernel (RHSA-2026:8342)	high
306642	RHEL 9 : buildah, crun, podman, runc, and skopeo (RHSA-2026:8325)	high
306629	RHEL 10 : bind (RHSA-2026:8312)	high
306628	RHEL 9 : vim (RHSA-2026:8259)	high
306627	RHEL 9 : rhc (RHSA-2026:8324)	high
306626	RHEL 9 : thunderbird (RHSA-2026:8287)	critical
306625	RHEL 10 : delve (RHSA-2026:8314)	high
306624	RHEL 9 : rhc (RHSA-2026:8322)	high

Detections

Analytics

Red Hat Local Security Checks Family for Nessus

critical

high

high

critical

critical

critical

high

critical

high

high

high

high

high

critical

critical

high

high

critical

critical

high

high

critical

critical

high

high

high

high

high

high

high

high

high

critical

high

high

critical

high

high

high

critical

critical

high

high

high

high

high

high

critical

high

high