The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:10135 advisory.

    The buildah package provides a tool for facilitating building OCI container images. Among other things,     buildah enables you to: Create a working container, either from scratch or using an image as a starting     point; Create an image, either from a working container or using the instructions in a Dockerfile; Build     both Docker and OCI images.

    Security Fix(es):

    * github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted     JSON Web Encryption (JWE) object (CVE-2026-34986)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 / 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:9689 advisory.

    The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software     Development Kit.

    Security Fix(es):

    * JDK: Enhance crypto algorithm support (CVE-2026-22007)

    * JDK: Improve Kerberos credentialing (CVE-2026-22013)

    * JDK: Enhance Path Factories Redux (CVE-2026-22016)

    * JDK: Enhance Zip file reading (CVE-2026-22018)

    * JDK: Enhance certificate chain validation (CVE-2026-22021)

    * JDK: Updating FreeType 2.14.1 (CVE-2026-23865)

    * JDK: Enhance TLS connection handling (CVE-2026-34282)

    * JDK: Enhance key generation (CVE-2026-34268)

    Bug Fix(es):

    * When copying files, OpenJDK 21 prefers to use the copy_file_range native function for performance     reasons, only falling back to sendfile when this fails.  However, in previous OpenJDK 21 releases, a     response of EOPNOTSUPP (operation not supported) did not cause the JDK to fall back to sendfile.  This is     rectified in this release. (RHEL-169617, RHEL-169951, RHEL-169952, RHEL-169942, RHEL-169953, RHEL-169945)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:9683 advisory.

    The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java     Software Development Kit.

    Security Fix(es):

    * JDK: Enhance crypto algorithm support (CVE-2026-22007)

    * JDK: Improve Kerberos credentialing (CVE-2026-22013)

    * JDK: Enhance Path Factories Redux (CVE-2026-22016)

    * JDK: Enhance Zip file reading (CVE-2026-22018)

    * JDK: Enhance certificate chain validation (CVE-2026-22021)

    * JDK: Updating FreeType 2.14.1 (CVE-2026-23865)

    * JDK: Enhance key generation (CVE-2026-34268)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:9686 advisory.

    The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java     Software Development Kit.

    Security Fix(es):

    * JDK: Enhance crypto algorithm support (CVE-2026-22007)

    * JDK: Improve Kerberos credentialing (CVE-2026-22013)

    * JDK: Enhance Path Factories Redux (CVE-2026-22016)

    * JDK: Enhance Zip file reading (CVE-2026-22018)

    * JDK: Enhance certificate chain validation (CVE-2026-22021)

    * JDK: Updating FreeType 2.14.1 (CVE-2026-23865)

    * JDK: Enhance TLS connection handling (CVE-2026-34282)

    * JDK: Enhance key generation (CVE-2026-34268)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:10226 advisory.

    Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &     OpenTSDB.

    Security Fix(es):

    * grafana: Grafana: Information disclosure of data-source passwords via public dashboards (CVE-2026-27877)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:10133 advisory.

    HTTP reverse proxy, backed by IPP-over-USB connection to device. It enables      driverless support for USB devices capable of using IPP-over-USB protocol.

    Security Fix(es):

    * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:10111 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:10257 advisory.

    Squid is a high-performance proxy caching server for web clients, supporting FTP, and HTTP data objects.

    Security Fix(es):

    * squid: Squid: Denial of Service via heap Use-After-Free vulnerability in ICP handling (CVE-2026-33526)

    * Squid: Squid: Denial of Service via crafted ICP traffic (CVE-2026-32748)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:10108 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: Bluetooth: MGMT: Fix possible UAFs (CVE-2025-39981)

    * kernel: mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (CVE-2025-68800)

    * kernel: Linux kernel: Denial of Service due to a deadlock in hugetlb folio migration (CVE-2026-23097)

    * kernel: Linux kernel: Denial of Service via unsafe requeue in rxrpc_recvmsg (CVE-2026-23066)

