The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_28247 advisory.

    * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API     (CVE-2026-4786)

    * python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module (CVE-2026-6019)

    Bug Fix(es) and Enhancement(s):

    * [9.8.z]Update python3.14 to 3.14.5 for the incremental GC changes (JIRA:Rocky Linux-180642)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150501 advisory.

    Mitgation ofCVE-2026-4519 was incomplete. If the URL contained %action the mitigation could be     bypassed for certain browser types the webbrowser.open() API could have commands injected into the     underlying shell. SeeCVE-2026-4519 for details.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-dfc9182263 advisory.

    New Python version including bugfixes and security fixes.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1818-1 advisory.

    Security issues fixed:

    - CVE-2026-1502: HTTP client proxy tunnel headers not validated for CR/LF (bsc#1261969).
    - CVE-2026-3446: base64 decoding stops at first padded quad by default and ignores other information that     could be       processed (bsc#1261970).
    - CVE-2026-3479: improper resource argument validation in `pkgutil.get_data()` can lead to path traversal     (bsc#1259989).
    - CVE-2026-4786: URLs prefixed with `%action` can pass the dash-prefix safety check and allow for command     injection       (bsc#1262319).
    - CVE-2026-6019: `BaseCookie.js_output()` does not neutralize characters in cookie values embedded in JS     (bsc#1262654).
    - CVE-2026-6100: use-after-free in `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile`     when process is       under memory pressure(bsc#1262098).

    Other updates and bugfixes:

    - Rewrite structure of Python interpreter packages. `python3*` symbols should be now provided by real     python3 packages       and its subpackages instead of the virtual provides (bsc#1258364).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
357533	Rocky Linux 9 [CIQ] Security Update: python3.14 / python3.14-debug / python3.14-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_28247)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	high
376605	Unity Linux 20.1070a Security Update: python3.11 (UTSA-2026-150501)	Nessus	Unity Linux Local Security Checks	2026/11/5	2026/11/5	high
321848	Fedora 44 : python3.13 (2026-dfc9182263)	Nessus	Fedora Local Security Checks	2026/6/21	2026/6/21	critical
315056	SUSE SLES15 Security Update : python39 (SUSE-SU-2026:1818-1)	Nessus	SuSE Local Security Checks	2026/5/16	2026/5/19	critical

检测

插件搜索

high

high

critical

critical