The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:18027 advisory.

    The Grafana plugin for Performance Co-Pilot includes datasources for scalable     time series from pmseries and Redis, live PCP metrics and bpftrace scripts from     pmdabpftrace, as well as several dashboards.

    Security Fix(es):

    * golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root     (CVE-2026-32282)

    * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key     update messages (CVE-2026-32283)

    * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in     certificate chain building (CVE-2026-32280)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE page(s)     listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:18040 advisory.

    jq is a lightweight and flexible command-line JSON processor. jq is like sed for JSON data. You can use it     to slice, filter, map, or transform structured data with the same ease that sed, awk, grep, or similar     applications allow you to manipulate text.

    Security Fix(es):

    * jq: out-of-bounds read in jv_parse_sized() on error formatting for non-NUL-terminated buffers     (CVE-2026-39979)

    * jq: jq: Denial of Service via crafted JSON object causing hash collisions (CVE-2026-40164)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:18065 advisory.

    Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text     files and to perform system management tasks.

    Security Fix(es):

    * erb: ERB: Arbitrary code execution via deserialization bypass (CVE-2026-41316)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:18043 advisory.

    jq is a lightweight and flexible command-line JSON processor. jq is like sed for JSON data. You can use it     to slice, filter, map, or transform structured data with the same ease that sed, awk, grep, or similar     applications allow you to manipulate text.

    Security Fix(es):

    * jq: out-of-bounds read in jv_parse_sized() on error formatting for non-NUL-terminated buffers     (CVE-2026-39979)

    * jq: jq: Denial of Service via crafted JSON object causing hash collisions (CVE-2026-40164)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:18063 advisory.

    nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency,     performance, and low memory usage.

    Security Fix(es):

    * nginx: NGINX: Arbitrary Code Execution Vulnerability (CVE-2026-42945)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:18036 advisory.

    PackageKit is a D-Bus abstraction layer that allows the session user to manage packages in a secure way     using a cross-distribution, cross-architecture API.

    Security Fix(es):

    * PackageKit: race condition vulnerability leads to arbitrary package installation as root     (CVE-2026-41651)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:18047 advisory.

    jq is a lightweight and flexible command-line JSON processor. jq is like sed for JSON data. You can use it     to slice, filter, map, or transform structured data with the same ease that sed, awk, grep, or similar     applications allow you to manipulate text.

    Security Fix(es):

    * jq: out-of-bounds read in jv_parse_sized() on error formatting for non-NUL-terminated buffers     (CVE-2026-39979)

    * jq: jq: Denial of Service via crafted JSON object causing hash collisions (CVE-2026-40164)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:18029 advisory.

    nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency,     performance, and low memory usage.

    Security Fix(es):

    * nginx: NGINX: Arbitrary Code Execution Vulnerability (CVE-2026-42945)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:18054 advisory.

    Red Hat JBoss Enterprise Application Platform 8 is a platform for Java applications based on the WildFly     application runtime. This release of Red Hat JBoss Enterprise Application Platform 8.1.6 serves as a     replacement for Red Hat JBoss Enterprise Application Platform 8.1.5, and includes bug fixes and     enhancements. See the Red Hat JBoss Enterprise Application Platform 8.1.6 Release Notes for information     about the most significant bug fixes and enhancements included in this release.

    Security Fix(es):

    * bcprov-jdk18on: GOSTCTR implementation unable to process more than 255 blocks correctly (CVE-2025-14813)

    *bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly     (CVE-2025-14813)

    * bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion     (CVE-2026-3505)

    * bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid     (CVE-2026-5588)

    * bcprov-ext-jdk15on: LDAP injection vulnerability in LDAPStoreHelper.java (CVE-2026-0636)

    * bcprov-jdk12: private key leakage via non-constant time comparisons (CVE-2026-5598)

    * netty-codec-http: Netty: Denial of Service via HTTP/2 CONTINUATION frame flood (CVE-2026-33871)

    * netty-codec-http: Netty: Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding     extension values (CVE-2026-33870)

    * artemis-server: Apache Artemis, Apache ActiveMQ Artemis: Message injection and exfiltration due to     missing authentication (CVE-2026-27446)