    * kernel: Kernel: Privilege escalation or denial of service in nf_tables via inverted element activity     check (CVE-2026-23111)

    * kernel: Linux kernel: Local denial of service and memory leak in DAMON sysfs via setup failure     (CVE-2026-23144)

    * kernel: Linux kernel: Use-after-free in bonding module can cause system crash or arbitrary code     execution (CVE-2026-23171)

    * kernel: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CVE-2026-23193)

    * kernel: net/sched: cls_u32: use skb_header_pointer_careful() (CVE-2026-23204)

    * kernel: kernel: Privilege escalation or denial of service via use-after-free in nf_tables_addchain()     (CVE-2026-23231)

    * kernel: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (CVE-2026-31402)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:10107 advisory.

    rhc is a client tool and daemon that connects the system to Red Hat hosted services enabling system and     subscription management.

    Security Fix(es):

    * google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to     improper HTTP/2 path validation (CVE-2026-33186)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:10256 advisory.

    Squid is a high-performance proxy caching server for web clients, supporting FTP, and HTTP data objects.

    Security Fix(es):

    * squid: Squid: Denial of Service via heap Use-After-Free vulnerability in ICP handling (CVE-2026-33526)

    * Squid: Squid: Denial of Service via crafted ICP traffic (CVE-2026-32748)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:10102 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:10101 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:10223 advisory.

    Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &     OpenTSDB.

    Security Fix(es):

    * grafana: Grafana: Information disclosure of data-source passwords via public dashboards (CVE-2026-27877)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:10083 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 9.0.115 and .NET Runtime 9.0.14.Security Fix(es):

    * .net: .NET: Denial of Service via out-of-bounds read (CVE-2026-26127)

    * asp.net: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-26130)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:10082 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 8.0.125 and .NET Runtime 8.0.25.Security Fix(es):

    * asp.net: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-26130)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:10084 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 8.0.125 and .NET Runtime 8.0.25.Security Fix(es):

    * asp.net: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-26130)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:10169 advisory.

    A worker for yggdrasil that receives Ansible playbooks and executes them against the local host.

    Security Fix(es):

    * crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)

    * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:10076 advisory.

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

    Security Fix(es):

    * freerdp: FreeRDP heap-use-after-free (CVE-2026-22856)

    * freerdp: FreeRDP heap-buffer-overflow (CVE-2026-22854)

    * freerdp: FreeRDP heap-buffer-overflow (CVE-2026-22852)

    * freerdp: FreeRDP: Denial of Service via FastGlyph parsing buffer overflow (CVE-2026-23732)

    * freerdp: FreeRDP: Denial of Service via use-after-free in AUDIN format renegotiation (CVE-2026-24676)

    * freerdp: FreeRDP has a heap-use-after-free in video_timer (CVE-2026-24491)

    * freerdp: FreeRDP has a NULL Pointer Dereference in rdp_write_logon_info_v2() (CVE-2026-23948)

    * freerdp: FreeRDP has a Heap-use-after-free in play_thread (CVE-2026-24684)

    * freerdp: FreeRDP has a heap-buffer-overflow in urb_select_interface (CVE-2026-24679)

    * freerdp: FreeRDP has a Heap-use-after-free in urb_select_interface (CVE-2026-24675)

    * freerdp: FreeRDP: Arbitrary code execution via crafted Remote Desktop Protocol (RDP) server messages     (CVE-2026-31806)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:10085 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 9.0.115 and .NET Runtime 9.0.14.Security Fix(es):

    * .net: .NET: Denial of Service via out-of-bounds read (CVE-2026-26127)

    * asp.net: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-26130)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:10091 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 8.0.125 and .NET Runtime 8.0.25.Security Fix(es):

    * asp.net: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-26130)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:9682 advisory.

    The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java     Software Development Kit.

