The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0638 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2026-39821:
    The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-     only label. For example, ToUnicode(xn--example-.com) incorrectly returns the name example.com rather     than an error. This behavior can lead to privilege escalation in programs using the idna package. For     example, a program which performs privilege checks on the ASCII hostname may reject example.com but     permit xn--example-.com. If that program subsequently converts the ASCII hostname to Unicode, it will     inadvertently permits access to the Unicode name example.com.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0637 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2026-39821:
    The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-     only label. For example, ToUnicode(xn--example-.com) incorrectly returns the name example.com rather     than an error. This behavior can lead to privilege escalation in programs using the idna package. For     example, a program which performs privilege checks on the ASCII hostname may reject example.com but     permit xn--example-.com. If that program subsequently converts the ASCII hostname to Unicode, it will     inadvertently permits access to the Unicode name example.com.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:35827 advisory.

    * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label     processing (CVE-2026-39821)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21432-1 advisory.

    Changes in gh:

    - CVE-2026-39821: reject all-ASCII xn-- Punycode labels in the vendored       golang.org/x/net/idna package regardless of Go's unicode.Version (boo#1266618).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3432-1 advisory.

    This update for google-osconfig-agent fixes the following issues

    - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for     validation       bypass and privilege escalation (bsc#1266603).
    - CVE-2026-56852: golang.org/x/text/unicode/norm: improper handling of input containing invalid UTF-8     bytes can lead       to infinite loop (bsc#1272118).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21480-1 advisory.

    - CVE-2026-5160: github.com/yuin/goldmark/renderer: Cross-site Scripting due to improper URL validation     (bsc#1272488).
    - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for     validation       bypass and privilege escalation (bsc#1266572).
    - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input     (bsc#1272131).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:51112 advisory.

    Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &     OpenTSDB.

    Security Fix(es):

    * golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect     Punycode label processing (CVE-2026-39821)

    * golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass     (CVE-2026-27136)

    * golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting     (CVE-2026-25681)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3528-1 advisory.

    Update to 10.32.6.

    Security issues fixed:

    - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for     validation       bypass and privilege escalation (bsc#1266657).
    - CVE-2026-56852: golang.org/x/text/unicode/norm: improper handling of truncated/invalid UTF-8 input can     lead to       infinite loop (bsc#1272123).

    Other updates and bugfixes:

    - Version 10.32.6:
      * Run go mod tidy
      * Merge tag 'v10.32.4' into release/fips
      * Merge remote-tracking branch 'origin/wendi/10.32.5' into release/fips
      * Merge branch 'main' into wendi/10.32.5
      * TASK 38260338: Updated the release pipeline to produce Linux builds         capable of complying with the FIPS 140-3 standard. (#3488)
      * Bump Go toolchain and security-relevant dependencies (#3486)
      * stylistic changes from copilot :)
    - Update golang.org/x/text to v0.40.0
    - Update golang.org/x/net to v0.57.0
    - Version 10.32.5:
      * Create new patch release
      * Merge branch 'main' into seanmcc/bump-deps-2026-06
      * Ensure get/set ACLs are on URLs with paths (#3453)
      * Print out help command on just `azcopy` (#3485)
      * Bump Go toolchain and security-relevant dependencies
      * Centralize HTTP client into a shared global instance (#3436)
      * Remove 0-padding in mode with SetUID (#3467)
      * Updated trivy dependency to known safe version (#3421)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:56223 advisory.

    The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries     and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards.

    Security Fix(es):

    * golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect     Punycode label processing (CVE-2026-39821)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:56143 advisory.

    The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries     and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards.

    Security Fix(es):

    * golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect     Punycode label processing (CVE-2026-39821)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21069-1 advisory.

