There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.
    Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs
    unbounded recursive backtracking when a glob pattern contains multiple non-adjacent `**` (GLOBSTAR)
    segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- where `n` is
    the number of path segments and `k` is the number of globstars. With k=11 and n=30, a call to the default
    `minimatch()` API stalls for roughly 5 seconds. With k=13, it exceeds 15 seconds. No memoization or call
    budget exists to bound this behavior. Any application where an attacker can influence the glob pattern
    passed to `minimatch()` is vulnerable. The realistic attack surface includes build tools and task runners
    that accept user-supplied glob arguments (ESLint, Webpack, Rollup config), multi-tenant systems where one
    tenant configures glob-based rules that run in a shared process, admin or developer interfaces that accept
    ignore-rule or filter configuration as globs, and CI/CD pipelines that evaluate user-submitted config
    files containing glob patterns. An attacker who can place a crafted pattern into any of these paths can
    stall the Node.js event loop for tens of seconds per invocation. The pattern is 56 bytes for a 5-second
    stall and does not require authentication in contexts where pattern input is part of the feature. Versions
    10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3 fix the issue. (CVE-2026-27903)

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - minimatch 是一種最小的比對公用程式可將 glob 運算式轉換為 JavaScript RegExp 物件。
     10.2.3、 9.0.7、 8.0.6、 7.4.8、 6.2.2、 5.1.8、 4.2.5和 3.1.3之前的版本中當 glob 模式包含多個不相鄰的「**」時`matchOne()` 會執行無限制的遞回回溯(GLOBSTAR) 區段且輸入路徑不相符。時間複雜度為 O(C(n, k)) -- 二項式 -- 其中「n」是路徑區段數而「k」是 globstar 數。在 k=11 和 n=30 的情況下對預設「minimatch()」API 的呼叫會停止大約 5 秒。若 k=13則超過 15 秒。不存在可限制此行為的記憶體或呼叫概算。攻擊者可影響傳遞至 `minimatch()` 之 glob 模式的任何應用程式都容易受到影響。真實的攻擊破綻包括接受使用者提供之 glob 引數 (ESLint、Webpack、匯總組態) 的建構工具和工作執行程式、一個租用戶設定 glob 型規則並在共用處理程序中執行的多租用戶系統、管理員或開發人員介面接受忽略規則或篩選設定為 glob，以及接受用於評估使用者提交且含有 glob 模式之設定檔案的 CI/CD 管線。可將特製模式放置到其中任何路徑中的攻擊者可在每次叫用時停止 Node.js 事件迴圈數十秒。模式為 56 位元組可造成 5 秒停止且在模式輸入屬於功能一部分的內容中不需要驗證。 10.2.3、 9.0.7、 8.0.6、 7.4.8、 6.2.2、 5.1.8、 4.2.5和 3.1.3 版可修正此問題。 (CVE-2026-27903)

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

遠端主機上安裝的 IBM Cognos Analytics 版本在 12.0.4 FP3 之前 12.0.4 ，或 12.1.x 在 FP2 之前 12.1.3 。因此，它會受到 IBM 安全公告 No.
7287209:

  - NLTK 版本 3.9.2 和更早版本由於 StanfordSegmenter 模組中的輸入驗證不當而容易受到任意程式碼執行的影響。此模組會動態載入外部Java.jar檔案，而無需驗證或沙箱。攻擊者可以提供或取代 JAR 檔案，從而在匯入時執行任意 Java 位元組碼。（CVE-2026-0848）

  - lodash 修正，用於 CVE-2021-23337 新增 _.template 中變數選項的驗證，但未對 options.imports 索引鍵名稱套用相同的驗證。這兩個路徑都將匯入相同的 Function() 建構函式接收器。當應用程式將未受信任的輸入作為 options.imports 金鑰名稱傳遞時，攻擊者可插入用於在範本編譯時執行任意程式碼的預設參數運算式。
    (CVE-2026-4800)

  - cryptography 套件用於向 Python 開發人員公開密碼編譯原語和配方。
    從 45.0.0 到 以前 46.0.7，如果將不連續的緩衝區傳遞給接受 Python 緩衝區的 API（例如 Hash.update（）），這可能會導致緩衝區溢位。（CVE-2026-39892）