    Security Fix(es):

    * JDK: Enhance crypto algorithm support (CVE-2026-22007)

    * JDK: Improve Kerberos credentialing (CVE-2026-22013)

    * JDK: Enhance Path Factories Redux (CVE-2026-22016)

    * JDK: Enhance Zip file reading (CVE-2026-22018)

    * JDK: Enhance certificate chain validation (CVE-2026-22021)

    * JDK: Updating FreeType 2.14.1 (CVE-2026-23865)

    * JDK: Enhance key generation (CVE-2026-34268)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:9870 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: Linux kernel: RDMA/rxe use-after-free vulnerability leading to potential arbitrary code     execution (CVE-2025-38024)

    * kernel: iavf: Fix reset error handling (CVE-2022-50053)

    * kernel: Linux kernel: Use-After-Free vulnerability in ATM subsystem (CVE-2025-38180)

    * kernel: RDMA/rxe: Fix incomplete state save in rxe_requester (CVE-2023-53539)

    * kernel: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CVE-2026-23193)

    * kernel: net/sched: cls_u32: use skb_header_pointer_careful() (CVE-2026-23204)

    * kernel: scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CVE-2026-23216)

    * kernel: kernel: Privilege escalation or denial of service via use-after-free in nf_tables_addchain()     (CVE-2026-23231)

    * kernel: Linux kernel (qla2xxx): Double free vulnerability leads to denial of service and potential     privilege escalation. (CVE-2025-71238)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:9732 advisory.

    OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating     systems. It includes the core files necessary for both the OpenSSH client and server.

    Security Fix(es):

    * openssh: OpenSSH GSSAPI: Information disclosure or denial of service due to uninitialized variables     (CVE-2026-3497)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:9693 advisory.

    The OpenJDK 25 packages provide the OpenJDK 25 Java Runtime Environment and the OpenJDK 25 Java Software     Development Kit.

    Security Fix(es):

    * JDK: Enhance crypto algorithm support (CVE-2026-22007)

    * JDK: Improved Arena allocations (CVE-2026-22008)

    * JDK: Improve Kerberos credentialing (CVE-2026-22013)

    * JDK: Enhance Path Factories Redux (CVE-2026-22016)

    * JDK: Enhance Zip file reading (CVE-2026-22018)

    * JDK: Enhance certificate chain validation (CVE-2026-22021)

    * JDK: Updating FreeType 2.14.1 (CVE-2026-23865)

    * JDK: Enhance TLS connection handling (CVE-2026-34282)

    * JDK: Enhance key generation (CVE-2026-34268)

    This release also updates a number of third-party libraries included in the JDK.  The libraries themselves     are affected by the following CVEs, but this is not a statement that the JDK itself is affected:

    * giflib: Denial of Service via buffer overflow in EGifGCBToExtension (CVE-2026-26740)

    * libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette     expansion (CVE-2026-33636)

    * libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416)

    Bug Fix(es):

    * When copying files, OpenJDK 25 prefers to use the copy_file_range native function for performance     reasons, only falling back to sendfile when this fails.  However, in previous OpenJDK 25 releases, a     response of EOPNOTSUPP (operation not supported) did not cause the JDK to fall back to sendfile.  This is     rectified in this release. (RHEL-169939, RHEL-169937)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:9874 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

    * minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions     (CVE-2026-27904)

    * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination     (CVE-2026-27135)

    * Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:9643 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: smc: Fix use-after-free in __pnet_find_base_ndev() (CVE-2025-40064)

    * kernel: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match() (CVE-2025-40168)

    * kernel: net/sched: cls_u32: use skb_header_pointer_careful() (CVE-2026-23204)

    * kernel: kernel: Privilege escalation or denial of service via use-after-free in nf_tables_addchain()     (CVE-2026-23231)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:9836 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: macvlan: fix possible UAF in macvlan_forward_source() (CVE-2026-23001)

    * kernel: net/sched: cls_u32: use skb_header_pointer_careful() (CVE-2026-23204)

    * kernel: kernel: Privilege escalation or denial of service via use-after-free in nf_tables_addchain()     (CVE-2026-23231)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:9745 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:9254 advisory.