    * org.hibernate.orm/hibernate-c3p0: c3p0: Arbitrary Code Execution via deserialization of crafted objects     [(CVE-2026-27830)

    * org.keycloak-keycloak-parent: Minimatch: Denial of Service via catastrophic backtracking in glob     expressions (CVE-2026-27904)

    * mchange-commons-java: mchange-commons-java: Arbitrary code execution via JNDI dereferencing of crafted     objects (CVE-2026-27727)

    * io.hawt-project: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

    * wildfly-elytron-integration: Wildfly Elytron Brute Force Attack via CLI  (CVE-2025-23368)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:18031 advisory.

    PackageKit is a D-Bus abstraction layer that allows the session user to manage packages in a secure way     using a cross-distribution, cross-architecture API.

    Security Fix(es):

    * PackageKit: race condition vulnerability leads to arbitrary package installation as root     (CVE-2026-41651)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:18042 advisory.

    jq is a lightweight and flexible command-line JSON processor. jq is like sed for JSON data. You can use it     to slice, filter, map, or transform structured data with the same ease that sed, awk, grep, or similar     applications allow you to manipulate text.

    Security Fix(es):

    * jq: out-of-bounds read in jv_parse_sized() on error formatting for non-NUL-terminated buffers     (CVE-2026-39979)

    * jq: jq: Denial of Service via crafted JSON object causing hash collisions (CVE-2026-40164)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:18039 advisory.

    Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text     files and to perform system management tasks.

    Security Fix(es):

    * erb: ERB: Arbitrary code execution via deserialization bypass (CVE-2026-41316)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:18055 advisory.

    Red Hat JBoss Enterprise Application Platform 8 is a platform for Java applications based on the WildFly     application runtime. This release of Red Hat JBoss Enterprise Application Platform 8.1.6 serves as a     replacement for Red Hat JBoss Enterprise Application Platform 8.1.5, and includes bug fixes and     enhancements. See the Red Hat JBoss Enterprise Application Platform 8.1.6 Release Notes for information     about the most significant bug fixes and enhancements included in this release.

    Security Fix(es):

    * bcprov-jdk18on: GOSTCTR implementation unable to process more than 255 blocks correctly (CVE-2025-14813)

    *bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly     (CVE-2025-14813)

    * bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion     (CVE-2026-3505)

    * bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid     (CVE-2026-5588)

    * bcprov-ext-jdk15on: LDAP injection vulnerability in LDAPStoreHelper.java (CVE-2026-0636)
    * bcprov-jdk12: private key leakage via non-constant time comparisons (CVE-2026-5598)

    * netty-codec-http: Netty: Denial of Service via HTTP/2 CONTINUATION frame flood (CVE-2026-33871)

    * netty-codec-http: Netty: Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding     extension values (CVE-2026-33870)

    * artemis-server: Apache Artemis, Apache ActiveMQ Artemis: Message injection and exfiltration due to     missing authentication (CVE-2026-27446)

    * org.hibernate.orm/hibernate-c3p0: c3p0: Arbitrary Code Execution via deserialization of crafted objects     (CVE-2026-27830)

    * org.keycloak-keycloak-parent: Minimatch: Denial of Service via catastrophic backtracking in glob     expressions (CVE-2026-27904)

    * mchange-commons-java: mchange-commons-java: Arbitrary code execution via JNDI dereferencing of crafted     objects (CVE-2026-27727)

    * io.hawt-project: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

    * wildfly-elytron-integration: Wildfly Elytron Brute Force Attack via CLI (CVE-2025-23368)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:18041 advisory.

    nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency,     performance, and low memory usage.

    Security Fix(es):

    * nginx: NGINX: Arbitrary Code Execution Vulnerability (CVE-2026-42945)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:18048 advisory.

    jq is a lightweight and flexible command-line JSON processor. jq is like sed for JSON data. You can use it     to slice, filter, map, or transform structured data with the same ease that sed, awk, grep, or similar     applications allow you to manipulate text.