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - minimatch 是用于将 glob 表达式转换为 JavaScript RegExp 对象的最小匹配实用工具。
    在低于版本 10.2.3、 9.0.7、 8.0.6、 7.4.8、 6.2.2、 5.1.8、 4.2.5和 3.1.3的版本中当 glob 模式包含多个不相邻的“**”时“matchOne()”会执行不受限制的递归回溯(GLOBSTAR) 段与输入路径不匹配。时间复杂度为 O(C(n, k)) -- 二项式 -- 其中“n”是路径段的数量“k”是 globstar 的数量。k=11 且 n=30 时对默认“minimatch()”API 的调用会停止大约 5 秒。当 k=13 时，该时间超过 15 秒。不存在限制此行为的 memoization 或 callsky 。攻击者可影响传递到 “minimatch()” glob 模式的任何应用程序都容易受到影响。实际的攻击面包括接受用户提供的 glob 参数ESLint、Webpack、Rollup 配置的构建工具和任务运行程序、一个租户配置在共享进程中运行的基于 glob 的规则的多租户系统、接受将忽略规则或过滤器配置为 glob以及评估用户提交的包含 glob 模式的配置文件的 CI/CD 管道。可将特制模式放置于其中任何路径的攻击者可在每次调用时使 Node.js 事件循环停止数十秒。对于 5 秒的停止该模式为 56 字节并且在模式输入作为功能的一部分的上下文中不需要认证。版本 10.2.3、 9.0.7、 8.0.6、 7.4.8、 6.2.2、 5.1.8、 4.2.5和 3.1.3 修复了此问题。 (CVE-2026-27903)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

远程主机上安装的 IBM Cognos Analytics 版本低于 12.0.412.0.4 FP3 或12.1.x12.1.3低于 FP2。因此，如 IBM 安全公告 No.
7287209:

  - NLTK 版本 3.9.2 和之前版本容易遭受任意代码执行的攻击，原因是 StanfordSegmenter 模块中错误的输入验证。该模块动态加载外部 Java .jar文件，无需验证或沙盒化。攻击者可提供或替换 JAR 文件，从而在导入时执行任意 Java 字节码。（CVE-2026-0848）

  - lodash CVE-2021-23337 补丁添加了对 _.template 中变量选项的验证，但未对 options.imports 密钥名应用相同的验证。两个路径都流入同一个 Function() 构造函数接收器。应用程序传递不受信任的输入作为 options.imports 密钥名称时，攻击者可注入默认参数表达式，在模板编译时执行任意代码。
    (CVE-2026-4800)

  - cryptography 程序包旨在为 Python 开发人员提供加密基元和方法。
    从 45.0.0 之前到 46.0.7之前，如果将非连续缓冲区传递到接受 Python 缓冲区的 API（例如 Hash.update（）），这可导致缓冲区溢出。（CVE-2026-39892）

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - minimatch は、glob 式を JavaScript RegExp オブジェクトに変換するための最小マッチングユーティリティです。
    バージョン 10.2.3、 9.0.7、 8.0.6、 7.4.8、 6.2.2、 5.1.8、 4.2.5、 3.1.3より前では、「matchOne()」は、グロブパターンに複数の隣接しない「**」が含まれる場合、無限の再帰バックトラッキングを実行します。 GLOBstarセグメントと入力パスが一致しません。時間複雑性は O(C(n, k)) -- binomial -- ここで「n」はパスセグメントの数で、「k」は globstar の数です。k=11 および n=30 では、デフォルトの「minimatch()」API の呼び出しで、約 5 秒間ストールします。k=13 の場合、15 秒を超えます。この動作をバインドするためのメモリ化や呼び出しバインドが存在しません。攻撃者が「minimatch()」に渡されるグロブパターンに影響を与えることができるアプリケーションはすべて脆弱です。現実的なアタックサーフェスとして、ユーザー指定の glob 引数 (ESLint、Webpack、Rollup config) を受け入れるビルドツールやタスク実行者、1 つのテナントが共有プロセスで実行される glob ベースのルールを構成するマルチテナントシステム、は、ルールの無視またはフィルターの構成を glob として受け入れ、また CI/CD パイプラインは glob パターンが含まれているユーザー送信の構成ファイルを評価します。これらのパスのいずれかに細工されたパターンを配置できる攻撃者が、Node.jsイベントループを1呼び出しごとに数十秒停止させる可能性があります。パターンは 5 秒のストールで 56 バイトであり、パターン入力が機能の一部であるコンテキストでは認証を必要としません。バージョン 10.2.3、 9.0.7、 8.0.6、 7.4.8、 6.2.2、 5.1.8、 4.2.5、 3.1.3 では、この問題が修正されます。CVE-2026-27903

