The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:0233 advisory.

    MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.

    Security Fix(es):

    * mariadb: MariaDB: mariadb-dump utility vulnerable to remote code execution via improper path validation     (CVE-2025-13699)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:0265 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    Security Fix(es):

    * postgresql: CREATE STATISTICS does not check for schema CREATE privilege (CVE-2025-12817)

    * postgresql: libpq undersizes allocations, via integer wraparound (CVE-2025-12818)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:0250 advisory.

    The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a     large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and     anti-aliasing, and conversions, all with multi-level undo.

    Security Fix(es):

    * gimp: GIMP DCM File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability     (CVE-2025-10922)

    * gimp: GIMP XWD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability     (CVE-2025-10934)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:0234 advisory.

    The libpng packages contain a library of functions for creating and manipulating Portable Network Graphics     (PNG) image format files.

    Security Fix(es):

    * libpng: LIBPNG buffer overflow (CVE-2025-64720)

    * libpng: LIBPNG heap buffer overflow (CVE-2025-65018)

    * libpng: LIBPNG out-of-bounds read in png_image_read_composite (CVE-2025-66293)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:0203 advisory.

    Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics     with text pointers inside Git, while storing the file contents on a remote server.

    Security Fix(es):

    * git-lfs: Git LFS may write to arbitrary files via crafted symlinks (CVE-2025-26625)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:0246 advisory.

    Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &     OpenTSDB.

    Security Fix(es):

    * golang: archive/tar: Unbounded allocation when parsing GNU sparse map (CVE-2025-58183)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:0226 advisory.

    A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild     under the hood. Besides building images for local usage, it can also upload images directly to cloud.  It     is compatible with composer-cli and cockpit-composer clients.

    Security Fix(es):

    * golang: archive/tar: Unbounded allocation when parsing GNU sparse map (CVE-2025-58183)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:0199 advisory.

    Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics     with text pointers inside Git, while storing the file contents on a remote server.

    Security Fix(es):

    * git-lfs: Git LFS may write to arbitrary files via crafted symlinks (CVE-2025-26625)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:0232 advisory.

    MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.

    Security Fix(es):

    * mariadb: MariaDB: mariadb-dump utility vulnerable to remote code execution via improper path validation     (CVE-2025-13699)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:0173 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: RDMA/siw: Fix connection failure handling (CVE-2023-52513)

    * kernel: smb: client: fix potential UAF in cifs_stats_proc_write() (CVE-2024-35868)

    * kernel: can: j1939: implement NETDEV_UNREGISTER notification handler (CVE-2025-39925)

    * kernel: i40e: fix idx validation in config queues msg (CVE-2025-39971)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:0171 advisory.

    The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

    Security Fix(es):

    * httpd: Apache HTTP Server: Server Side Includes adds query string to #exec cmd=... (CVE-2025-58098)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:0210 advisory.

    The libpng packages contain a library of functions for creating and manipulating Portable Network Graphics     (PNG) image format files.

    Security Fix(es):

    * libpng: LIBPNG buffer overflow (CVE-2025-64720)

    * libpng: LIBPNG heap buffer overflow (CVE-2025-65018)

    * libpng: LIBPNG out-of-bounds read in png_image_read_composite (CVE-2025-66293)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:0263 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    Security Fix(es):

    * postgresql: CREATE STATISTICS does not check for schema CREATE privilege (CVE-2025-12817)

    * postgresql: libpq undersizes allocations, via integer wraparound (CVE-2025-12818)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:0245 advisory.

    Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &     OpenTSDB.

    Security Fix(es):

    * golang: archive/tar: Unbounded allocation when parsing GNU sparse map (CVE-2025-58183)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:0225 advisory.

    MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.

