The version of Kibana installed on the remote host is 8.x prior to 8.19.24, or 9.0.x prior to 9.4.9, or 9.5.x prior to 9.5.6. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-232 advisory.

  - A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3     through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state     memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary     code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries     between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1. (CVE-2026-111497)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a336a99528 advisory.

    Backport fix for CVE-2026-111497.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8956-2 advisory.

    USN-8956-1 fixed a vulnerability in Brotli. This update provides the corresponding fixes for Ubuntu 16.04     LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:5036-1 advisory.

    - CVE-2026-105481: Keep-alive socket process a response that was written before the request was sent     (bsc#1286565).
    - CVE-2026-105482: dns.resolve truncates names containing NUL char (bsc#1286561).
    - CVE-2026-106069: TLS certificate hostname bypass when the host loosely resolves to an IP address     (bsc#1286563).
    - CVE-2026-106072: Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to     authenticate IP       endpoints (bsc#1286566).
    - CVE-2026-106073: Permission Model bypass with fs.realpathSync (bsc#1286570).
    - CVE-2026-106074: crypto.randomUUID() and randomInt() entropy caches are saved into user-land startup     snapshots and       SEAs, so every process repeats the same values (bsc#1286567).
    - CVE-2026-111497: Node.js Brotli decoder out-of-bounds write permits remote code execution (bsc#1286564).

    Changes for nodejs22:

    - Update to 22.23.4:
     - deps: update c-ares to 1.34.9
     - deps: update timezone to 2026e
     - deps: upgrade openssl sources to openssl-3.5.9
     - deps: update sqlite to 3.53.4
     - deps: update undici to 6.29.1
    - Update to 22.23.3:
     - deps: update corepack to 0.36.0
     - deps: upgrade npm to 10.9.9
     - deps: update icu to 78.3
     - deps: update Undici to 6.28.1
     - node-api: support SharedArrayBuffer in napi_create_typedarray
     - node-api: add napi_create_external_sharedarraybuffer

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:95657 advisory.

    This advisory provides security fixes for affected packages used by Red Hat     Satellite. The updates address the vulnerabilities described below.

    Security Fix(es):