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

リモートホストにインストールされている IBM Cognos Analytics のバージョンは、12.0.4 FP3 より前の 12.0.4、または 12.1.3 FP2 より前の 12.1.x です。したがって、IBMセキュリティ報告書No.に記載されている複数の脆弱性の影響を受けます。
7287209:

  - 3.9.2 以前の NLTK バージョンは、StanfordSegmenter モジュールの入力検証が不適切なために、任意のコードの実行に脆弱です。このモジュールは、検証やサンドボックスを行わずに、外部Java.jarファイルを動的にロードします。攻撃者は、JAR ファイルを供給または置換することで、インポート時に任意の Java バイトコードを実行できるようになります。(CVE-2026-0848)

  - CVE-2021-23337 に対する lodash の修正は、_.template の変数 option に対する検証を追加しましたが、options.imports キー名に同じ検証は適用しませんでした。両方のパスは同じ Function() コンストラクターシンクにフローします。アプリケーションが信頼できない入力を options.imports のキー名として渡す場合、攻撃者はテンプレートのコンパイル時に任意コードを実行するデフォルトパラメーター式を注入する可能性があります。
    (CVE-2026-4800)

  - cryptography は、Python 開発者向けに暗号のプリミティブとレシピを公開するために設計されたパッケージです。
    45.0.0から46.0.7以前まで、Pythonバッファ(Hash.update()など)を受け入れるAPIに非連続バッファが渡されると、これがバッファオーバーフローを引き起こす可能性があります。(CVE-2026-39892)

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0295 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-42037:
    Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.1, the     FormDataPart constructor in lib/helpers/formDataToStream.js interpolates value.type directly into the     Content-Type header of each multipart part without sanitizing CRLF (\r\n) sequences. An attacker who     controls the .type property of a Blob/File-like object (e.g., via a user-uploaded file in a Node.js proxy     service) can inject arbitrary MIME part headers into the multipart form-data body. This bypasses Node.js     v18+ built-in header protections because the injection targets the multipart body structure, not HTTP     request headers. This vulnerability is fixed in 1.15.1.

    CVE-2026-42035:
    Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, a prototype     pollution gadget exists in the Axios HTTP adapter (lib/adapters/http.js) that allows an attacker to inject     arbitrary HTTP headers into outgoing requests. The vulnerability exploits duck-type checking of the data     payload, where if Object.prototype is polluted with getHeaders, append, pipe, on, once, and     Symbol.toStringTag, Axios misidentifies any plain object payload as a FormData instance and calls the     attacker-controlled getHeaders() function, merging the returned headers into the outgoing request. The     vulnerable code resides exclusively in lib/adapters/http.js. The prototype pollution source does not need     to originate from Axios itself  any prototype pollution primitive in any dependency in the     application's dependency tree is sufficient to trigger this gadget. This vulnerability is fixed in 1.15.1     and 0.31.1.

    CVE-2026-42033:
    Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when     Object.prototype has been polluted by any co-dependency with keys that axios reads without a     hasOwnProperty guard, an attacker can (a) silently intercept and modify every JSON response before the     application sees it, or (b) fully hijack the underlying HTTP transport, gaining access to request     credentials, headers, and body. The precondition is prototype pollution from a separate source in the same     process. This vulnerability is fixed in 1.15.1 and 0.31.1.

    CVE-2026-41242:
    protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1 and     7.5.5, attackers can inject arbitrary code in the type fields of protobuf definitions, which will then     execute during object decoding using that definition. Versions 8.0.1 and 7.5.5 patch the issue.

    CVE-2026-33896:
    Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.
    Prior to version 1.4.0, `pki.verifyCertificateChain()` does not enforce RFC 5280 basicConstraints     requirements when an intermediate certificate lacks both the `basicConstraints` and `keyUsage` extensions.
    This allows any leaf certificate (without these extensions) to act as a CA and sign other certificates,     which node-forge will accept as valid. Version 1.4.0 patches the issue.

    CVE-2026-33895:
    Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.
    Prior to version 1.4.0, Ed25519 signature verification accepts forged non-canonical signatures where the     scalar S is not reduced modulo the group order (`S >= L`). A valid signature and its `S + L` variant both     verify in forge, while Node.js `crypto.verify` (OpenSSL-backed) rejects the `S + L` variant, as defined by     the specification. This class of signature malleability has been exploited in practice to bypass     authentication and authorization logic (see CVE-2026-25793, CVE-2022-35961). Applications relying on     signature uniqueness (i.e., dedup by signature bytes, replay tracking, signed-object canonicalization     checks) may be bypassed. Version 1.4.0 patches the issue.

    CVE-2026-33894:
    Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.
    Prior to version 1.4.0, RSASSA PKCS#1 v1.5 signature verification accepts forged signatures for low public     exponent keys (e=3). Attackers can forge signatures by stuffing garbage bytes within the ASN     structure in order to construct a signature that passes verification, enabling Bleichenbacher style     forgery. This issue is similar to CVE-2022-24771, but adds bytes in an addition field within the ASN     structure, rather than outside of it.  Additionally, forge does not validate that signatures include a     minimum of 8 bytes of padding as defined by the specification, providing attackers additional space to     construct Bleichenbacher forgeries. Version 1.4.0 patches the issue.

    CVE-2026-33891:
    Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.
    Prior to version 1.4.0, a Denial of Service (DoS) vulnerability exists in the node-forge library due to an     infinite loop in the BigInteger.modInverse() function (inherited from the bundled jsbn library). When     modInverse() is called with a zero value as input, the internal Extended Euclidean Algorithm enters an     unreachable exit condition, causing the process to hang indefinitely and consume 100% CPU. Version 1.4.0     patches the issue.

    CVE-2026-33228:
    flatted is a circular JSON parser. Prior to version 3.4.2, the parse() function in flatted can use     attacker-controlled string values from the parsed JSON as direct array index keys, without validating that     they are numeric. Since the internal input buffer is a JavaScript Array, accessing it with the key
    __proto__ returns Array.prototype via the inherited getter. This object is then treated as a legitimate     parsed value and assigned as a property of the output object, effectively leaking a live reference to     Array.prototype to the consumer. Any code that subsequently writes to that property will pollute the     global prototype. This issue has been patched in version 3.4.2.

    CVE-2026-32141:
    flatted is a circular JSON parser. Prior to 3.4.0, flatted's parse() function uses a recursive revive()     phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested     or self-referential $ indices, the recursion depth is unbounded, causing a stack overflow that crashes the     Node.js process. This vulnerability is fixed in 3.4.0.

    CVE-2026-29074:
    SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files.
    From version 2.1.0 to before version 2.8.1, from version 3.0.0 to before version 3.3.3, and before version     4.0.1, SVGO accepts XML with custom entities, without guards against entity expansion or recursion. This     can result in a small XML file (811 bytes) stalling the application and even crashing the Node.js process     with JavaScript heap out of memory. This issue has been patched in versions 2.8.1, 3.3.3, and 4.0.1.

    CVE-2026-27904:
    minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.
    Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs     produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic     backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()`     stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes.
    This is the most severe finding: it is triggered by the default `minimatch()` API with no special options,     and the minimum viable pattern is only 12 bytes. The same issue affects `+()` extglobs equally. Versions     10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.

    CVE-2026-27903:
    minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.
    Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs     unbounded recursive backtracking when a glob pattern contains multiple non-adjacent `**` (GLOBSTAR)     segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- where `n` is     the number of path segments and `k` is the number of globstars. With k=11 and n=30, a call to the default     `minimatch()` API stalls for roughly 5 seconds. With k=13, it exceeds 15 seconds. No memoization or call     budget exists to bound this behavior. Any application where an attacker can influence the glob pattern     passed to `minimatch()` is vulnerable. The realistic attack surface includes build tools and task runners     that accept user-supplied glob arguments (ESLint, Webpack, Rollup config), multi-tenant systems where one     tenant configures glob-based rules that run in a shared process, admin or developer interfaces that accept     ignore-rule or filter configuration as globs, and CI/CD pipelines that evaluate user-submitted config     files containing glob patterns. An attacker who can place a crafted pattern into any of these paths can     stall the Node.js event loop for tens of seconds per invocation. The pattern is 56 bytes for a 5-second     stall and does not require authentication in contexts where pattern input is part of the feature. Versions     10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3 fix the issue.

    CVE-2026-26996:
    minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.
    Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob     pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the     test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine     backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number     of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively     forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is     vulnerable to DoS. This issue has been fixed in version 10.2.1.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0304 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-27904:
    minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.
    Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs     produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic     backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()`     stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes.
    This is the most severe finding: it is triggered by the default `minimatch()` API with no special options,     and the minimum viable pattern is only 12 bytes. The same issue affects `+()` extglobs equally. Versions     10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.

    CVE-2026-27903:
    minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.
    Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs     unbounded recursive backtracking when a glob pattern contains multiple non-adjacent `**` (GLOBSTAR)     segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- where `n` is     the number of path segments and `k` is the number of globstars. With k=11 and n=30, a call to the default     `minimatch()` API stalls for roughly 5 seconds. With k=13, it exceeds 15 seconds. No memoization or call     budget exists to bound this behavior. Any application where an attacker can influence the glob pattern     passed to `minimatch()` is vulnerable. The realistic attack surface includes build tools and task runners     that accept user-supplied glob arguments (ESLint, Webpack, Rollup config), multi-tenant systems where one     tenant configures glob-based rules that run in a shared process, admin or developer interfaces that accept     ignore-rule or filter configuration as globs, and CI/CD pipelines that evaluate user-submitted config     files containing glob patterns. An attacker who can place a crafted pattern into any of these paths can     stall the Node.js event loop for tens of seconds per invocation. The pattern is 56 bytes for a 5-second     stall and does not require authentication in contexts where pattern input is part of the feature. Versions     10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3 fix the issue.

    CVE-2026-26996:
    minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.
    Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob     pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the     test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine     backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number     of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively     forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is     vulnerable to DoS. This issue has been fixed in version 10.2.1.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of IBM Cognos Analytics installed on the remote host is 12.0.4 prior to 12.0.4 FP3, or 12.1.x prior to 12.1.3 FP2. It is, therefore, affected by multiple vulnerabilities as referenced in the IBM Security Bulletin No.
7287209:

  - NLTK versions 3.9.2 and prior are vulnerable to arbitrary code execution due to improper input     validation in the StanfordSegmenter module. The module dynamically loads external Java .jar files     without verification or sandboxing. An attacker can supply or replace the JAR file, enabling the     execution of arbitrary Java bytecode at import time. (CVE-2026-0848)

  - The lodash fix for CVE-2021-23337 added validation for the variable option in _.template but did not     apply the same validation to options.imports key names. Both paths flow into the same Function()     constructor sink. When an application passes untrusted input as options.imports key names, an attacker     can inject default-parameter expressions that execute arbitrary code at template compilation time.
    (CVE-2026-4800)

  - cryptography is a package designed to expose cryptographic primitives and recipes to Python developers.
    From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python     buffers (e.g. Hash.update()), this could lead to buffer overflows. (CVE-2026-39892)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.
    Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs     unbounded recursive backtracking when a glob pattern contains multiple non-adjacent `**` (GLOBSTAR)     segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- where `n` is     the number of path segments and `k` is the number of globstars. With k=11 and n=30, a call to the default     `minimatch()` API stalls for roughly 5 seconds. With k=13, it exceeds 15 seconds. No memoization or call     budget exists to bound this behavior. Any application where an attacker can influence the glob pattern     passed to `minimatch()` is vulnerable. The realistic attack surface includes build tools and task runners     that accept user-supplied glob arguments (ESLint, Webpack, Rollup config), multi-tenant systems where one     tenant configures glob-based rules that run in a shared process, admin or developer interfaces that accept     ignore-rule or filter configuration as globs, and CI/CD pipelines that evaluate user-submitted config     files containing glob patterns. An attacker who can place a crafted pattern into any of these paths can     stall the Node.js event loop for tens of seconds per invocation. The pattern is 56 bytes for a 5-second     stall and does not require authentication in contexts where pattern input is part of the feature. Versions     10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3 fix the issue. (CVE-2026-27903)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0762 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-27903:
    minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.
    Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs     unbounded recursive backtracking when a glob pattern contains multiple non-adjacent `**` (GLOBSTAR)     segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- where `n` is     the number of path segments and `k` is the number of globstars. With k=11 and n=30, a call to the default     `minimatch()` API stalls for roughly 5 seconds. With k=13, it exceeds 15 seconds. No memoization or call     budget exists to bound this behavior. Any application where an attacker can influence the glob pattern     passed to `minimatch()` is vulnerable. The realistic attack surface includes build tools and task runners     that accept user-supplied glob arguments (ESLint, Webpack, Rollup config), multi-tenant systems where one     tenant configures glob-based rules that run in a shared process, admin or developer interfaces that accept     ignore-rule or filter configuration as globs, and CI/CD pipelines that evaluate user-submitted config     files containing glob patterns. An attacker who can place a crafted pattern into any of these paths can     stall the Node.js event loop for tens of seconds per invocation. The pattern is 56 bytes for a 5-second     stall and does not require authentication in contexts where pattern input is part of the feature. Versions     10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3 fix the issue.