    Security Fix(es):

    * jq: out-of-bounds read in jv_parse_sized() on error formatting for non-NUL-terminated buffers     (CVE-2026-39979)

    * jq: jq: Denial of Service via crafted JSON object causing hash collisions (CVE-2026-40164)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:18053 advisory.

    Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind.
    It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL     drivers and authentication plug-ins are provided as subpackages.

    Security Fix(es):

    * dovecot: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command     (CVE-2025-59032)

    * dovecot: denial of service via crafted message before authentication (CVE-2026-27858)

    * dovecot: denial of service via specially crafted NOOP command (CVE-2026-27857)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:18030 advisory.

    Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text     files and to perform system management tasks.

    Security Fix(es):

    * erb: ERB: Arbitrary code execution via deserialization bypass (CVE-2026-41316)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:18032 advisory.

    Grafana is an open source, feature rich metrics dashboard and graph editor for     Graphite, InfluxDB & OpenTSDB.

    Security Fix(es):

    * golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root     (CVE-2026-32282)

    * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key     update messages (CVE-2026-32283)

    * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in     certificate chain building (CVE-2026-32280)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE page(s)     listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:18064 advisory.

    The libpng packages contain a library of functions for creating and manipulating Portable Network Graphics     (PNG) image format files.

    Security Fix(es):

    * libpng: libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:18044 advisory.

    jq is a lightweight and flexible command-line JSON processor. jq is like sed for JSON data. You can use it     to slice, filter, map, or transform structured data with the same ease that sed, awk, grep, or similar     applications allow you to manipulate text.

    Security Fix(es):

    * jq: out-of-bounds read in jv_parse_sized() on error formatting for non-NUL-terminated buffers     (CVE-2026-39979)

    * jq: jq: Denial of Service via crafted JSON object causing hash collisions (CVE-2026-40164)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:18025 advisory.

    This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the     code of a running kernel.  This patch module is targeted for kernel-5.14.0-570.17.1.el9_6.

    Security Fix(es):

    * kernel: Dirty Frag is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux     kernel (CVE-2026-43284)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:18024 advisory.

    PackageKit is a D-Bus abstraction layer that allows the session user to manage packages in a secure way     using a cross-distribution, cross-architecture API.

    Security Fix(es):

    * PackageKit: race condition vulnerability leads to arbitrary package installation as root     (CVE-2026-41651)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:18046 advisory.

    jq is a lightweight and flexible command-line JSON processor. jq is like sed for JSON data. You can use it     to slice, filter, map, or transform structured data with the same ease that sed, awk, grep, or similar     applications allow you to manipulate text.

    Security Fix(es):

    * jq: out-of-bounds read in jv_parse_sized() on error formatting for non-NUL-terminated buffers     (CVE-2026-39979)

    * jq: jq: Denial of Service via crafted JSON object causing hash collisions (CVE-2026-40164)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:18045 advisory.

    jq is a lightweight and flexible command-line JSON processor. jq is like sed for JSON data. You can use it     to slice, filter, map, or transform structured data with the same ease that sed, awk, grep, or similar     applications allow you to manipulate text.

    Security Fix(es):

    * jq: out-of-bounds read in jv_parse_sized() on error formatting for non-NUL-terminated buffers     (CVE-2026-39979)

    * jq: jq: Denial of Service via crafted JSON object causing hash collisions (CVE-2026-40164)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:18028 advisory.

    The libpng packages contain a library of functions for creating and manipulating Portable Network Graphics     (PNG) image format files.

    Security Fix(es):

    * libpng: libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:17792 advisory.

    nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency,     performance, and low memory usage.

    Security Fix(es):

    * nginx: NGINX: Arbitrary Code Execution Vulnerability (CVE-2026-42945)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:17794 advisory.

    nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency,     performance, and low memory usage.

    Security Fix(es):

    * nginx: NGINX: Arbitrary Code Execution Vulnerability (CVE-2026-42945)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:17795 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: Dirty Frag is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux     kernel (CVE-2026-43284)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the NVIDIA for RHEL 10 Release Notes linked from     the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:17791 advisory.

    nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency,     performance, and low memory usage.

    Security Fix(es):

    * nginx: NGINX: Arbitrary Code Execution Vulnerability (CVE-2026-42945)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:17793 advisory.

    nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency,     performance, and low memory usage.