    Security Fix(es):

    * mariadb: MariaDB: mariadb-dump utility vulnerable to remote code execution via improper path validation     (CVE-2025-13699)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:0271 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: x86/vmscape: Add conditional IBPB mitigation (CVE-2025-40300)

    * kernel: HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() (CVE-2025-39806)

    * kernel: mm: slub: avoid wake up kswapd in set_track_prepare (CVE-2025-39843)

    * kernel: mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (CVE-2025-39883)

    * kernel: can: j1939: implement NETDEV_UNREGISTER notification handler (CVE-2025-39925)

    * kernel: Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync (CVE-2025-39982)

    * kernel: Bluetooth: MGMT: Fix possible UAFs (CVE-2025-39981)

    * kernel: Bluetooth: hci_event: Fix UAF in hci_conn_tx_dequeue (CVE-2025-39983)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:0237 advisory.

    The libpng packages contain a library of functions for creating and manipulating Portable Network Graphics     (PNG) image format files.

    Security Fix(es):

    * libpng: LIBPNG buffer overflow (CVE-2025-64720)

    * libpng: LIBPNG heap buffer overflow (CVE-2025-65018)

    * libpng: LIBPNG out-of-bounds read in png_image_read_composite (CVE-2025-66293)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:0244 advisory.

    Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &     OpenTSDB.

    Security Fix(es):

    * golang: archive/tar: Unbounded allocation when parsing GNU sparse map (CVE-2025-58183)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:0211 advisory.

    The libpng packages contain a library of functions for creating and manipulating Portable Network Graphics     (PNG) image format files.

    Security Fix(es):

    * libpng: LIBPNG buffer overflow (CVE-2025-64720)

    * libpng: LIBPNG heap buffer overflow (CVE-2025-65018)

    * libpng: LIBPNG out-of-bounds read in png_image_read_composite (CVE-2025-66293)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:0247 advisory.

    MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.

    Security Fix(es):

    * mysql: High Privilege Denial of Service Vulnerability in MySQL Server (CVE-2025-21490)

    * mariadb: MariaDB Server Crash Due to Empty Backtrace Log (CVE-2023-52969)

    * mariadb: MariaDB Server Crash (CVE-2023-52971)

    * mariadb: MariaDB Server Crash via Item_direct_view_ref (CVE-2023-52970)

    * mysql: mysqldump unspecified vulnerability (CPU Apr 2025) (CVE-2025-30722)

    * mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-30693)

    * mariadb: MariaDB: mariadb-dump utility vulnerable to remote code execution via improper path validation     (CVE-2025-13699)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:0251 advisory.

    The libpng packages contain a library of functions for creating and manipulating Portable Network Graphics     (PNG) image format files.

    Security Fix(es):

    * libpng: LIBPNG buffer overflow (CVE-2025-64720)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:0241 advisory.

    The libpng packages contain a library of functions for creating and manipulating Portable Network Graphics     (PNG) image format files.

    Security Fix(es):

    * libpng: LIBPNG buffer overflow (CVE-2025-64720)

    * libpng: LIBPNG heap buffer overflow (CVE-2025-65018)

    * libpng: LIBPNG out-of-bounds read in png_image_read_composite (CVE-2025-66293)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:0227 advisory.

    A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild     under the hood. Besides building images for local usage, it can also upload images directly to cloud.  It     is compatible with composer-cli and cockpit-composer clients.

    Security Fix(es):

    * golang: archive/tar: Unbounded allocation when parsing GNU sparse map (CVE-2025-58183)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:0204 advisory.

    Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics     with text pointers inside Git, while storing the file contents on a remote server.

    Security Fix(es):

    * git-lfs: Git LFS may write to arbitrary files via crafted symlinks (CVE-2025-26625)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:0268 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    Security Fix(es):

    * postgresql: CREATE STATISTICS does not check for schema CREATE privilege (CVE-2025-12817)

    * postgresql: libpq undersizes allocations, via integer wraparound (CVE-2025-12818)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:0130 advisory.

    Poppler is a Portable Document Format (PDF) rendering library, used by applications such as Evince.

    Security Fix(es):

    * poppler: Out-of-Bounds Read in Poppler (CVE-2025-32365)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:0137 advisory.

    MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.

    Security Fix(es):

    * mariadb: MariaDB: mariadb-dump utility vulnerable to remote code execution via improper path validation     (CVE-2025-13699)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:0140 advisory.