    CVE-2026-27904:
    minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.
    Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs     produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic     backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()`     stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes.
    This is the most severe finding: it is triggered by the default `minimatch()` API with no special options,     and the minimum viable pattern is only 12 bytes. The same issue affects `+()` extglobs equally. Versions     10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.

    CVE-2026-26996:
    minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.
    Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob     pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the     test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine     backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number     of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively     forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is     vulnerable to DoS. This issue has been fixed in version 10.2.1.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
461830	Echo: minimatch: security update to 3.1.3node-minimatch: security update to 9.0.3-6+e1	Tenable Cloud Security	Echo Local Security Checks	2026/10/2	2026/10/5	high
461830	Echo: minimatch: security update to 3.1.3node-minimatch: security update to 9.0.3-6+e1	Tenable Self-Hosted Container Security	Echo Local Security Checks	2026/10/2	2026/10/5	high
438108	SCA: security update for minimatch (GHSA-7r86-cg39-jmmj)	Tenable Cloud Security	SCA Checks	2026/3/3	2026/7/2	high
438108	SCA: security update for minimatch (GHSA-7r86-cg39-jmmj)	Tenable Self-Hosted Container Security	SCA Checks	2026/3/3	2026/7/2	high
300455	Linux Distros 未修補的弱點：CVE-2026-27903	Nessus	Misc.	2026/3/3	2026/9/2	high
347960	IBM Cognos Analytics 12.0.4 < 12.0.4 FP3 / 12.1.x < 12.1.3 FP2 多個弱點（7287209）	Nessus	CGI abuses	2026/9/18	2026/9/21	high
300455	Linux Distros 未修补的漏洞：CVE-2026-27903	Nessus	Misc.	2026/3/3	2026/9/2	high
347960	IBM Cognos Analytics 12.0.4 < 12.0.4 FP3 / 12.1.x < 12.1.3 FP2 多种漏洞（7287209）	Nessus	CGI abuses	2026/9/18	2026/9/21	high
300455	Linux Distros のパッチ未適用の脆弱性: CVE-2026-27903	Nessus	Misc.	2026/3/3	2026/9/2	high
347960	IBM Cognos Analytics 12.0.4 < 12.0.4 FP3 / 12.1.x < 12.1.3 FP2 の複数の脆弱性 (7287209)	Nessus	CGI abuses	2026/9/18	2026/9/21	high
319720	TencentOS Server 4: grafana (TSSA-2026:0295)	Nessus	Tencent Local Security Checks	2026/6/8	2026/6/8	critical
319754	TencentOS Server 4: nodejs20 (TSSA-2026:0304)	Nessus	Tencent Local Security Checks	2026/6/8	2026/6/8	high
347960	IBM Cognos Analytics 12.0.4 < 12.0.4 FP3 / 12.1.x < 12.1.3 FP2 Multiple Vulnerabilities (7287209)	Nessus	CGI abuses	2026/9/18	2026/9/21	high
300455	Linux Distros Unpatched Vulnerability : CVE-2026-27903	Nessus	Misc.	2026/3/3	2026/9/2	high
330801	TencentOS Server 4: nodejs-nodemon (TSSA-2026:0762)	Nessus	Tencent Local Security Checks	2026/7/29	2026/9/3	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

critical

high

high

high

high