    Security Fix(es):

    * nginx: NGINX: Arbitrary Code Execution Vulnerability (CVE-2026-42945)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:17790 advisory.

    nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency,     performance, and low memory usage.

    Security Fix(es):

    * nginx: NGINX: Arbitrary Code Execution Vulnerability (CVE-2026-42945)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:17753 advisory.

    nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency,     performance, and low memory usage.

    Security Fix(es):

    * nginx: NGINX: Arbitrary Code Execution Vulnerability (CVE-2026-42945)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:17751 advisory.

    nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency,     performance, and low memory usage.

    Security Fix(es):

    * nginx: NGINX: Arbitrary Code Execution Vulnerability (CVE-2026-42945)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:17752 advisory.

    nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency,     performance, and low memory usage.

    Security Fix(es):

    * nginx: NGINX: Arbitrary Code Execution Vulnerability (CVE-2026-42945)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:17687 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    Security Fix(es):

    * firefox: thunderbird: Incorrect boundary conditions in the Libraries component in NSS (CVE-2026-6772)

    * firefox: thunderbird: Use-after-free in the JavaScript Engine component (CVE-2026-6754)

    * firefox: thunderbird: Spoofing issue in the DOM: Core & HTML component (CVE-2026-6762)

    * firefox: thunderbird: Incorrect boundary conditions in the WebRTC component (CVE-2026-6752)

    * firefox: thunderbird: Other issue in the Storage: IndexedDB component (CVE-2026-6770)

    * firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-6757)

    * firefox: thunderbird: Other issue in the Libraries component in NSS (CVE-2026-6767)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox     150 and Thunderbird 150 (CVE-2026-6786)

    * firefox: thunderbird: Incorrect boundary conditions in the WebRTC component (CVE-2026-6753)

    * firefox: thunderbird: Use-after-free in the Widget: Cocoa component (CVE-2026-6759)

    * firefox: thunderbird: Use-after-free in the WebRTC component (CVE-2026-6747)

    * firefox: thunderbird: Information disclosure due to uninitialized memory in the Graphics: Canvas2D     component (CVE-2026-6749)

    * firefox: thunderbird: Incorrect boundary conditions in the Libraries component in NSS (CVE-2026-6766)

    * firefox: thunderbird: Privilege escalation in the Networking component (CVE-2026-6761)

    * firefox: thunderbird: Mitigation bypass in the File Handling component (CVE-2026-6763)

    * firefox: thunderbird: Privilege escalation in the Graphics: WebRender component (CVE-2026-6750)

    * firefox: thunderbird: Uninitialized memory in the Audio/Video: Web Codecs component (CVE-2026-6748)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird     ESR 140.10, Firefox 150 and Thunderbird 150 (CVE-2026-6785)

    * firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-6771)

    * firefox: thunderbird: Incorrect boundary conditions in the DOM: Device Interfaces component     (CVE-2026-6764)

    * firefox: thunderbird: Information disclosure in the Form Autofill component (CVE-2026-6765)

    * firefox: thunderbird: Privilege escalation in the Debugger component (CVE-2026-6769)

    * firefox: thunderbird: Uninitialized memory in the Audio/Video: Web Codecs component (CVE-2026-6751)

    * firefox: thunderbird: Incorrect boundary conditions in the WebRTC: Networking component (CVE-2026-6776)

    * firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-6746)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:17618 advisory.

    ImageMagick is an image display and manipulation tool for the X Window System that can read and write     multiple image formats.

    Security Fix(es):

    * ImageMagick: ImageMagick: Denial of Service via out-of-bounds write in NewXMLTree method     (CVE-2026-32636)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:17685 advisory.

    The libpng packages contain a library of functions for creating and manipulating Portable Network Graphics     (PNG) image format files.

    Security Fix(es):

    * libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon     palette expansion (CVE-2026-33636)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:17686 advisory.

    A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild     under the hood. Besides building images for local usage, it can also upload images directly to cloud.  It     is compatible with composer-cli and cockpit-composer clients.

    Security Fix(es):

    * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:17625 advisory.

    Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind.
    It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL     drivers and authentication plug-ins are provided as subpackages.

    Security Fix(es):

    * dovecot: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command     (CVE-2025-59032)

    * dovecot: denial of service via crafted message before authentication (CVE-2026-27858)

    * dovecot: denial of service via specially crafted NOOP command (CVE-2026-27857)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:17688 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    Security Fix(es):

    * firefox: thunderbird: Incorrect boundary conditions in the Libraries component in NSS (CVE-2026-6772)

    * firefox: thunderbird: Use-after-free in the JavaScript Engine component (CVE-2026-6754)

    * firefox: thunderbird: Spoofing issue in the DOM: Core & HTML component (CVE-2026-6762)

    * firefox: thunderbird: Incorrect boundary conditions in the WebRTC component (CVE-2026-6752)

    * firefox: thunderbird: Other issue in the Storage: IndexedDB component (CVE-2026-6770)

    * firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-6757)

    * firefox: thunderbird: Other issue in the Libraries component in NSS (CVE-2026-6767)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox     150 and Thunderbird 150 (CVE-2026-6786)

    * firefox: thunderbird: Incorrect boundary conditions in the WebRTC component (CVE-2026-6753)

    * firefox: thunderbird: Use-after-free in the Widget: Cocoa component (CVE-2026-6759)

    * firefox: thunderbird: Use-after-free in the WebRTC component (CVE-2026-6747)

    * firefox: thunderbird: Information disclosure due to uninitialized memory in the Graphics: Canvas2D     component (CVE-2026-6749)

    * firefox: thunderbird: Incorrect boundary conditions in the Libraries component in NSS (CVE-2026-6766)

    * firefox: thunderbird: Privilege escalation in the Networking component (CVE-2026-6761)

    * firefox: thunderbird: Mitigation bypass in the File Handling component (CVE-2026-6763)

    * firefox: thunderbird: Privilege escalation in the Graphics: WebRender component (CVE-2026-6750)

    * firefox: thunderbird: Uninitialized memory in the Audio/Video: Web Codecs component (CVE-2026-6748)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird     ESR 140.10, Firefox 150 and Thunderbird 150 (CVE-2026-6785)

    * firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-6771)

    * firefox: thunderbird: Incorrect boundary conditions in the DOM: Device Interfaces component     (CVE-2026-6764)

    * firefox: thunderbird: Information disclosure in the Form Autofill component (CVE-2026-6765)

    * firefox: thunderbird: Privilege escalation in the Debugger component (CVE-2026-6769)

    * firefox: thunderbird: Uninitialized memory in the Audio/Video: Web Codecs component (CVE-2026-6751)

    * firefox: thunderbird: Incorrect boundary conditions in the WebRTC: Networking component (CVE-2026-6776)

    * firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-6746)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:17690 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    Security Fix(es):

    * firefox: thunderbird: Incorrect boundary conditions in the Libraries component in NSS (CVE-2026-6772)

    * firefox: thunderbird: Use-after-free in the JavaScript Engine component (CVE-2026-6754)

    * firefox: thunderbird: Spoofing issue in the DOM: Core & HTML component (CVE-2026-6762)

    * firefox: thunderbird: Incorrect boundary conditions in the WebRTC component (CVE-2026-6752)

    * firefox: thunderbird: Other issue in the Storage: IndexedDB component (CVE-2026-6770)

    * firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-6757)

    * firefox: thunderbird: Other issue in the Libraries component in NSS (CVE-2026-6767)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox     150 and Thunderbird 150 (CVE-2026-6786)

    * firefox: thunderbird: Incorrect boundary conditions in the WebRTC component (CVE-2026-6753)

    * firefox: thunderbird: Use-after-free in the Widget: Cocoa component (CVE-2026-6759)

    * firefox: thunderbird: Use-after-free in the WebRTC component (CVE-2026-6747)

    * firefox: thunderbird: Information disclosure due to uninitialized memory in the Graphics: Canvas2D     component (CVE-2026-6749)

    * firefox: thunderbird: Incorrect boundary conditions in the Libraries component in NSS (CVE-2026-6766)