    The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries     and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards.

    Security Fix(es):

    * expr-eval: expr-eval: Prototype Pollution (CVE-2025-13204)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:0141 advisory.

    The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

    Security Fix(es):

    * httpd: Apache HTTP Server: Server Side Includes adds query string to #exec cmd=... (CVE-2025-58098)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:0076 advisory.

    Spice client MSI installers for Windows clients

    Security Fix(es):

    * sqlite: Integer Truncation in SQLite (CVE-2025-6965)

    * libtiff: LibTIFF Use-After-Free Vulnerability (CVE-2025-8176)

    * libtiff: Libtiff Write-What-Where (CVE-2025-9900)

    * expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small     document that is submitted for parsing (CVE-2025-59375)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:0108 advisory.

    Binutils is a collection of binary utilities, including ar (for creating, modifying and extracting from     archives), as (a family of GNU assemblers), gprof (for displaying call graph profile data), ld (the GNU     linker), nm (for listing symbols from object files), objcopy (for copying and translating object files),     objdump (for displaying information from object files), ranlib (for generating an index for the contents     of an archive), readelf (for displaying detailed information about binary files), size (for listing the     section sizes of an object or archive file), strings (for listing printable strings from files), strip     (for discarding symbols), and addr2line (for converting addresses to file and line).

    Security Fix(es):

    * binutils: GNU Binutils Linker heap-based overflow (CVE-2025-11083)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:0125 advisory.

    MinGW Windows Libpng library.

    Security Fix(es):

    * libpng: LIBPNG buffer overflow (CVE-2025-64720)

    * libpng: LIBPNG heap buffer overflow (CVE-2025-65018)

    * libpng: LIBPNG out-of-bounds read in png_image_read_composite (CVE-2025-66293)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:0123 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * cpython: python: Python zipfile End of Central Directory (EOCD) Locator record offset not checked     (CVE-2025-8291)

    * cpython: python: cpython: Quadratic algorithm in xml.dom.minidom leads to denial of service     (CVE-2025-12084)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:0112 advisory.

    MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.

    Security Fix(es):

    * mariadb: MariaDB: mariadb-dump utility vulnerable to remote code execution via improper path validation     (CVE-2025-13699)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:0111 advisory.

    MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.

    Security Fix(es):

    * mariadb: MariaDB: mariadb-dump utility vulnerable to remote code execution via improper path validation     (CVE-2025-13699)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:0139 advisory.

    The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

    Security Fix(es):

    * httpd: Apache HTTP Server: Server Side Includes adds query string to #exec cmd=... (CVE-2025-58098)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:0092 advisory.

    This module manages common properties of domains for one or more virtual hosts. Specifically it can use     the ACME protocol to automate certificate provisioning.  Certificates will be configured for managed     domains and their virtual hosts automatically, including at renewal.

    Security Fix(es):

    * mod_md: Apache HTTP Server: mod_md (ACME), unintended retry intervals (CVE-2025-55753)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:0095 advisory.

    The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

    Security Fix(es):

    * httpd: Apache HTTP Server: Server Side Includes adds query string to #exec cmd=... (CVE-2025-58098)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:0128 advisory.

    Poppler is a Portable Document Format (PDF) rendering library, used by applications such as Evince.

    Security Fix(es):

    * poppler: Out-of-Bounds Read in Poppler (CVE-2025-32365)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:0124 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    Security Fix(es):

    * firefox: Memory safety bugs fixed in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and     Thunderbird 146 (CVE-2025-14333)

    * firefox: Use-after-free in the WebRTC: Signaling component (CVE-2025-14321)

    * firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2025-14325)

    * firefox: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component     (CVE-2025-14322)

    * firefox: Privilege escalation in the Netmonitor component (CVE-2025-14328)

    * firefox: Privilege escalation in the Netmonitor component (CVE-2025-14329)

    * firefox: Same-origin policy bypass in the Request Handling component (CVE-2025-14331)

    * firefox: Privilege escalation in the DOM: Notifications component (CVE-2025-14323)

    * firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2025-14330)

    * firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2025-14324)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:0136 advisory.

    MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is     a client/server implementation consisting of a server daemon (mariadbd) and many different client programs     and libraries. The base package contains the standard MariaDB/MySQL client programs and utilities.

    Security Fix(es):

    * mysql: High Privilege Denial of Service Vulnerability in MySQL Server (CVE-2025-21490)

    * mariadb: MariaDB Server Crash Due to Empty Backtrace Log (CVE-2023-52969)

    * mariadb: MariaDB Server Crash (CVE-2023-52971)

    * mariadb: MariaDB Server Crash via Item_direct_view_ref (CVE-2023-52970)

    * mysql: mysqldump unspecified vulnerability (CPU Apr 2025) (CVE-2025-30722)

    * mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-30693)

    * mariadb: MariaDB: mariadb-dump utility vulnerable to remote code execution via improper path validation     (CVE-2025-13699)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:0077 advisory.

    Spice client MSI installers for Windows clients

    Security Fix(es):

    * sqlite: Integer Truncation in SQLite (CVE-2025-6965)

    * libtiff: LibTIFF Use-After-Free Vulnerability (CVE-2025-8176)

    * libtiff: Libtiff Write-What-Where (CVE-2025-9900)

    * expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small     document that is submitted for parsing (CVE-2025-59375)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:0093 advisory.

    This module manages common properties of domains for one or more virtual hosts. Specifically it can use     the ACME protocol to automate certificate provisioning.  Certificates will be configured for managed     domains and their virtual hosts automatically, including at renewal.

    Security Fix(es):

    * mod_md: Apache HTTP Server: mod_md (ACME), unintended retry intervals (CVE-2025-55753)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:0094 advisory.

    This module manages common properties of domains for one or more virtual hosts. Specifically it can use     the ACME protocol to automate certificate provisioning.  Certificates will be configured for managed     domains and their virtual hosts automatically, including at renewal.

    Security Fix(es):

    * mod_md: Apache HTTP Server: mod_md (ACME), unintended retry intervals (CVE-2025-55753)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:0126 advisory.

    Poppler is a Portable Document Format (PDF) rendering library, used by applications such as Evince.

    Security Fix(es):

    * poppler: Out-of-Bounds Read in Poppler (CVE-2025-32365)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:0127 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    Security Fix(es):

    * firefox: Memory safety bugs fixed in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and     Thunderbird 146 (CVE-2025-14333)

    * firefox: Use-after-free in the WebRTC: Signaling component (CVE-2025-14321)

    * firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2025-14325)

    * firefox: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component     (CVE-2025-14322)

    * firefox: Privilege escalation in the Netmonitor component (CVE-2025-14328)

    * firefox: Privilege escalation in the Netmonitor component (CVE-2025-14329)

    * firefox: Same-origin policy bypass in the Request Handling component (CVE-2025-14331)

    * firefox: Privilege escalation in the DOM: Notifications component (CVE-2025-14323)

    * firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2025-14330)

    * firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2025-14324)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:0135 advisory.

    The GNU tar program can save multiple files in an archive and restore files from an archive.

    Security Fix(es):

    * tar: Tar path traversal (CVE-2025-45582)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:0090 advisory.

    The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

    Security Fix(es):

    * httpd: Apache HTTP Server: Server Side Includes adds query string to #exec cmd=... (CVE-2025-58098)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:0079 advisory.

    Perl is a high-level programming language that is commonly used for system administration utilities and     web programming.

    Security Fix(es):

    * perl: CPAN.pm does not verify TLS certificates when downloading distributions over HTTPS     (CVE-2023-31484)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:0075 advisory.