    The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java     Software Development Kit.

    This release contains OpenJDK 11 with Extended Lifecycle Support for Red Hat Enterprise Linux versions 7,     8, and 9.

    Security Fix(es):

    * JDK: LIBPNG: out-of-bounds read in png_image_read_composite (CVE-2025-66293)
    * JDK: LIBPNG: Information disclosure and denial of service via integer truncation in simplified write API     (CVE-2026-22801)
    * JDK: LIBPNG: has a heap buffer overflow in png_set_quantize (CVE-2026-25646)
    * JDK: GIFLIB: Denial of Service via buffer overflow in EGifGCBToExtension (CVE-2026-26740)
    * JDK: LIBPNG: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416)
    * JDK: LIBPNG: Information disclosure and denial of service via out-of-bounds read/write in Neon palette     expansion (CVE-2026-33636)
    * JDK: Denial of service and information disclosure via heap buffer over-read in png_image_finish_read     (CVE-2026-22695)

    * JDK: (CVE-2026-22007)
    * JDK: (CVE-2026-22016)
    * JDK: (CVE-2026-22013)
    * JDK: (CVE-2026-22018)
    * JDK: (CVE-2026-22021)
    * JDK: (CVE-2026-34268)
    * JDK: (CVE-2026-34282)
    * JDK: (CVE-2026-23865)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:9640 advisory.

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

    Security Fix(es):

    * freerdp: FreeRDP heap-use-after-free (CVE-2026-22856)

    * freerdp: FreeRDP heap-buffer-overflow (CVE-2026-22854)

    * freerdp: FreeRDP heap-buffer-overflow (CVE-2026-22852)

    * freerdp: FreeRDP: Denial of Service via FastGlyph parsing buffer overflow (CVE-2026-23732)

    * freerdp: FreeRDP: Denial of Service via use-after-free in AUDIN format renegotiation (CVE-2026-24676)

    * freerdp: FreeRDP has a heap-use-after-free in video_timer (CVE-2026-24491)

    * freerdp: FreeRDP has a NULL Pointer Dereference in rdp_write_logon_info_v2() (CVE-2026-23948)

    * freerdp: FreeRDP has a Heap-use-after-free in play_thread (CVE-2026-24684)

    * freerdp: FreeRDP has a heap-use-after-free in urb_bulk_transfer_cb (CVE-2026-24681)

    * freerdp: FreeRDP has a heap-buffer-overflow in urb_select_interface (CVE-2026-24679)

    * freerdp: FreeRDP has a Heap-use-after-free in urb_select_interface (CVE-2026-24675)

    * freerdp: FreeRDP: Arbitrary code execution via crafted Remote Desktop Protocol (RDP) server messages     (CVE-2026-31806)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:9641 advisory.

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

    Security Fix(es):

    * freerdp: FreeRDP heap-use-after-free (CVE-2026-22856)

    * freerdp: FreeRDP heap-buffer-overflow (CVE-2026-22854)

    * freerdp: FreeRDP heap-buffer-overflow (CVE-2026-22852)

    * freerdp: FreeRDP: Denial of Service via FastGlyph parsing buffer overflow (CVE-2026-23732)

    * freerdp: FreeRDP: Denial of Service via use-after-free in AUDIN format renegotiation (CVE-2026-24676)

    * freerdp: FreeRDP has a heap-use-after-free in video_timer (CVE-2026-24491)

    * freerdp: FreeRDP has a NULL Pointer Dereference in rdp_write_logon_info_v2() (CVE-2026-23948)

    * freerdp: FreeRDP has a Heap-use-after-free in play_thread (CVE-2026-24684)

    * freerdp: FreeRDP has a heap-use-after-free in urb_bulk_transfer_cb (CVE-2026-24681)

    * freerdp: FreeRDP has a heap-buffer-overflow in urb_select_interface (CVE-2026-24679)

    * freerdp: FreeRDP has a Heap-use-after-free in urb_select_interface (CVE-2026-24675)

    * freerdp: FreeRDP: Arbitrary code execution via crafted Remote Desktop Protocol (RDP) server messages     (CVE-2026-31806)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:9638 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    Security Fix(es):

    * libpng: libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416)

    * libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon     palette expansion (CVE-2026-33636)

    * thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox     149.0.2 and Thunderbird 149.0.2 (CVE-2026-5734)

    * thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird     ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVE-2026-5731)

    * firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics: Text component     (CVE-2026-5732)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:9692 advisory.

    WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

    Security Fix(es):

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2025-43213)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2025-43214)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2025-43457)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43511)

    * webkitgtk: Processing maliciously crafted web content may disclose internal states of the app     (CVE-2025-46299)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2026-20608)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2026-20635)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2026-20636)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2026-20644)

    * webkitgtk: A remote attacker may be able to cause a denial-of-service (CVE-2026-20652)

    * webkitgtk: A website may be able to track users through Safari web extensions (CVE-2026-20676)

    * webkitgtk: Processing maliciously crafted web content may bypass Same Origin Policy (CVE-2026-20643)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2026-20664)

    * webkitgtk: Processing maliciously crafted web content may prevent Content Security Policy from being     enforced (CVE-2026-20665)

    * webkitgtk: A maliciously crafted webpage may be able to fingerprint the user (CVE-2026-20691)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2026-28857)

    * webkitgtk: A malicious website may be able to process restricted web content outside the sandbox     (CVE-2026-28859)

    * webkitgtk: Visiting a maliciously crafted website may lead to a cross-site scripting attack     (CVE-2026-28871)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:9666 advisory.

    The wireshark packages contain a network protocol analyzer used to capture and browse the traffic running     on a computer network.

    Security Fix(es):

    * wireshark: Buffer Over-read in Wireshark (CVE-2026-3203)

    * wireshark: Improperly Controlled Sequential Memory Allocation in Wireshark (CVE-2026-3201)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:9835 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: macvlan: fix possible UAF in macvlan_forward_source() (CVE-2026-23001)

    * kernel: net/sched: cls_u32: use skb_header_pointer_careful() (CVE-2026-23204)

    * kernel: kernel: Privilege escalation or denial of service via use-after-free in nf_tables_addchain()     (CVE-2026-23231)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:9711 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

    * minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions     (CVE-2026-27904)

    * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination     (CVE-2026-27135)

    * Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:9644 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: Linux kernel:A use-after-free in bridge multicast in br_multicast_port_ctx_init (CVE-2025-38248)

    * kernel: Bluetooth: MGMT: Fix possible UAFs (CVE-2025-39981)

    * kernel: mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (CVE-2025-68800)

    * kernel: Linux kernel: Denial of Service via unsafe requeue in rxrpc_recvmsg (CVE-2026-23066)

    * kernel: Linux kernel: Local denial of service and memory leak in DAMON sysfs via setup failure     (CVE-2026-23144)

    * kernel: Linux kernel: Use-after-free in bonding module can cause system crash or arbitrary code     execution (CVE-2026-23171)

    * kernel: macvlan: fix error recovery in macvlan_common_newlink() (CVE-2026-23209)

    * kernel: net/sched: cls_u32: use skb_header_pointer_careful() (CVE-2026-23204)

    * kernel: kernel: Privilege escalation or denial of service via use-after-free in nf_tables_addchain()     (CVE-2026-23231)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:9705 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:9695 advisory.

    rhc is a client tool and daemon that connects the system to Red Hat hosted services enabling system and     subscription management.

    Security Fix(es):

    * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:9621 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:9656 advisory.

