The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Fix command injection CVE-2026-46529  (CVE-2026-46529)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4596 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4596-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                   Andreas Henriksson     May 22, 2026                                  https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : evince     Version        : 3.38.2-1+deb11u1     CVE ID         : CVE-2026-46529

    It was discovered that evince, a simple multi-page document viewer, is     prone to a command injection vulnerability if a specially crafted PDF     file is opened.

    For Debian 11 bullseye, this problem has been fixed in version     3.38.2-1+deb11u1.

    We recommend that you upgrade your evince packages.

    For the detailed security status of evince please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/evince

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4597 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4597-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                   Andreas Henriksson     May 22, 2026                                  https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : atril     Version        : 1.24.0-1+deb11u2     CVE ID         : CVE-2026-46529

    It was discovered that atril, a simple multi-page document viewer, is     prone to a command injection vulnerability if a specially crafted PDF     file is opened.

    For Debian 11 bullseye, this problem has been fixed in version     1.24.0-1+deb11u2.

    We recommend that you upgrade your atril packages.

    For the detailed security status of atril please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/atril

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-aea94fcc1c advisory.

    Fix command injection CVE-2026-46529

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-49dc95b509 advisory.

    Fix command injection CVE-2026-46529


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8295-1 advisory.

    It was discovered that Evince did not properly sanitize command-line arguments in PDF /GoToR actions. If a     user opened a specially crafted PDF file, an attacker could possibly use this issue to execute arbitrary     code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-d29bd1ad07 advisory.

    Fix command injection CVE-2026-46529

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 12 / 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6286 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6286-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     May 21, 2026                          https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : evince     CVE ID         : CVE-2026-46529

    It was discovered that evince, a simple multi-page document viewer, is     prone to a command injection vulnerability if a specially crafted PDF     file is opened.

    For the oldstable distribution (bookworm), this problem has been fixed     in version 43.1-2+deb12u1.

    For the stable distribution (trixie), this problem has been fixed in     version 48.1-3+deb13u1.

    We recommend that you upgrade your evince packages.

    For the detailed security status of evince please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/evince

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
315531	Linux Distros Unpatched Vulnerability : CVE-2026-46529	Nessus	Misc.	5/19/2026	5/26/2026	critical
316544	Debian dla-4596 : evince - security update	Nessus	Debian Local Security Checks	5/25/2026	5/25/2026	critical
316546	Debian dla-4597 : atril - security update	Nessus	Debian Local Security Checks	5/25/2026	5/25/2026	critical
315984	Fedora 44 : evince (2026-aea94fcc1c)	Nessus	Fedora Local Security Checks	5/20/2026	5/25/2026	critical
316627	Fedora 42 : evince (2026-49dc95b509)	Nessus	Fedora Local Security Checks	5/25/2026	5/25/2026	critical
316638	Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : Evince vulnerability (USN-8295-1)	Nessus	Ubuntu Local Security Checks	5/25/2026	5/25/2026	high
315968	Fedora 43 : evince (2026-d29bd1ad07)	Nessus	Fedora Local Security Checks	5/20/2026	5/25/2026	critical
316044	Debian dsa-6286 : evince - security update	Nessus	Debian Local Security Checks	5/21/2026	5/25/2026	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

high

critical

critical