    * firefox: thunderbird: Privilege escalation in the Networking component (CVE-2026-6761)

    * firefox: thunderbird: Mitigation bypass in the File Handling component (CVE-2026-6763)

    * firefox: thunderbird: Privilege escalation in the Graphics: WebRender component (CVE-2026-6750)

    * firefox: thunderbird: Uninitialized memory in the Audio/Video: Web Codecs component (CVE-2026-6748)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird     ESR 140.10, Firefox 150 and Thunderbird 150 (CVE-2026-6785)

    * firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-6771)

    * firefox: thunderbird: Incorrect boundary conditions in the DOM: Device Interfaces component     (CVE-2026-6764)

    * firefox: thunderbird: Information disclosure in the Form Autofill component (CVE-2026-6765)

    * firefox: thunderbird: Privilege escalation in the Debugger component (CVE-2026-6769)

    * firefox: thunderbird: Uninitialized memory in the Audio/Video: Web Codecs component (CVE-2026-6751)

    * firefox: thunderbird: Incorrect boundary conditions in the WebRTC: Networking component (CVE-2026-6776)

    * firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-6746)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:17628 advisory.

    Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind.
    It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL     drivers and authentication plug-ins are provided as subpackages.

    Security Fix(es):

    * dovecot: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command     (CVE-2025-59032)

    * dovecot: denial of service via crafted message before authentication (CVE-2026-27858)

    * dovecot: denial of service via specially crafted NOOP command (CVE-2026-27857)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:17656 advisory.

    OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image     processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are     specific to this format.  This package containes the binaries for OpenEXR.

    Security Fix(es):

    * OpenEXR: OpenEXR: Arbitrary code execution and information disclosure via crafted EXR file     (CVE-2026-34588)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:17642 advisory.

    The libpng packages contain a library of functions for creating and manipulating Portable Network Graphics     (PNG) image format files.

    Security Fix(es):

    * libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon     palette expansion (CVE-2026-33636)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:17560 advisory.

    PackageKit is a D-Bus abstraction layer that allows the session user to manage packages in a secure way     using a cross-distribution, cross-architecture API.

    Security Fix(es):

    * PackageKit: race condition vulnerability leads to arbitrary package installation as root     (CVE-2026-41651)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:17558 advisory.

    PackageKit is a D-Bus abstraction layer that allows the session user to manage packages in a secure way     using a cross-distribution, cross-architecture API.

    Security Fix(es):

    * PackageKit: race condition vulnerability leads to arbitrary package installation as root     (CVE-2026-41651)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:17567 advisory.

    The libpng packages contain a library of functions for creating and manipulating Portable Network Graphics     (PNG) image format files.

    Security Fix(es):

    * libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon     palette expansion (CVE-2026-33636)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:17659 advisory.

    OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image     processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are     specific to this format.  This package containes the binaries for OpenEXR.

    Security Fix(es):

    * OpenEXR: OpenEXR: Arbitrary code execution and information disclosure via crafted EXR file     (CVE-2026-34588)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:17626 advisory.

    Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind.
    It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL     drivers and authentication plug-ins are provided as subpackages.

    Security Fix(es):

    * dovecot: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command     (CVE-2025-59032)

    * dovecot: denial of service via crafted message before authentication (CVE-2026-27858)

    * dovecot: denial of service via specially crafted NOOP command (CVE-2026-27857)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:17602 advisory.

    Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind.
    It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL     drivers and authentication plug-ins are provided as subpackages.

    Security Fix(es):

    * dovecot: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command     (CVE-2025-59032)

    * dovecot: denial of service via crafted message before authentication (CVE-2026-27858)