    * python3.12-django: Django: Remote code execution via GeoDjango spatial lookups (CVE-2026-15307)
    * python3.12-brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)
    * python3.12-urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override     (CVE-2026-97687)
    * python3.12-urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser     (CVE-2026-97689)
    * python3.12-pillow: pillow: Denial of Service via duplicate page references in PDF files (CVE-2026-96640)
    * python3.12-pillow: pillow: Denial of Service via repeated EXIF headers (CVE-2026-96643)
    * python3.12-pillow: pillow: Arbitrary code execution via JPEG encoder buffer overflow (CVE-2026-96778)
    * python3.12-pillow: Pillow: Denial of Service via infinite loop during crafted MIC image parsing     (CVE-2026-112390)
    * python3.12-pillow: Pillow: Denial of Service via unbounded recursion in PDF parser (CVE-2026-112391)
    * python3.12-pillow: pillow: Denial of Service via zero-size images in rank filters (CVE-2026-112392)
    * python3.12-pillow: Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO     (CVE-2026-112393)
    * python3.12-pillow: pillow: Denial of Service via out-of-bounds memory access on zero-width images     (CVE-2026-112397)
    * python3.12-pillow: Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution     (CVE-2026-112398)
    * python3.12-pillow: pillow: Denial of service via crafted APNG image (CVE-2026-112399)
    * python3.12-pillow: pillow: Denial of Service via memory exhaustion from crafted GIF image     (CVE-2026-112400)
    * python3.12-pillow: pillow: Denial of service via double free during image transformation     (CVE-2026-112402)
    * python3.12-pillow: Pillow: Heap buffer overflow in ImagingJpegDecode (CVE-2026-112403)
    * python3.12-pillow: Pillow: Denial of Service via out-of-bounds read in TIFF decoding (CVE-2026-112404)
    * python3.12-pillow: Pillow: Denial of Service via null pointer dereference in Image.merge()     (CVE-2026-112405)
    * python3.12-pillow: pillow: Denial of Service via infinite loop during PDF page rewriting     (CVE-2026-112406)
    * python3.12-pillow: pillow: Denial of Service via unbounded memory expansion in MSP image decoder     (CVE-2026-112892)
    * python3.12-pillow: Pillow: Denial of Service via invalid pointer free during font rendering     (CVE-2026-112893)
    * python3.12-pillow: pillow: Denial of Service via crafted multi-frame image conversion (CVE-2026-112894)
    * python3.12-pillow: pillow: Denial of service via crafted PDF during append operations (CVE-2026-112895)
    * python3.12-pillow: Pillow: Denial of Service via out-of-bounds read in TIFF encoder (CVE-2026-112896)
    * python3.12-pillow: pillow: Information disclosure via uninitialized buffer in TIFF decoding     (CVE-2026-112897)
    * python-gitpython: GitPython: Arbitrary file read vulnerability via `Repo.archive()` (CVE-2026-73619)
    * python3.12-gitpython: GitPython: Arbitrary Code Execution via Path Traversal (CVE-2026-78677)
    * python3.12-gitpython: GitPython: Denial of Service via crafted commit author field (CVE-2026-87819)
    * python3.12-gitpython: GitPython: Denial of Service via regular expression backtracking in date parsing     (CVE-2026-110856)
    * python3.12-gitpython: GitPython: Arbitrary code execution via unsafe URL protocol handling     (CVE-2026-110857)
    * python3.12-gitpython: GitPython 3.1.30 before 3.2.0 Command Injection via Remote.pull() Refspec     (CVE-2026-110858)
    * python3.12-gitpython: GitPython: Arbitrary file read via argument injection in branch checkout     (CVE-2026-110859)
    * python3.12-gitpython: GitPython: arbitrary code execution via improper submodule path validation     (CVE-2026-114145)
    * openvox-agent: integer overflow issue in regular expression compiler (CVE-2026-110264)
    * openvox-agent: integer overflow issue in CI/CD regular expression compiler (CVE-2026-97229)
    * openvox-agent: integer overflow issue in regular expression compiler (CVE-2026-93577)
    * openvox-agent: double free issue in regular expression parser (CVE-2026-89078)
    * openvox-server: jackson-dataformat-smile: Denial of Service via unbounded memory allocation in     asynchronous parser (CVE-2026-104895)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of SolarWinds DameWare Mini Remote Control installed on the remote host is prior to 2026.3.1. It is, therefore, affected by multiple vulnerabilities as referenced in the Dameware 2026.3.1 release notes.

  - A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through     1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory,     disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a     crafted Brotli-compressed stream. (CVE-2026-111497)

  - SolarWinds Dameware was found to be affected by a command injection vulnerability that could lead to the     compromise of the remotely controlled host. Authentication is required. (CVE-2026-28336)

  - SolarWinds Dameware was found to be affected by a buffer overflow vulnerability that can result in remote code     execution. Authentication is required. (CVE-2026-28335)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apple iOS running on the mobile device is prior to 26.7.3. It is, therefore, affected by multiple vulnerabilities.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
375645	Kibana 8.x < 8.19.24 / 9.0.x < 9.4.9 / 9.5.x < 9.5.6 RCE (ESA-2026-232)	Nessus	CGI abuses	2026/11/3	2026/11/5	critical
375743	Fedora 44 : mingw-qt5-qtwebkit (2026-a336a99528)	Nessus	Fedora Local Security Checks	2026/11/4	2026/11/5	critical
376176	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Brotli vulnerability (USN-8956-2)	Nessus	Ubuntu Local Security Checks	2026/11/4	2026/11/5	critical
376263	SUSE SLES15 Security Update : nodejs22 (SUSE-SU-2026:5036-1)	Nessus	SuSE Local Security Checks	2026/11/5	2026/11/6	critical
376918	RHEL 9 : Satellite 6.18 (RHSA-2026:95657)	Nessus	Red Hat Local Security Checks	2026/11/6	2026/11/9	critical
377037	SolarWinds DameWare Mini Remote Control < 2026.3.1 Multiple Vulnerabilities	Nessus	Windows	2026/11/6	2026/11/9	critical
377977	Apple iOS < 26.7.3 Multiple Vulnerabilities (149716)	Nessus	Mobile Devices	2026/11/9	2026/11/11	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical