The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:17630 advisory.

    Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind.
    It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL     drivers and authentication plug-ins are provided as subpackages.

    Security Fix(es):

    * dovecot: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command     (CVE-2025-59032)

    * dovecot: denial of service via crafted message before authentication (CVE-2026-27858)

    * dovecot: denial of service via specially crafted NOOP command (CVE-2026-27857)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:17658 advisory.

    Please update

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:17619 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression     modules (CVE-2026-6100)

    * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API     (CVE-2026-4786)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:17603 advisory.

    The libpng packages contain a library of functions for creating and manipulating Portable Network Graphics     (PNG) image format files.

    Security Fix(es):

    * libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon     palette expansion (CVE-2026-33636)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:17525 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression     modules (CVE-2026-6100)

    * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API     (CVE-2026-4786)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:17477 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    Security Fix(es):

    * firefox: thunderbird: Incorrect boundary conditions in the Libraries component in NSS (CVE-2026-6772)

    * firefox: thunderbird: Use-after-free in the JavaScript Engine component (CVE-2026-6754)

    * firefox: thunderbird: Spoofing issue in the DOM: Core & HTML component (CVE-2026-6762)

    * firefox: thunderbird: Incorrect boundary conditions in the WebRTC component (CVE-2026-6752)

    * firefox: thunderbird: Other issue in the Storage: IndexedDB component (CVE-2026-6770)

    * firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-6757)

    * firefox: thunderbird: Other issue in the Libraries component in NSS (CVE-2026-6767)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox     150 and Thunderbird 150 (CVE-2026-6786)

    * firefox: thunderbird: Incorrect boundary conditions in the WebRTC component (CVE-2026-6753)

    * firefox: thunderbird: Use-after-free in the Widget: Cocoa component (CVE-2026-6759)

    * firefox: thunderbird: Use-after-free in the WebRTC component (CVE-2026-6747)

    * firefox: thunderbird: Information disclosure due to uninitialized memory in the Graphics: Canvas2D     component (CVE-2026-6749)

    * firefox: thunderbird: Incorrect boundary conditions in the Libraries component in NSS (CVE-2026-6766)

    * firefox: thunderbird: Privilege escalation in the Networking component (CVE-2026-6761)

    * firefox: thunderbird: Mitigation bypass in the File Handling component (CVE-2026-6763)

    * firefox: thunderbird: Privilege escalation in the Graphics: WebRender component (CVE-2026-6750)

    * firefox: thunderbird: Uninitialized memory in the Audio/Video: Web Codecs component (CVE-2026-6748)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird     ESR 140.10, Firefox 150 and Thunderbird 150 (CVE-2026-6785)

    * firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-6771)

    * firefox: thunderbird: Incorrect boundary conditions in the DOM: Device Interfaces component     (CVE-2026-6764)

    * firefox: thunderbird: Information disclosure in the Form Autofill component (CVE-2026-6765)

    * firefox: thunderbird: Privilege escalation in the Debugger component (CVE-2026-6769)

    * firefox: thunderbird: Uninitialized memory in the Audio/Video: Web Codecs component (CVE-2026-6751)

    * firefox: thunderbird: Incorrect boundary conditions in the WebRTC: Networking component (CVE-2026-6776)

    * firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-6746)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:17524 advisory.

    The libpng packages contain a library of functions for creating and manipulating Portable Network Graphics     (PNG) image format files.

    Security Fix(es):

    * libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon     palette expansion (CVE-2026-33636)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:17482 advisory.

    Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access     Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate     packages.  libsoup uses the Glib main loop and is designed to work well with GTK applications. This     enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion,     very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who     want it), but the SOAP parts were removed long ago.

    Security Fix(es):

    * libsoup: libsoup: Denial of Service via Use-After-Free in HTTP/2 server (CVE-2026-4271)

    * libsoup: libsoup: Information disclosure via cleartext transmission of cookies during HTTPS tunnel     establishment (CVE-2026-5119)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:17481 advisory.

    The rsync utility enables the users to copy and synchronize files locally or across a network.
    Synchronization with rsync is fast because rsync only sends the differences in files over the network     instead of sending whole files. The rsync utility is also used as a mirroring tool.