    This update for google-guest-agent fixes the following issues

    - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2     :path pseudo-       header (bsc#1260264).
    - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for     validation       bypass and privilege escalation (bsc#1266603).
    - CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh     (bsc#1266171).
    - CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266171).
    - CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh     (bsc#1266171).
    - CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in     golang.org/x/crypto/ssh       (bsc#1266171).
    - CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in     golang.org/x/crypto/ssh       (bsc#1266171).
    - CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent       (bsc#1266171).
    - CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266171).
    - CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266171).
    - CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh     (bsc#1266171).
    - CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in     golang.org/x/crypto/ssh/knownhosts       (bsc#1266171).
    - CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in     golang.org/x/crypto/ssh       (bsc#1266171).
    - CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh     (bsc#1266171).
    - CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent     (bsc#1266171).

    Changes for google-guest-agent:

    - Update to version 20260529.00
     * Dependency updates (#616)
    - from version 20260522.00
     * Fix improper umask calculation on socket creation (#614)
    - from version 20260520.01
     * Update OWNERS (#609)
     * Bump google.golang.org/grpc from 1.75.0 to 1.79.3 (#602) (bsc#1260264, CVE-2026-33186)
    - Update to version 20250506.01 (bsc#1243254, bsc#1243505)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21210-1 advisory.

    This update for google-osconfig-agent fixes the following issues

    - CVE-2023-45288: golang.org/x/net/http2: close connections when receiving too many headers.
    - CVE-2025-47911: golang.org/x/net/html: various algorithms with quadratic complexity when parsing HTML     documents       (bsc#1251453).
    - CVE-2025-58190: golang.org/x/net/html: excessive memory consumption by `html.ParseFragment` when     processing specially       crafted input (bsc#1251704).
    - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2     :path pseudo-       header (bsc#1260264).
    - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad     SETTINGS_MAX_FRAME_SIZE       (bsc#1265762).
    - CVE-2026-34986: github.com/go-jose/go-jose/v4: crafted JWE input with a missing encrypted key can lead     to a denial of       service (bsc#1262926).
    - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for     validation       bypass and privilege escalation (bsc#1266603).
    - CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh     (bsc#1266171).
    - CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266171).
    - CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh     (bsc#1266171).
    - CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in     golang.org/x/crypto/ssh       (bsc#1266171).
    - CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in     golang.org/x/crypto/ssh       (bsc#1266171).
    - CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent       (bsc#1266171).
    - CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266171).
    - CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266171).
    - CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh     (bsc#1266171).
    - CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in     golang.org/x/crypto/ssh/knownhosts       (bsc#1266171).
    - CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in     golang.org/x/crypto/ssh       (bsc#1266171).
    - CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh     (bsc#1266171).
    - CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent     (bsc#1266171).
    - CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following     redirects during       smart-HTTP clone and fetch operations (bsc#1264923).

    Changes for google-osconfig-agent:

    - Update to version 20260615.01
     * Upgrade golang.org/x/crypto & golang.org/x/net (#1006)
    - from version 20260615.00
     * Add unit tests for ospatch_apt_upgrade.go (#938)
    - Update to version 20260611.00
     * Add unit tests for policies/policies.go PART 5 (#998)
    - from version 20260610.00
     * Add unit tests for policies/policies.go PART 4 (#997)
    - from version 20260609.02
     * squash commits (#936)
    - from version 20260609.01
     * Add unit tests for policies/policies.go PART 3 (#996)
    - from version 20260609.00
     * Add unit tests for policies/policies.go PART 2 (#991)
    - from version 20260602.01
     * Align format of dates and timestamp collected across Windows packages (#973)
    - from version 20260602.00
     * Add unit tests for config/config,go (#979)
    - from version 20260528.00
     * Bump github.com/containerd/containerd (#990)
    - from version 20260521.00
     * Cover agentconfig functionality by unit tests (#925)
    - from version 20260520.04
     * Add unit tests for policies/googet.go (#961)
     * Bump github.com/go-git/go-git/v5 (#987)
    - from version 20260520.02
     * Add unit tests for policies/yum.go (#952)
     * Add unit tests for policies/apt.go PART 3 (#951)
    - from version 20260520.00
     * Add unit tests for policies/zypper.go (#953)
    - from version 20260519.00
     * Add unit tests for policies/policies.go PART 1 (#949)
    - from version 20260513.01
     * Bump github.com/go-git/go-git/v5 (#981), this also updates      golang.org/x/net to v0.53.0 (bsc#1265762, CVE-2026-33814)
    - from version 20260513.00
     * upgrade a few packages (#980)
    - from version 20260512.02
     * Add/improve unit tests for agentendpoint/exec_task.go (#933)
    - from version 20260512.01
     * Cover google_update.go by unit tests (#941)
    - from version 20260512.00
     * Change zone for arm64 builds because of stockout (#978)
    - Update to version 20260511.00
     * switch to t2a-standard-2 on ARM package build (#977)
    - from version 20260505.03
     * Cover zypper_patch by unit tests (#958)
    - from version 20260505.02
     * Remove unused functions DisableAutoUpdates (#970)
    - from version 20260505.01
     * Bump go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc (#966)
    - from version 20260505.00
     * Upgrade a few dependencies across the repo (#968)      + github.com/go-git/go-git/v5 5.16.2->5.18.0 (bsc#1264923, CVE-2026-41506)      + github.com/go-jose/go-jose/v4 4.1.3->4.1.4 (bsc#1262926, CVE-2026-34986)      + github.com/go-viper/mapstructure/v2 2.3.0->2.4.0      + go.opentelemetry.io/otel 1.40.0->1.41.0      + go.opentelemetry.io/otel/sdk 1.39.0->1.43.0
    - from version 20260504.01
     * bump github.com/docker/cli to 29.2.0 (#962)
    - from version 20260504.00
     * Bump github.com/opencontainers/selinux (#960)
    - Update to version 20260428.00
     * Add/improve unit tests for agentendpoint/agentendpoint.go (#930)
    - from version 20260427.03
     * Cover config/file.go by unit tests (#935)
    - from version 20260422.01
     * Cover patch_linux.go by unit tests (#932)
    - from version 20260422.00
     * upgrade grpc package in main package and e2e tests (#959)      (bsc#1260264, CVE-2026-33186)
    - from version 20260417.04
     * Bump OSV-Scalibr version to v0.4.3 (#956)
    - from version 20260417.03
     * Add unit tests for updates_linux.go (#937)
    - from version 20260417.02
     * Add zone to CreateDisk step (#955)
    - from version 20260417.01
     * Change disk type for deb11 (#954)
    - from version 20260417.00
     * Add unit tests for policies/apt.go PART 1 (#950)
