The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:20609 advisory.

    The skopeo command lets you inspect images from container image registries, get images and image layers,     and use signatures to create and verify files.

    Security Fix(es):

    * github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted     JSON Web Encryption (JWE) object (CVE-2026-34986)

    * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages     (CVE-2026-32283)

    * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building     (CVE-2026-32280)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:20569 advisory.

    The buildah package provides a tool for facilitating building OCI container images. Among other things,     buildah enables you to: Create a working container, either from scratch or using an image as a starting     point; Create an image, either from a working container or using the instructions in a Dockerfile; Build     both Docker and OCI images.

    Security Fix(es):

    * github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted     JSON Web Encryption (JWE) object (CVE-2026-34986)

    * crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation     (CVE-2026-32281)

    * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages     (CVE-2026-32283)

    * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building     (CVE-2026-32280)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:20607 advisory.

    The buildah package provides a tool for facilitating building OCI container images. Among other things,     buildah enables you to: Create a working container, either from scratch or using an image as a starting     point; Create an image, either from a working container or using the instructions in a Dockerfile; Build     both Docker and OCI images.

    Security Fix(es):

    * github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted     JSON Web Encryption (JWE) object (CVE-2026-34986)

    * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages     (CVE-2026-32283)

    * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building     (CVE-2026-32280)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0671 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2026-25679:
    url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.

    CVE-2026-32280:
    During chain building, the amount of work that is done is not correctly limited when a large number of     intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of     service. This affects both direct users of crypto/x509 and users of crypto/tls.

    CVE-2026-32281:
    Validating certificate chains which use policies is unexpectedly inefficient when certificates in the     chain contain a very large number of policy mappings, possibly causing denial of service. This only     affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots     CertPool, or in the system certificate pool.

    CVE-2026-32283:
    If one side of the TLS connection sends multiple key update messages post-handshake in a single record,     the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of     service. This only affects TLS 1.3.

    CVE-2026-34986:
    Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go,     including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT)     standards. Prior to 4.1.4 and 3.0.5, decrypting a JSON Web Encryption (JWE) object will panic if the alg     field indicates a key wrapping algorithm (one ending in KW, with the exception of A128GCMKW, A192GCMKW,     and A256GCMKW) and the encrypted_key field is empty. The panic happens when cipher.KeyUnwrap() in     key_wrap.go attempts to allocate a slice with a zero or negative length based on the length of the     encrypted_key. This code path is reachable from ParseEncrypted() / ParseEncryptedJSON() /     ParseEncryptedCompact() followed by Decrypt() on the resulting object. Note that the parse functions take     a list of accepted key algorithms. If the accepted key algorithms do not include any key wrapping     algorithms, parsing will fail and the application will be unaffected. This panic is also reachable by     calling cipher.KeyUnwrap() directly with any ciphertext parameter less than 16 bytes long, but calling     this function directly is less common. Panics can lead to denial of service. This vulnerability is fixed     in 4.1.4 and 3.0.5.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:29455 advisory.

    The buildah package provides a tool for facilitating building OCI container images. Among other things,     buildah enables you to: Create a working container, either from scratch or using an image as a starting     point; Create an image, either from a working container or using the instructions in a Dockerfile; Build     both Docker and OCI images.

    Security Fix(es):

    * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

    * crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation     (CVE-2026-32281)

    * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages     (CVE-2026-32283)

    * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building     (CVE-2026-32280)

    * golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with     excessive parameters (CVE-2026-39829)

    * golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited     SSH responses (CVE-2026-39830)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-29455 advisory.

    - Rebuild for CVE-2026-25679

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:39810 advisory.

    Security Fix(es):

    * net/url: Memory exhaustion in query parameter parsing in net/url     (CVE-2025-61726)

    * golang: Denial of Service due to excessive resource consumption via     crafted certificate (CVE-2025-61729)

    * Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

    * Incorrect enforcement of email constraints in crypto/x509     (CVE-2026-27137)

    * crypto/tls: golang: Go: Denial of Service vulnerability in certificate     chain building (CVE-2026-32280)

    * golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update     messages (CVE-2026-32283)

    * golang: Go crypto/x509: Certificate validation bypass due to incorrect     DNS constraint application (CVE-2026-33810)

    * golang: Go net package: Denial of Service via long CNAME response in     LookupCNAME (CVE-2026-33811)

    * golang: Go crypto/x509: Denial of Service via inefficient certificate     chain validation (CVE-2026-32281)

    * internal/syscall/unix: Root.Chmod can follow symlinks out of the root     (CVE-2026-32282)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:28047 advisory.

    etcd is a highly-available key value store for shared configuration.

    Security Fix(es):

    * net/url: Memory exhaustion in query parameter parsing in net/url     (CVE-2025-61726)

    * golang: Denial of Service due to excessive resource consumption via     crafted certificate (CVE-2025-61729)

    * Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

    * Incorrect enforcement of email constraints in crypto/x509     (CVE-2026-27137)

    * crypto/tls: golang: Go: Denial of Service vulnerability in certificate     chain building (CVE-2026-32280)

    * golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update     messages (CVE-2026-32283)

    * google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to     improper HTTP/2 path validation (CVE-2026-33186)

    * golang: Go crypto/x509: Certificate validation bypass due to incorrect     DNS constraint application (CVE-2026-33810)

    * crypto/tls: Incorrect certificate validation during TLS session     resumption (CVE-2025-68121)

    * internal/syscall/unix: Root.Chmod can follow symlinks out of the root     (CVE-2026-32282)

    * etcd: Authorization bypass allows information disclosure and denial of     service (CVE-2026-33413)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:36796 advisory.