    Security Fix(es):

    * rsync: Rsync: Use-after-free vulnerability in extended attribute handling (CVE-2026-41035)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:17287 advisory.

    The podman tool manages pods, container images, and containers. It is part of the libpod library, which is     for applications that use container pods. Container pods is a concept in Kubernetes.

    Security Fix(es):

    * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

    * github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted     JSON Web Encryption (JWE) object (CVE-2026-34986)

    * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages     (CVE-2026-32283)

    * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building     (CVE-2026-32280)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:17084 advisory.

    A replacement for libslirp and VPNKit, written in pure Go. It is based on the network stack of gVisor.
    Compared to libslirp, gvisor-tap-vsock brings a configurable DNS server and dynamic port forwarding.

    Security Fix(es):

    * crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate     (CVE-2025-61729)

    * golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

    * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

    * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

    * golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)

    * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages     (CVE-2026-32283)

    * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building     (CVE-2026-32280)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:16865 advisory.

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

    Security Fix(es):

    * freerdp: FreeRDP: Denial of service due to use-after-free vulnerability (CVE-2026-25952)

    * freerdp: FreeRDP: Denial of Service via double free vulnerability during disconnect (CVE-2026-26986)

    * freerdp: FreeRDP: Denial of Service via endless blocking loop in Stream_EnsureCapacity (CVE-2026-27951)

    * freerdp: FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId (CVE-2026-29775)

    * freerdp: FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds     checks (CVE-2026-31885)

    * freerdp: FreeRDP has a division-by-zero in ADPCM decoders when `nBlockAlign` is 0 (CVE-2026-31884)

    * freerdp: FreeRDP: Denial of Service via crafted audio data in RDP (CVE-2026-31883)

    * FreeRDP: FreeRDP: Information disclosure via heap memory out of bounds read (CVE-2026-33985)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:17083 advisory.

    The fence-agents packages provide a collection of scripts for handling remote power management for cluster     devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.

    Security Fix(es):

    * pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 ?4.1.11 MUST violation) (CVE-2026-32597)

    * pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion (CVE-2026-30922)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:16875 advisory.

    Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics     with text pointers inside Git, while storing the file contents on a remote server.

    Security Fix(es):

    * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

    * golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)

    * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages     (CVE-2026-32283)

    * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building     (CVE-2026-32280)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:17040 advisory.

    The podman tool manages pods, container images, and containers. It is part of the libpod library, which is     for applications that use container pods. Container pods is a concept in Kubernetes.

    Security Fix(es):

    * crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate     (CVE-2025-61729)

    * golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip     (CVE-2025-61728)

    * golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

    * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

    * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

    * github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted     JSON Web Encryption (JWE) object (CVE-2026-34986)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:16866 advisory.

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

    Security Fix(es):

    * freerdp: FreeRDP: Denial of service due to use-after-free vulnerability (CVE-2026-25952)

    * freerdp: FreeRDP: Denial of Service via double free vulnerability during disconnect (CVE-2026-26986)

    * freerdp: FreeRDP: Denial of Service via endless blocking loop in Stream_EnsureCapacity (CVE-2026-27951)

    * freerdp: FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId (CVE-2026-29775)

    * freerdp: FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds     checks (CVE-2026-31885)

    * freerdp: FreeRDP has a division-by-zero in ADPCM decoders when `nBlockAlign` is 0 (CVE-2026-31884)

    * freerdp: FreeRDP: Denial of Service via crafted audio data in RDP (CVE-2026-31883)

    * FreeRDP: FreeRDP: Information disclosure via heap memory out of bounds read (CVE-2026-33985)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:17075 advisory.

    yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on     the topics to an appropriate child worker process, exchanging data with its worker processes through a     D-Bus message broker.

    Security Fix(es):

    * golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)

    * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages     (CVE-2026-32283)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:16799 advisory.

    Kerberos is a network authentication system, which can improve the security of your network by eliminating     the insecure practice of sending passwords over the network in unencrypted form. It allows clients and     servers to authenticate to each other with the help of a trusted third party, the Kerberos key     distribution center (KDC).