    - from version 20260410.02
     * Add unit tests for packages/pty_linux.go (#943)
    - from version 20260410.01
     * fix disk type for arm workflows (#948)
    - from version 20260410.00
     * Change machine type for arm based workflows (#946)
    - Update to version 20260330.00
     * bump timeouts for all workflows (#940)
    - from version 20260326.00
     * Cover exec_resource.go by unit tests (#934)
    - from version 20260318.00
     * Integrate OSConfig agent with ReportVmInventory (#923)
    - from version 20260313.02
     * remove cacheonly flag from yum upgrade (#924)
    - from version 20260313.01
     * conditions python version override (#927)
    - from version 20260313.00
     * Fix presubmits by explicitly set python version for rpm based systems (#926)
    - from version 20260311.00
     * Bump osconfig version (#922)
    - from version 20260309.02
     * Extend OSV scalibr extractor (#921)
    - from version 20260309.01
     * upgrade golang.org/x/crypto and it's transitive deps (#918)
    - from version 20260309.00
     * Add purl to pkg info (#920)
    - from version 20260306.00
     * Add 'Type' field to PkgInfo (#919)
    - from version 20260303.01
     * Upgrade go.opentelemetry.io/otel/sdk (#913)
    - from version 20260303.00
     * Bump github.com/vbatts/tar-split from 0.11.5 to 0.12.2 (#908)
    - from version 20260302.00
     * Bump github.com/spdx/tools-golang from 0.5.3 to 0.5.7 (#906)
    - from version 20260126.00
     * Bump go.opentelemetry.io/otel/sdk from 1.38.0 to 1.39.0 (#905)
     * Bump github.com/sirupsen/logrus (#894)
    - Update to version 20260119.00
     * Bump cloud.google.com/go/storage from 1.56.0 to 1.58.0 (#899)
    - Update to version 20251230.00
     * chore: Migrate gsutil usage to gcloud storage (#904)
    - from version 20251223.00
     * fix e2e tests for report inventory (#903)
    - from version 20251222.01
     * Revert Bump cloud.google.com/go/longrunning from 0.6.3 to 0.7.0 (#882) (#902)
    - from version 20251222.00
     * Bump golang to the new version (#900)
    - from version 20251218.00
     * add new CODEOWNERS (#901)
    - from version 20251217.00
     * Bump cloud.google.com/go/longrunning from 0.6.3 to 0.7.0 (#882)
    - Bump the golang compiler version to 1.24.5
    - Update to version 20251202.00
     * Revert Bump github.com/spdx/tools-golang from 0.5.3 to 0.5.5 (#887) (#893)
    - Update to version 20251201.00
     * Revert Bump github.com/containerd/containerd (#890) (#892)
    - Update to version 20251126.00
     * Bump github.com/containerd/containerd (#890)
     * Bump github.com/spdx/tools-golang from 0.5.3 to 0.5.5 (#887)
    - Update to version 20251028.00
     * Bump go.opentelemetry.io/otel/sdk/metric from 1.35.0 to 1.38.0 (#886)
     * Bump github.com/tidwall/pretty from 1.2.0 to 1.2.1 (#880)
    - from version 20251023.02
     * Create multiple_os.yaml (#883)
    - from version 20251023.00
     * Bump github.com/docker/go-connections from 0.4.0 to 0.6.0 (#877)
     * Add test runner for e2e tests (#876)
    - Update to version 20250925.00
     * Bump cloud.google.com/go/auth/oauth2adapt from 0.2.7 to 0.2.8 (#870)
     * Bump google.golang.org/protobuf from 1.36.6 to 1.36.9 (#874)
     * Bump go.opentelemetry.io/otel from 1.35.0 to 1.38.0 (#872)
     * Bump github.com/golang/glog from 1.2.4 to 1.2.5 (#830)
    - Update to version 20250902.01
     * Bump github.com/googleapis/enterprise-certificate-proxy (#829)
    - from version 20250902.00
     * update github.com/go-jose/go-jose/v4 (#869)
     * Upgrade scalibr and other deps (#866)
    - from version 20250901.00
     * Fix possibility of path traversal for zip and tar archival (#868)
    - from version 20250825.00
     * set CODEOWNERS file as required by org (#863)
    - from version 20250819.00
     * Fix/rhel10 build centos image (#860)
    - from version 20250814.00
     * Fix/rhel10 build image (#859)
    - from version 20250813.00
     * Fix: Add RHEL 10 support to RPM startup script (#858)
    - from version 20250811.00
     * Remove old/sles-15-sp4-sap as image is deprecated (#857)
    - Update to version 20250806.00
     * Fixed JSON identifier for the universe domain (#855)
    - from version 20250729.00
     * Bump github.com/google/s2a-go from 0.1.8 to 0.1.9 (#828)
    - from version 20250725.02
     * Update utils.go (#854)
     * Upgrade golang.org/x/oauth2 package to the latest. (#853)
     * Bump golang.org/x/time from 0.9.0 to 0.12.0 (#839)
    - from version 20250725.01
     * Bump golang.org/x/oauth2 (#848)
     * Port fix for debian 11 to goo package manager. (#852)
    - from version 20250725.00
     * Update Golang version in common.sh and skip backports      repo for debian 11 (#850)
    - from version 20250723.01
     * Add workflows to build package for el10 (#849)
    - from version 20250721.00
     * Make OS Config agent TPC aware (#846)
    - from version 20250718.00
     * Create workflows for new Debian 13. (#847)
    - Update to version 20250703.00
     * Fix sles images (#844)
    - from version 20250702.00
     * Remove rhel-sap 8-4 add rhel-sap 8-10 (#843)
    - from version 20250701.00
     * Bump the go_modules group across 1 directory with 2 updates (#840)
    - Update to version 20250606.00
     * Change base docker images Google's official base images. (#838)
    - Update to version 20250523.01
     * Add a simple no-op OS policy for user testing (#837)
    - from version 20250523.00
     * Introduce scalibr inventory extractor for dpkg/rpm/cos      os/filesystem extractors (linux) (#834)
     * Trace GetInstalledPackages memory levels (#835)
    - from version 20250520.00
    - Update to version 20250513.00
     * Fix rpm extractor, handle (none) value correctly. (#833)
    - from version 20250512.01
     * Bump github.com/envoyproxy/go-control-plane from 0.13.1 to 0.13.4 (#816)
    - from version 20250512.00
     * Bump golang.org/x/net from 0.39.0 to 0.40.0 (#819)
    - from version 20250508.01
     * cosmetic refactoring to osinfo package (#826)
    - from version 20250508.00
     * Refactor /inventory with dependency injection (#825)
     * Add debian, ubuntu (InstalledDebPackages) snapshots (#821)
     * cover packages_linux.go file with tests (#824)
     * Add debian (10,11,12) GetPackageUpdates output snapshots (#822)
    - from version 20250507.00
     * Add InstalledRPMPackages snapshot tests (#823)
    - from version 20250506.02
     * Yum tests: simplify initialization of exit errors (#820)
    - from version 20250506.01
     * Improve test coverage for gem package manager (#818)
    - from version 20250506.00
     * after go/x/crypto update 0.32.0 -> 0.37.0 (#817)
    - from version 20250505.01
     * Improve packages package coverage (#814)
     * Bump golang.org/x/net from 0.34.0 to 0.39.0 (#807)
    - from version 20250505.00
     * Bump golang.org/x/crypto from 0.32.0 to 0.37.0 (#806)
    - from version 20250430.00
     * Snapshot YumUpdates (GetPackageUpdates) output (#813)
    - from version 20250428.00
     * Snapshot ZypperPatches, ZypperUpdates (GetPackageUpdates) output      for sles 12, 15 testdata (#812)
    - from version 20250423.00
     * Introduce MatchSnapshot large test results matcher function, snapshot      apt-deb GetPackageUpdates (#811)
    - from version 20250416.02