    Red Hat Edge Manager (RHEM) provides simple, scalable, and security-focused     management of edge devices and applications. It supports image-mode RHEL and     container workloads that run on Podman/Docker or Kubernetes.

    RHEM is now available as a standalone feature, providing greater flexibility for     edge deployments. In addition to the standalone version, RHEM continues to be     offered as a plugin for the following platforms:

    Red Hat Advanced Cluster Management (RHACM): Extends fleet management to edge     devices.
    Red Hat Ansible Automation Platform (AAP): Integrates edge management with     Ansible automation.

    This integration enables organizations to optimize the management and     orchestration of their fleets of edge devices; whether its thousands of     dispersed retail point-of-sale systems or industrial machinery on remote factory     floors.

    Value for customers and partners:

    * This solution not only helps customers manage thousands of devices but helps     scale operations.
    * To manage large-scale deployments, customers need to be able to integrate with     their existing management systems, support remote configuration and over-the-air     updates, and collect telemetry data for advanced analytics.
    * Red Hat Edge Manager offers a simple and security-focused lifecycle     management, from onboarding to decommissioning of edge devices.

    This complete end-to-end solution empowers organizations to gain the most value     from the fleets of devices that generate data, all from a centralized location.

    Security fixes:

    * golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate (CVE-2026-39835)
    * golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses     (CVE-2026-39830)
    * golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters     (CVE-2026-39829)
    * golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions (CVE-2026-39828)
    * golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation (CVE-2026-46595)
    * golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions     (CVE-2026-39832)
    * golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey (CVE-2026-42508)
    * golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)
    * Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)
    * Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281)
    * Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application     (CVE-2026-33810)
    * Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)
    * Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)
    * Go crypto/x509: Incorrect enforcement of email constraints (CVE-2026-27137)
    * Go net/url: Incorrect parsing of IPv6 host literals (CVE-2026-25679)
    * golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729)
    * github.com/jackc/pgx: Memory-safety vulnerability (CVE-2026-33815)
    * github.com/jackc/pgx: Memory-safety vulnerability (CVE-2026-33816)
    * gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186)
    * Prometheus: Information disclosure of Azure OAuth client secret via config API (CVE-2026-42151)
    * Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint     (CVE-2026-42154)
    * Root.Chmod can follow symlinks out of the root (CVE-2026-32282)
    * Kubelet, CRI-O, kube-apiserver: Denial of Service via SPDY streaming code (CVE-2026-35469)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:49838 advisory.

    A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild     under the hood. Besides building images for local usage, it can also upload images directly to cloud.  It     is compatible with composer-cli and cockpit-composer clients.

    Security Fix(es):

    * crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation     (CVE-2026-32281)

    * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building     (CVE-2026-32280)

    Bug Fix(es) and Enhancement(s):

    * bootupctl backend install --auto fails bootupd EFI metadata missing (JIRA:RHEL-185745)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:49600 advisory.

    rhc is a client tool and daemon that connects the system to Red Hat hosted services enabling system and     subscription management.

    Security Fix(es):

    * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

    * crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation     (CVE-2026-32281)

    * golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)

    * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages     (CVE-2026-32283)

    * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building     (CVE-2026-32280)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
316749	RHEL 9 : skopeo (RHSA-2026:20609)	Nessus	Red Hat Local Security Checks	2026/5/26	2026/5/26	high
316762	RHEL 10 : buildah (RHSA-2026:20569)	Nessus	Red Hat Local Security Checks	2026/5/26	2026/5/26	high
317092	RHEL 9 : buildah (RHSA-2026:20607)	Nessus	Red Hat Local Security Checks	2026/5/27	2026/5/27	high
328404	TencentOS Server 3: container-tools:rhel8 (TSSA-2026:0671)	Nessus	Tencent Local Security Checks	2026/7/20	2026/7/20	high
322553	RHEL 9 : buildah (RHSA-2026:29455)	Nessus	Red Hat Local Security Checks	2026/6/24	2026/6/24	high
322885	Oracle Linux 9 : buildah (ELSA-2026-29455)	Nessus	Oracle Linux Local Security Checks	2026/6/26	2026/6/26	high
327031	RHEL 9 : Red Hat OpenStack Services on OpenShift 18.0 (golang-github-openstack-k8s-operators-os-diff) (RHSA-2026:39810)	Nessus	Red Hat Local Security Checks	2026/7/15	2026/7/15	high
322151	RHEL 9 : Red Hat OpenStack Platform 17.1 (etcd) (RHSA-2026:28047)	Nessus	Red Hat Local Security Checks	2026/6/23	2026/6/23	high
325733	RHEL 9 : Red Hat Edge Manager Version 1.0.3 Security Update (Important) (RHSA-2026:36796)	Nessus	Red Hat Local Security Checks	2026/7/9	2026/8/4	high
331939	RHEL 9 : osbuild-composer (RHSA-2026:49838)	Nessus	Red Hat Local Security Checks	2026/8/4	2026/8/4	high
331697	RHEL 9 : rhc (RHSA-2026:49600)	Nessus	Red Hat Local Security Checks	2026/8/3	2026/8/3	critical

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

critical