    Security Fix(es):

    * krb5: MIT Kerberos 5 (krb5): Denial of Service via integer underflow and out-of-bounds read     (CVE-2026-40356)

    * krb5: MIT Kerberos 5: Denial of Service via NULL pointer dereference in NegoEx mechanism     (CVE-2026-40355)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:16695 advisory.

    WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

    Security Fix(es):

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2025-43213)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2025-43214)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2025-43457)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43511)

    * webkitgtk: Processing maliciously crafted web content may disclose internal states of the app     (CVE-2025-46299)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2026-20608)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2026-20635)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2026-20636)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2026-20644)

    * webkitgtk: A remote attacker may be able to cause a denial-of-service (CVE-2026-20652)

    * webkitgtk: A website may be able to track users through Safari web extensions (CVE-2026-20676)

    * webkitgtk: Processing maliciously crafted web content may bypass Same Origin Policy (CVE-2026-20643)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2026-20664)

    * webkitgtk: Processing maliciously crafted web content may prevent Content Security Policy from being     enforced (CVE-2026-20665)

    * webkitgtk: A maliciously crafted webpage may be able to fingerprint the user (CVE-2026-20691)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2026-28857)

    * webkitgtk: A malicious website may be able to process restricted web content outside the sandbox     (CVE-2026-28859)

    * webkitgtk: Visiting a maliciously crafted website may lead to a cross-site scripting attack     (CVE-2026-28871)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:16697 advisory.

    Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

    Security Fix(es):

    * cmd/go: golang: Go (golang) and cmd/go: Arbitrary Code Execution via malicious SWIG file names     (CVE-2026-27140)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:16699 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression     modules (CVE-2026-6100)

    * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API     (CVE-2026-4786)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:16482 advisory.

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

    Security Fix(es):

    * freerdp: FreeRDP: Denial of service due to use-after-free vulnerability (CVE-2026-25952)

    * freerdp: FreeRDP: Denial of Service via double free vulnerability during disconnect (CVE-2026-26986)

    * freerdp: FreeRDP: Denial of Service via endless blocking loop in Stream_EnsureCapacity (CVE-2026-27951)

    * freerdp: FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId (CVE-2026-29775)

    * freerdp: FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds     checks (CVE-2026-31885)

    * freerdp: FreeRDP has a division-by-zero in ADPCM decoders when `nBlockAlign` is 0 (CVE-2026-31884)

    * freerdp: FreeRDP: Denial of Service via crafted audio data in RDP (CVE-2026-31883)

    * FreeRDP: FreeRDP: Information disclosure via heap memory out of bounds read (CVE-2026-33985)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:16698 advisory.

    Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

    Security Fix(es):

    * cmd/go: golang: Go (golang) and cmd/go: Arbitrary Code Execution via malicious SWIG file names     (CVE-2026-27140)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:16777 advisory.

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

    Security Fix(es):

    * freerdp: FreeRDP: Denial of service due to use-after-free vulnerability (CVE-2026-25952)

    * freerdp: FreeRDP: Denial of Service via double free vulnerability during disconnect (CVE-2026-26986)

    * freerdp: FreeRDP: Denial of Service via endless blocking loop in Stream_EnsureCapacity (CVE-2026-27951)

    * freerdp: FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId (CVE-2026-29775)

    * freerdp: FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds     checks (CVE-2026-31885)

    * freerdp: FreeRDP has a division-by-zero in ADPCM decoders when `nBlockAlign` is 0 (CVE-2026-31884)

    * freerdp: FreeRDP: Denial of Service via crafted audio data in RDP (CVE-2026-31883)

    * FreeRDP: FreeRDP: Information disclosure via heap memory out of bounds read (CVE-2026-33985)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:16693 advisory.

    jq is a lightweight and flexible command-line JSON processor. jq is like sed for JSON data. You can use it     to slice, filter, map, or transform structured data with the same ease that sed, awk, grep, or similar     applications allow you to manipulate text.

    Security Fix(es):

    * jq: out-of-bounds read in jv_parse_sized() on error formatting for non-NUL-terminated buffers     (CVE-2026-39979)

    * jq: jq: Denial of Service via crafted JSON object causing hash collisions (CVE-2026-40164)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:16692 advisory.

    jq is a lightweight and flexible command-line JSON processor. jq is like sed for JSON data. You can use it     to slice, filter, map, or transform structured data with the same ease that sed, awk, grep, or similar     applications allow you to manipulate text.

    Security Fix(es):

    * jq: out-of-bounds read in jv_parse_sized() on error formatting for non-NUL-terminated buffers     (CVE-2026-39979)

    * jq: jq: Denial of Service via crafted JSON object causing hash collisions (CVE-2026-40164)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:16701 advisory.

    The container-tools module contains tools for working with containers, notably podman, buildah, skopeo,     and runc.

    Security Fix(es):

    * golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected     SSH_AGENT_SUCCESS (CVE-2025-47913)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:16485 advisory.

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

    Security Fix(es):

    * freerdp: FreeRDP: Denial of service due to use-after-free vulnerability (CVE-2026-25952)

    * freerdp: FreeRDP: Denial of Service via double free vulnerability during disconnect (CVE-2026-26986)

    * freerdp: FreeRDP: Denial of Service via endless blocking loop in Stream_EnsureCapacity (CVE-2026-27951)

    * freerdp: FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId (CVE-2026-29775)

    * freerdp: FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds     checks (CVE-2026-31885)

    * freerdp: FreeRDP has a division-by-zero in ADPCM decoders when `nBlockAlign` is 0 (CVE-2026-31884)

    * freerdp: FreeRDP: Denial of Service via crafted audio data in RDP (CVE-2026-31883)

    * FreeRDP: FreeRDP: Information disclosure via heap memory out of bounds read (CVE-2026-33985)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:16497 advisory.

    The golang packages provide the Go programming language compiler.

    Security Fix(es):

    * cmd/go: golang: Go (golang) and cmd/go: Arbitrary Code Execution via malicious SWIG file names     (CVE-2026-27140)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:16814 advisory.

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

    Security Fix(es):

    * freerdp: FreeRDP: Denial of service due to use-after-free vulnerability (CVE-2026-25952)

    * freerdp: FreeRDP: Denial of Service via double free vulnerability during disconnect (CVE-2026-26986)

    * freerdp: FreeRDP: Denial of Service via endless blocking loop in Stream_EnsureCapacity (CVE-2026-27951)

    * freerdp: FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId (CVE-2026-29775)

    * freerdp: FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds     checks (CVE-2026-31885)

    * freerdp: FreeRDP has a division-by-zero in ADPCM decoders when `nBlockAlign` is 0 (CVE-2026-31884)

    * freerdp: FreeRDP: Denial of Service via crafted audio data in RDP (CVE-2026-31883)

    * FreeRDP: FreeRDP: Information disclosure via heap memory out of bounds read (CVE-2026-33985)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:16696 advisory.

    The skopeo command lets you inspect images from container image registries, get images and image layers,     and use signatures to create and verify files.

    Security Fix(es):

    * crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate     (CVE-2025-61729)

    * golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

    * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

    * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

    * github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted     JSON Web Encryption (JWE) object (CVE-2026-34986)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:16702 advisory.

    The podman tool manages pods, container images, and containers. It is part of the libpod library, which is     for applications that use container pods. Container pods is a concept in Kubernetes.

    Security Fix(es):

    * golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected     SSH_AGENT_SUCCESS (CVE-2025-47913)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:16694 advisory.

    Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

    Security Fix(es):

    * cmd/go: golang: Go (golang) and cmd/go: Arbitrary Code Execution via malicious SWIG file names     (CVE-2026-27140)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:16484 advisory.

    The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a     large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and     anti-aliasing, and conversions, all with multi-level undo.

    Security Fix(es):

    * gimp: GIMP:Memory disclosure and denial of service via specially crafted PCX image (CVE-2026-4887)

    * gimp: GIMP: Remote Code Execution via XPM File Parsing Integer Overflow (CVE-2026-4154)

    * gimp: GIMP: Remote Code Execution via ANI File Parsing Integer Overflow (CVE-2026-4151)

    * gimp: GIMP: Remote Code Execution via malicious JP2 file parsing (CVE-2026-4152)

    * GIMP: GIMP: Arbitrary code execution via specially crafted PSD file (CVE-2026-4150)

    * gimp: GIMP: Remote Code Execution via PSP file parsing (CVE-2026-4153)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:16483 advisory.

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

    Security Fix(es):

    * freerdp: FreeRDP: Denial of service due to use-after-free vulnerability (CVE-2026-25952)

    * freerdp: FreeRDP: Denial of Service via double free vulnerability during disconnect (CVE-2026-26986)

    * freerdp: FreeRDP: Denial of Service via endless blocking loop in Stream_EnsureCapacity (CVE-2026-27951)

    * freerdp: FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId (CVE-2026-29775)

    * freerdp: FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds     checks (CVE-2026-31885)

    * freerdp: FreeRDP has a division-by-zero in ADPCM decoders when `nBlockAlign` is 0 (CVE-2026-31884)

    * freerdp: FreeRDP: Denial of Service via crafted audio data in RDP (CVE-2026-31883)

    * FreeRDP: FreeRDP: Information disclosure via heap memory out of bounds read (CVE-2026-33985)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:16494 advisory.

    The golang packages provide the Go programming language compiler.

    Security Fix(es):

    * cmd/go: golang: Go (golang) and cmd/go: Arbitrary Code Execution via malicious SWIG file names     (CVE-2026-27140)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:16314 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: Dirty Frag is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux     kernel (CVE-2026-43284)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:16328 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: Dirty Frag is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux     kernel (CVE-2026-43284)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:16498 advisory.

    The golang packages provide the Go programming language compiler.

    Security Fix(es):

    * cmd/go: golang: Go (golang) and cmd/go: Arbitrary Code Execution via malicious SWIG file names     (CVE-2026-27140)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:16312 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: Dirty Frag is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux     kernel (CVE-2026-43284)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:16195 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: Dirty Frag is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux     kernel (CVE-2026-43284)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:16201 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: Dirty Frag is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux     kernel (CVE-2026-43284)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:16202 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: Dirty Frag is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux     kernel (CVE-2026-43284)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:16204 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: Dirty Frag is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux     kernel (CVE-2026-43284)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:16203 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: Dirty Frag is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux     kernel (CVE-2026-43284)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:16196 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: Dirty Frag is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux     kernel (CVE-2026-43284)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:16059 advisory.

    OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating     systems. It includes the core files necessary for both the OpenSSH client and server.

    Security Fix(es):

    * OpenSSH: OpenSSH: Privilege escalation via scp legacy protocol when not preserving file mode     (CVE-2026-35385)

    * OpenSSH: OpenSSH: Security bypass via mishandling of authorized_keys principals option (CVE-2026-35414)

    * OpenSSH: OpenSSH: Information disclosure due to unintended cryptographic algorithm usage     (CVE-2026-35387)

    * OpenSSH: OpenSSH: Low integrity impact from unconfirmed proxy-mode multiplexing sessions     (CVE-2026-35388)

    * OpenSSH: OpenSSH: Arbitrary command execution via shell metacharacters in username (CVE-2026-35386)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:15888 advisory.

    OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image     processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are     specific to this format.  This package containes the binaries for OpenEXR.

    Security Fix(es):

    * OpenEXR: OpenEXR: Arbitrary code execution and information disclosure via crafted EXR file     (CVE-2026-34588)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:16064 advisory.

    The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols.
    BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing     with DNS); and tools for verifying that the DNS server is operating correctly.

    Security Fix(es):

    * bind: BIND: Denial of Service via maliciously crafted DNSSEC-validated zone (CVE-2026-1519)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:16102 advisory.

    The buildah package provides a tool for facilitating building OCI container images. Among other things,     buildah enables you to: Create a working container, either from scratch or using an image as a starting     point; Create an image, either from a working container or using the instructions in a Dockerfile; Build     both Docker and OCI images.

    Security Fix(es):

    * golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected     SSH_AGENT_SUCCESS (CVE-2025-47913)

    * crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate     (CVE-2025-61729)

    * golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

    * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

    * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

    * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages     (CVE-2026-32283)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Severity
314691	RHEL 9 : dovecot (RHSA-2026:17630)	high
314690	RHEL 9 : openexr update (Important) (RHSA-2026:17658)	high
314689	RHEL 8 : python3 (RHSA-2026:17619)	critical
314688	RHEL 9 : libpng (RHSA-2026:17603)	high
314646	RHEL 9 : python3.12 (RHSA-2026:17525)	critical
314645	RHEL 8 : firefox (RHSA-2026:17477)	critical
314644	RHEL 9 : libpng (RHSA-2026:17524)	high
314643	RHEL 10 : libsoup3 (RHSA-2026:17482)	high
314642	RHEL 8 : rsync (RHSA-2026:17481)	high
314515	RHEL 9 : podman (RHSA-2026:17287)	high
314514	RHEL 10 : gvisor-tap-vsock (RHSA-2026:17084)	critical
314497	RHEL 9 : freerdp (RHSA-2026:16865)	medium
314496	RHEL 10 : fence-agents (RHSA-2026:17083)	high
314495	RHEL 8 : git-lfs (RHSA-2026:16875)	medium
314494	RHEL 10 : podman (RHSA-2026:17040)	critical
314493	RHEL 9 : freerdp (RHSA-2026:16866)	medium
314492	RHEL 10 : yggdrasil (RHSA-2026:17075)	medium
314391	RHEL 8 : krb5 (RHSA-2026:16799)	medium
314390	RHEL 9 : webkit2gtk3 (RHSA-2026:16695)	medium
314389	RHEL 8 : go-toolset:rhel8 (RHSA-2026:16697)	high
314388	RHEL 10 : python3.12 (RHSA-2026:16699)	critical
314387	RHEL 9 : freerdp (RHSA-2026:16482)	medium
314386	RHEL 8 : go-toolset:rhel8 (RHSA-2026:16698)	high
314385	RHEL 8 : freerdp (RHSA-2026:16777)	medium
314384	RHEL 9 : jq (RHSA-2026:16693)	medium
314383	RHEL 10 : jq (RHSA-2026:16692)	medium
314382	RHEL 8 : container-tools:rhel8 (RHSA-2026:16701)	high
314381	RHEL 9 : freerdp (RHSA-2026:16485)	medium
314380	RHEL 9 : golang (RHSA-2026:16497)	high
314379	RHEL 8 : freerdp (RHSA-2026:16814)	medium
314375	RHEL 10 : skopeo (RHSA-2026:16696)	critical
314374	RHEL 9 : podman (RHSA-2026:16702)	high
314373	RHEL 8 : go-toolset:rhel8 (RHSA-2026:16694)	high
314364	RHEL 9 : gimp (RHSA-2026:16484)	high
314363	RHEL 9 : freerdp (RHSA-2026:16483)	medium
314362	RHEL 9 : golang (RHSA-2026:16494)	high
314361	RHEL 10 : kernel (RHSA-2026:16314)	high
314360	RHEL 9 : kernel (RHSA-2026:16328)	high
314359	RHEL 9 : golang (RHSA-2026:16498)	high
314358	RHEL 9 : kernel (RHSA-2026:16312)	high
314311	RHEL 8 : kernel (RHSA-2026:16195)	high
314310	RHEL 8 : kernel (RHSA-2026:16201)	high
314309	RHEL 9 : kernel (RHSA-2026:16202)	high
314308	RHEL 8 : kernel (RHSA-2026:16204)	high
314307	RHEL 9 : kernel-rt (RHSA-2026:16203)	high
314306	RHEL 8 : kernel-rt (RHSA-2026:16196)	high
314287	RHEL 9 : openssh (RHSA-2026:16059)	high
314286	RHEL 10 : openexr (RHSA-2026:15888)	high
314257	RHEL 8 : bind (RHSA-2026:16064)	high
314256	RHEL 9 : buildah (RHSA-2026:16102)	critical

Detections

Analytics

Red Hat Local Security Checks Family for Nessus

high

high

critical

high

critical

critical

high

high

high

high

critical

medium

high

medium

critical

medium

medium

medium

medium

high

critical

medium

high

medium

medium

medium

high

medium

high

medium

critical

high

high

high

medium

high

high

high

high

high

high

high

high

high

high

high

high

high

high

critical