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

    Security Fix(es):

    * FreeRDP: FreeRDP: Heap buffer overflow allows arbitrary code execution via crafted pixel data     (CVE-2026-33984)

    * FreeRDP: FreeRDP: Denial of Service via specially crafted Remote Desktop Protocol messages     (CVE-2026-33983)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:9614 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:9605 advisory.

    This module provides ways to parse XML documents. It is built on top of XML::Parser::Expat, which is a     lower level interface to James Clark's expat library. Each call to one of the parsing methods creates a     new instance of XML::Parser::Expat which is then used to parse the document. Expat options may be provided     when the XML::Parser object is created. These options are then passed on to the Expat object on each parse     call. They can also be given as extra arguments to the parse methods, in which case they override options     given at XML::Parser creation time.

    Security Fix(es):

    * perl-xml-parser: XML::Parser: Memory corruption via deeply nested XML files (CVE-2006-10003)

    * perl-xml-parser: XML::Parser for Perl: Heap corruption and denial of service from crafted XML input     (CVE-2006-10002)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:9513 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: smc: Fix use-after-free in __pnet_find_base_ndev() (CVE-2025-40064)

    * kernel: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match() (CVE-2025-40168)

    * kernel: net/sched: cls_u32: use skb_header_pointer_careful() (CVE-2026-23204)

    * kernel: kernel: Privilege escalation or denial of service via use-after-free in nf_tables_addchain()     (CVE-2026-23231)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:9515 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: net/sched: cls_u32: use skb_header_pointer_careful() (CVE-2026-23204)

    * kernel: kernel: Privilege escalation or denial of service via use-after-free in nf_tables_addchain()     (CVE-2026-23231)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:9591 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:9514 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: smc: Fix use-after-free in __pnet_find_base_ndev() (CVE-2025-40064)

    * kernel: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match() (CVE-2025-40168)

    * kernel: net/sched: cls_u32: use skb_header_pointer_careful() (CVE-2026-23204)

    * kernel: kernel: Privilege escalation or denial of service via use-after-free in nf_tables_addchain()     (CVE-2026-23231)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:9592 advisory.

    The libarchive programming library can create and read several different streaming archive formats,     including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility,     scripting language bindings such as python-libarchive, and several popular desktop file managers.

    Security Fix(es):

    * libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing     (CVE-2026-4424)

    * libarchive: libarchive: Arbitrary code execution via integer overflow in ISO9660 image processing     (CVE-2026-5121)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:9512 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: Linux kernel:A use-after-free in bridge multicast in br_multicast_port_ctx_init (CVE-2025-38248)

    * kernel: Bluetooth: MGMT: Fix possible UAFs (CVE-2025-39981)

    * kernel: mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (CVE-2025-68800)

    * kernel: Linux kernel: Denial of Service via unsafe requeue in rxrpc_recvmsg (CVE-2026-23066)

    * kernel: Linux kernel: Local denial of service and memory leak in DAMON sysfs via setup failure     (CVE-2026-23144)

    * kernel: Linux kernel: Use-after-free in bonding module can cause system crash or arbitrary code     execution (CVE-2026-23171)

    * kernel: macvlan: fix error recovery in macvlan_common_newlink() (CVE-2026-23209)

    * kernel: net/sched: cls_u32: use skb_header_pointer_careful() (CVE-2026-23204)