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:36796 advisory.

    Red Hat Edge Manager (RHEM) provides simple, scalable, and security-focused     management of edge devices and applications. It supports image-mode RHEL and     container workloads that run on Podman/Docker or Kubernetes.

    RHEM is now available as a standalone feature, providing greater flexibility for     edge deployments. In addition to the standalone version, RHEM continues to be     offered as a plugin for the following platforms:

    Red Hat Advanced Cluster Management (RHACM): Extends fleet management to edge     devices.
    Red Hat Ansible Automation Platform (AAP): Integrates edge management with     Ansible automation.

    This integration enables organizations to optimize the management and     orchestration of their fleets of edge devices; whether its thousands of     dispersed retail point-of-sale systems or industrial machinery on remote factory     floors.

    Value for customers and partners:

    * This solution not only helps customers manage thousands of devices but helps     scale operations.
    * To manage large-scale deployments, customers need to be able to integrate with     their existing management systems, support remote configuration and over-the-air     updates, and collect telemetry data for advanced analytics.
    * Red Hat Edge Manager offers a simple and security-focused lifecycle     management, from onboarding to decommissioning of edge devices.

    This complete end-to-end solution empowers organizations to gain the most value     from the fleets of devices that generate data, all from a centralized location.

    Security fixes:

    * golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate (CVE-2026-39835)
    * golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses     (CVE-2026-39830)
    * golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters     (CVE-2026-39829)
    * golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions (CVE-2026-39828)
    * golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation (CVE-2026-46595)
    * golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions     (CVE-2026-39832)
    * golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey (CVE-2026-42508)
    * golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)
    * Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)
    * Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281)
    * Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application     (CVE-2026-33810)
    * Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)
    * Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)
    * Go crypto/x509: Incorrect enforcement of email constraints (CVE-2026-27137)
    * Go net/url: Incorrect parsing of IPv6 host literals (CVE-2026-25679)
    * golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729)
    * github.com/jackc/pgx: Memory-safety vulnerability (CVE-2026-33815)
    * github.com/jackc/pgx: Memory-safety vulnerability (CVE-2026-33816)
    * gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186)
    * Prometheus: Information disclosure of Azure OAuth client secret via config API (CVE-2026-42151)
    * Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint     (CVE-2026-42154)
    * Root.Chmod can follow symlinks out of the root (CVE-2026-32282)
    * Kubelet, CRI-O, kube-apiserver: Denial of Service via SPDY streaming code (CVE-2026-35469)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Golang running on the remote host is 1.25.x prior to 1.25.13, or 1.26.x prior to 1.26.6. It is, therefore, affected by multiple vulnerabilities in the standard library and the toolchain, as referenced in the golang-announce advisory.

  - The ToASCII and ToUnicode functions incorrectly accepted Punycode-encoded labels that decode to an     ASCII-only label. This can lead to privilege escalation in programs using the idna package.
    (CVE-2026-39821)

  - When a server is configured to support unencrypted HTTP/2, it reads bytes from each new connection     to check for the HTTP/2 client preface. Previously this was done with no timeout. ReadHeaderTimeout     is now applied for this check. (CVE-2026-56853)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
328398	TencentOS Server 3: grafana (TSSA-2026:0638)	Nessus	Tencent Local Security Checks	2026/7/20	2026/7/20	high
328414	TencentOS Server 3: git-lfs (TSSA-2026:0637)	Nessus	Tencent Local Security Checks	2026/7/20	2026/7/20	high
328976	AlmaLinux 10 : grafana (ALSA-2026:35827)	Nessus	Alma Linux Local Security Checks	2026/7/22	2026/7/22	high
329719	openSUSE 16 Security Update : gh (openSUSE-SU-2026:21432-1)	Nessus	SuSE Local Security Checks	2026/7/25	2026/7/25	high
331546	SUSE SLES15 Security Update : google-osconfig-agent (SUSE-SU-2026:3432-1)	Nessus	SuSE Local Security Checks	2026/8/1	2026/8/1	high
331569	openSUSE 16: mcphost / mcphost-bash-completion / mcphost-fish-completion / etc (openSUSE-SU-2026:21480-1)	Nessus	SuSE Local Security Checks	2026/8/1	2026/8/1	medium
333118	RHEL 9 : grafana (RHSA-2026:51112)	Nessus	Red Hat Local Security Checks	2026/8/6	2026/8/6	high
333545	SUSE SLES15 Security Update : azure-storage-azcopy (SUSE-SU-2026:3528-1)	Nessus	SuSE Local Security Checks	2026/8/9	2026/8/9	high
337676	RHEL 9 : grafana-pcp (RHSA-2026:56223)	Nessus	Red Hat Local Security Checks	2026/8/18	2026/8/18	high
337678	RHEL 10 : grafana-pcp (RHSA-2026:56143)	Nessus	Red Hat Local Security Checks	2026/8/18	2026/8/18	high
324053	openSUSE 16 Security Update : google-guest-agent (openSUSE-SU-2026:21069-1)	Nessus	SuSE Local Security Checks	2026/7/1	2026/7/1	critical
325024	openSUSE 16 Security Update : google-osconfig-agent (openSUSE-SU-2026:21210-1)	Nessus	SuSE Local Security Checks	2026/7/3	2026/7/9	high
325733	RHEL 9 : Red Hat Edge Manager Version 1.0.3 Security Update (Important) (RHSA-2026:36796)	Nessus	Red Hat Local Security Checks	2026/7/9	2026/8/4	high
335411	Golang 1.25.x < 1.25.13 / 1.26.x < 1.26.6 Multiple Vulnerabilities	Nessus	Misc.	2026/8/14	2026/8/20	critical

检测

插件搜索

high

high

high

high

high

medium

high

high

high

high

critical

high

high

critical