    The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

    Security Fix(es):

    * httpd: Apache HTTP Server: Server Side Includes adds query string to #exec cmd=... (CVE-2025-58098)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Severity
282434	RHEL 8 : mariadb:10.5 (RHSA-2026:0233)	high
282433	RHEL 8 : postgresql:13 (RHSA-2026:0265)	medium
282432	RHEL 8 : gimp:2.8 (RHSA-2026:0250)	high
282431	RHEL 9 : libpng (RHSA-2026:0234)	high
282430	RHEL 9 : git-lfs (RHSA-2026:0203)	high
282429	RHEL 8 : grafana (RHSA-2026:0246)	medium
282428	RHEL 9 : osbuild-composer (RHSA-2026:0226)	medium
282427	RHEL 9 : git-lfs (RHSA-2026:0199)	high
282426	RHEL 8 : mariadb:10.11 (RHSA-2026:0232)	high
282425	RHEL 9 : kernel (RHSA-2026:0173)	high
282424	RHEL 10 : httpd (RHSA-2026:0171)	high
282423	RHEL 9 : libpng (RHSA-2026:0210)	high
282422	RHEL 9 : postgresql (RHSA-2026:0263)	medium
282421	RHEL 8 : grafana (RHSA-2026:0245)	medium
282420	RHEL 8 : mariadb:10.3 (RHSA-2026:0225)	high
282419	RHEL 10 : kernel (RHSA-2026:0271)	high
282418	RHEL 10 : libpng (RHSA-2026:0237)	high
282417	RHEL 8 : grafana (RHSA-2026:0244)	medium
282416	RHEL 9 : libpng (RHSA-2026:0211)	high
282415	RHEL 9 : mariadb:10.11 (RHSA-2026:0247)	medium
282414	RHEL 7 : libpng (RHSA-2026:0251)	high
282413	RHEL 8 : libpng (RHSA-2026:0241)	high
282412	RHEL 9 : osbuild-composer (RHSA-2026:0227)	medium
282411	RHEL 9 : git-lfs (RHSA-2026:0204)	high
282410	RHEL 9 : postgresql (RHSA-2026:0268)	medium
281899	RHEL 8 : poppler (RHSA-2026:0130)	high
281898	RHEL 9 : mariadb (RHSA-2026:0137)	high
281897	RHEL 8 : grafana-pcp (RHSA-2026:0140)	high
281896	RHEL 9 : httpd (RHSA-2026:0141)	high
281886	RHEL 8 : spice-client-win (RHSA-2026:0076)	high
281885	RHEL 10 : gcc-toolset-15-binutils (RHSA-2026:0108)	medium
281884	RHEL 8 : mingw-libpng (RHSA-2026:0125)	high
281883	RHEL 8 : python3.12 (RHSA-2026:0123)	medium
281882	RHEL 9 : mariadb (RHSA-2026:0112)	high
281871	RHEL 9 : mariadb (RHSA-2026:0111)	high
281870	RHEL 9 : httpd (RHSA-2026:0139)	high
281869	RHEL 9 : mod_md (RHSA-2026:0092)	high
281868	RHEL 9 : httpd (RHSA-2026:0095)	high
281867	RHEL 10 : poppler (RHSA-2026:0128)	high
281866	RHEL 10 : thunderbird (RHSA-2026:0124)	critical
281861	RHEL 10 : mariadb10.11 (RHSA-2026:0136)	medium
281860	RHEL 8 : spice-client-win (RHSA-2026:0077)	high
281859	RHEL 10 : mod_md (RHSA-2026:0093)	high
281858	RHEL 9 : mod_md (RHSA-2026:0094)	high
281857	RHEL 9 : poppler (RHSA-2026:0126)	high
281856	RHEL 10 : firefox (RHSA-2026:0127)	critical
281855	RHEL 10 : tar (RHSA-2026:0135)	medium
281854	RHEL 9 : httpd (RHSA-2026:0090)	high
281786	RHEL 7 : perl (RHSA-2026:0079)	high
281785	RHEL 7 : httpd (RHSA-2026:0075)	high

Detections

Analytics

Red Hat Local Security Checks Family for Nessus

high

medium

high

high

high

medium

medium

high

high

high

high

high

medium

medium

high

high

high

medium

high

medium

high

high

medium

high

medium

high

high

high

high

high

medium

high

medium

high

high

high

high

high

high

critical

medium

high

high

high

high

critical

medium

high

high

high