    * kernel: kernel: Privilege escalation or denial of service via use-after-free in nf_tables_addchain()     (CVE-2026-23231)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Severity
310142	RHEL 9 : buildah (RHSA-2026:10135)	high
310121	RHEL 10 / 8 / 9 : java-21-openjdk (RHSA-2026:9689)	high
310120	RHEL 8 / 9 : java-1.8.0-openjdk (RHSA-2026:9683)	high
310104	RHEL 8 / 9 : java-17-openjdk (RHSA-2026:9686)	high
310103	RHEL 9 : grafana (RHSA-2026:10226)	high
310038	RHEL 10 : golang-github-openprinting-ipp-usb (RHSA-2026:10133)	high
310037	RHEL 9 : python3.12 (RHSA-2026:10111)	high
310036	RHEL 9 : squid (RHSA-2026:10257)	critical
310035	RHEL 9 : kernel (RHSA-2026:10108)	high
310034	RHEL 8 : rhc (RHSA-2026:10107)	critical
310033	RHEL 9 : squid (RHSA-2026:10256)	critical
310032	RHEL 6 : python (RHSA-2026:10102)	high
310031	RHEL 9 : python3.9 (RHSA-2026:10101)	high
310030	RHEL 10 : grafana (RHSA-2026:10223)	high
309978	RHEL 10 : .NET 9.0 (RHSA-2026:10083)	high
309977	RHEL 9 : .NET 8.0 (RHSA-2026:10082)	high
309976	RHEL 9 : .NET 8.0 (RHSA-2026:10084)	high
309975	RHEL 10 : rhc-worker-playbook (RHSA-2026:10169)	high
309909	RHEL 8 : freerdp (RHSA-2026:10076)	critical
309908	RHEL 9 : .NET 9.0 (RHSA-2026:10085)	high
309907	RHEL 10 : .NET 8.0 (RHSA-2026:10091)	high
309748	RHEL 7 : java-1.8.0-openjdk (RHSA-2026:9682)	high
309747	RHEL 7 : kernel (RHSA-2026:9870)	high
309746	RHEL 9 : openssh (RHSA-2026:9732)	medium
309745	RHEL 10 / 9 : java-25-openjdk (RHSA-2026:9693)	high
309744	RHEL 9 : nodejs:20 (RHSA-2026:9874)	high
309662	RHEL 8 : kernel (RHSA-2026:9643)	high
309661	RHEL 9 : kernel (RHSA-2026:9836)	high
309660	RHEL 7 : python3 (RHSA-2026:9745)	high
309659	RHEL 7 / 8 / 9 : Java 11 OpenJDK ELS Security Update (Important) (RHSA-2026:9254)	high
309658	RHEL 9 : freerdp (RHSA-2026:9640)	critical
309657	RHEL 9 : freerdp (RHSA-2026:9641)	critical
309656	RHEL 10 : thunderbird (RHSA-2026:9638)	critical
309655	RHEL 9 : webkit2gtk3 (RHSA-2026:9692)	medium
309654	RHEL 10 : wireshark (RHSA-2026:9666)	high
309653	RHEL 9 : kernel-rt (RHSA-2026:9835)	high
309652	RHEL 9 : nodejs:20 (RHSA-2026:9711)	high
309651	RHEL 9 : kernel (RHSA-2026:9644)	high
309650	RHEL 9 : python3.11 (RHSA-2026:9705)	high
309191	RHEL 8 : rhc (RHSA-2026:9695)	high
309190	RHEL 8 : python3 (RHSA-2026:9621)	high
309189	RHEL 9 : freerdp (RHSA-2026:9656)	high
309188	RHEL 7 : python (RHSA-2026:9614)	high
309187	RHEL 9 : perl-XML-Parser (RHSA-2026:9605)	critical
309110	RHEL 8 : kernel (RHSA-2026:9513)	high
309109	RHEL 8 : kernel (RHSA-2026:9515)	high
309108	RHEL 8 : python3.11 (RHSA-2026:9591)	high
309107	RHEL 8 : kernel (RHSA-2026:9514)	high
309106	RHEL 8 : libarchive (RHSA-2026:9592)	critical
309105	RHEL 9 : kernel-rt (RHSA-2026:9512)	high

Detections

Analytics

Red Hat Local Security Checks Family for Nessus

high

high

high

high

high

high

high

critical

high

critical

critical

high

high

high

high

high

high

high

critical

high

high

high

high

medium

high

high

high

high

high

high

critical

critical

critical

medium

high

high

high

high

high

high

high

high

high

critical

high

high

high

high

critical

high