    * dovecot: denial of service via specially crafted NOOP command (CVE-2026-27857)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Severity
315200	RHEL 10 : grafana-pcp (RHSA-2026:18027)	medium
315199	RHEL 10 : jq (RHSA-2026:18040)	medium
315198	RHEL 10 : ruby (RHSA-2026:18065)	high
315197	RHEL 9 : jq (RHSA-2026:18043)	medium
315196	RHEL 10 : nginx (RHSA-2026:18063)	critical
315195	RHEL 9 : PackageKit (RHSA-2026:18036)	high
315194	RHEL 8 : jq (RHSA-2026:18047)	medium
315193	RHEL 9 : nginx (RHSA-2026:18029)	critical
315192	RHEL 8 : Red Hat JBoss Enterprise Application Platform 8.1.6 (RHSA-2026:18054)	critical
315191	RHEL 9 : PackageKit (RHSA-2026:18031)	high
315190	RHEL 9 : jq (RHSA-2026:18042)	medium
315189	RHEL 9 : ruby (RHSA-2026:18039)	high
315188	RHEL 9 : Red Hat JBoss Enterprise Application Platform 8.1.6 (RHSA-2026:18055)	critical
315187	RHEL 8 : nginx:1.24 (RHSA-2026:18041)	critical
315186	RHEL 8 : jq (RHSA-2026:18048)	medium
315185	RHEL 8 : dovecot (RHSA-2026:18053)	high
315184	RHEL 9 : ruby:3.3 (RHSA-2026:18030)	high
315183	RHEL 10 : grafana (RHSA-2026:18032)	medium
315182	RHEL 10 : libpng (RHSA-2026:18064)	high
315145	RHEL 9 : jq (RHSA-2026:18044)	medium
315144	RHEL 9 : kpatch-patch-5_14_0-570_17_1, kpatch-patch-5_14_0-570_39_1, kpatch-patch-5_14_0-570_66_1, and kpatch-patch-5_14_0-570_94_1 (RHSA-2026:18025)	high
315143	RHEL 9 : PackageKit (RHSA-2026:18024)	high
315142	RHEL 8 : jq (RHSA-2026:18046)	medium
315141	RHEL 9 : jq (RHSA-2026:18045)	medium
315140	RHEL 9 : libpng (RHSA-2026:18028)	high
315005	RHEL 9 : nginx (RHSA-2026:17792)	critical
315004	RHEL 9 : nginx (RHSA-2026:17794)	critical
314967	RHEL 10 : kernel (RHSA-2026:17795)	high
314966	RHEL 9 : nginx (RHSA-2026:17791)	critical
314965	RHEL 9 : nginx:1.24 (RHSA-2026:17793)	critical
314964	RHEL 10 : nginx (RHSA-2026:17790)	critical
314928	RHEL 9 : nginx:1.26 (RHSA-2026:17753)	critical
314927	RHEL 9 : nginx (RHSA-2026:17751)	critical
314926	RHEL 9 : nginx:1.24 (RHSA-2026:17752)	critical
314758	RHEL 9 : firefox (RHSA-2026:17687)	critical
314757	RHEL 7 : ImageMagick (RHSA-2026:17618)	high
314756	RHEL 9 : libpng (RHSA-2026:17685)	high
314755	RHEL 10 : osbuild-composer (RHSA-2026:17686)	critical
314754	RHEL 9 : dovecot (RHSA-2026:17625)	high
314753	RHEL 9 : firefox (RHSA-2026:17688)	critical
314752	RHEL 10 : firefox (RHSA-2026:17690)	critical
314751	RHEL 9 : dovecot (RHSA-2026:17628)	high
314750	RHEL 10 : openexr (RHSA-2026:17656)	high
314749	RHEL 9 : libpng (RHSA-2026:17642)	high
314748	RHEL 8 : PackageKit (RHSA-2026:17560)	high
314699	RHEL 8 : PackageKit (RHSA-2026:17558)	high
314698	RHEL 10 : libpng (RHSA-2026:17567)	high
314697	RHEL 9 : openexr (RHSA-2026:17659)	high
314696	RHEL 9 : dovecot (RHSA-2026:17626)	high
314695	RHEL 10 : dovecot (RHSA-2026:17602)	high

Detections

Analytics

Red Hat Local Security Checks Family for Nessus

medium

medium

high

medium

critical

high

medium

critical

critical

high

medium

high

critical

critical

medium

high

high

medium

high

medium

high

high

medium

medium

high

critical

critical

high

critical

critical

critical

critical

critical

critical

critical

high

high

critical

high

critical

critical

high

high

high

high

high

high

high

high

high