The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:22789 advisory.

    * webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS     (CVE-2025-13502)
      * webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2023-43000)
      * webkitgtk: A website may exfiltrate image data cross-origin (CVE-2025-43392)
      * webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2025-43419)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43425)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43427)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43429)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43430)
      * webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2025-43431)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43432)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2025-43434)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43440)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43443)
      * webkitgtk: A malicious website may exfiltrate data cross-origin (CVE-2025-43480)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43421)
      * webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop (CVE-2025-13947)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43458)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-66287)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0982 advisory.

    Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:

    CVE-2025-43272:
    The issue was addressed with improved memory handling. This issue is fixed in Safari 26, visionOS 26,     watchOS 26, macOS Tahoe 26, iOS 26 and iPadOS 26. Processing maliciously crafted web content may lead to     an unexpected Safari crash.

    CVE-2025-43342:
    A correctness issue was addressed with improved checks. This issue is fixed in tvOS 26, Safari 26, iOS     18.7 and iPadOS 18.7, visionOS 26, watchOS 26, macOS Tahoe 26, iOS 26 and iPadOS 26. Processing     maliciously crafted web content may lead to an unexpected process crash.

    CVE-2025-43356:
    The issue was addressed with improved handling of caches. This issue is fixed in tvOS 26, Safari 26, iOS     18.7 and iPadOS 18.7, visionOS 26, watchOS 26, macOS Tahoe 26, iOS 26 and iPadOS 26. A website may be able     to access sensor information without user consent.

    CVE-2025-43368:
    A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26,     macOS Tahoe 26, iOS 26 and iPadOS 26. Processing maliciously crafted web content may lead to an unexpected     Safari crash.

    CVE-2025-43419:
    The issue was addressed with improved memory handling. This issue is fixed in Safari 26, tvOS 26, watchOS     26, iOS 26 and iPadOS 26, visionOS 26. Processing maliciously crafted web content may lead to memory     corruption.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0021-1 advisory.

    Update to version 2.50.4.

    Security issues fixed:

    - CVE-2025-13502: processing of maliciously crafted payloads by the GLib remote inspector server may lead     to a       UIProcess crash due to an out-of-bounds read and an integer underflow (bsc#1254208).
    - CVE-2025-13947: use of the file drag-and-drop mechanism may lead to remote information disclosure due to     a lack of       verification of the origins of drag operations (bsc#1254473).
    - CVE-2025-14174: processing maliciously crafted web content may lead to memory corruption due to improper     validation       (bsc#1255497).
    - CVE-2025-43392: websites may exfiltrate image data cross-origin due to issues with cache handling     (bsc#1254165).
    - CVE-2025-43421: processing maliciously crafted web content may lead to an unexpected process crash due     to enabled       array allocation sinking (bsc#1254167).
    - CVE-2025-43425: processing maliciously crafted web content may lead to an unexpected process crash due     to improper       memory handling (bsc#1254168).
    - CVE-2025-43427: processing maliciously crafted web content may lead to an unexpected process crash due     to issues with       state management (bsc#1254169).
    - CVE-2025-43429: processing maliciously crafted web content may lead to an unexpected process crash due     to a buffer       overflow issue (bsc#1254174).
    - CVE-2025-43430: processing maliciously crafted web content may lead to an unexpected process crash due     to issues with       state management (bsc#1254172).
    - CVE-2025-43431: processing maliciously crafted web content may lead to memory corruption due to improper     memory       handling (bsc#1254170).
    - CVE-2025-43432: processing maliciously crafted web content may lead to an unexpected process crash due     to a       use-after-free issue (bsc#1254171).
    - CVE-2025-43434: processing maliciously crafted web content may lead to an unexpected process crash due     to a       use-after-free issue (bsc#1254179).
    - CVE-2025-43440: processing maliciously crafted web content may lead to an unexpected process crash due     to missing       checks (bsc#1254177).
    - CVE-2025-43443: processing maliciously crafted web content may lead to an unexpected process crash due     to missing       checks (bsc#1254176).
    - CVE-2025-43458: processing maliciously crafted web content may lead to an unexpected process crash due     to issues with       state management (bsc#1254498).
    - CVE-2025-43501: processing maliciously crafted web content may lead to an unexpected process crash due     to a buffer       overflow issue (bsc#1255194).
    - CVE-2025-43529: processing maliciously crafted web content may lead to arbitrary code execution due to a       use-after-free issue (bsc#1255198).
    - CVE-2025-43531: processing maliciously crafted web content may lead to an unexpected process crash due     to a race       condition (bsc#1255183).
    - CVE-2025-43535: processing maliciously crafted web content may lead to an unexpected process crash due     to improper       memory handling (bsc#1255195).
    - CVE-2025-43536: processing maliciously crafted web content may lead to an unexpected process crash due     to a       use-after-free issue (bsc#1255200).
    - CVE-2025-43541: processing maliciously crafted web content may lead to an unexpected process crash due     to type       confusion (bsc#1255191).
    - CVE-2025-66287: processing maliciously crafted web content may lead to an unexpected process crash due     to improper       memory handling (bsc#1254509).

    Other issues fixed and changes:

    - Version 2.50.4:
      * Correctly handle the program name passed to the sleep disabler.
      * Ensure GStreamer is initialized before using the Quirks.
      * Fix several crashes and rendering issues.

    - Version 2.50.3:
      * Fix seeking and looping of media elements that set the 'loop' property.
      * Fix several crashes and rendering issues.

    - Version 2.50.2:
      * Prevent unsafe URI schemes from participating in media playback.
      * Make jsc_value_array_buffer_get_data() function introspectable.
      * Fix logging in to Google accounts that have a WebAuthn second factor configured.
      * Fix loading webkit://gpu when there are no threads configured for GPU rendering.
      * Fix rendering gradiants that use the CSS hue interpolation method.
      * Fix pasting image data from the clipboard.
      * Fix font-family selection when the font name contains spaces.
      * Fix the build with standard C libraries that lack execinfo.h, like Musl or uClibc.
      * Fix capturing canvas snapshots in the Web Inspector.
      * Fix several crashes and rendering issues.

    - Fix a11y regression where AT-SPI roles were mapped incorrectly.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20065-1 advisory.

    Update to version 2.50.4.

    Security issues fixed:

    - CVE-2025-13502: processing of maliciously crafted payloads by the GLib remote inspector server may lead     to a       UIProcess crash due to an out-of-bounds read and an integer underflow (bsc#1254208).
    - CVE-2025-13947: use of the file drag-and-drop mechanism may lead to remote information disclosure due to     a lack of       verification of the origins of drag operations (bsc#1254473).
    - CVE-2025-14174: processing maliciously crafted web content may lead to memory corruption due to improper     validation       (bsc#1255497).
    - CVE-2025-43272: processing maliciously crafted web content may lead to an unexpected process crash due     to improper       memory handling (bsc#1250439).
    - CVE-2025-43342: processing maliciously crafted web content may lead to an unexpected process crash due     to a       correctness issue and missing checks (bsc#1250440).
    - CVE-2025-43343: processing maliciously crafted web content may lead to an unexpected process crash due     to improper       memory handling (bsc#1251975).
    - CVE-2025-43356: a website may be able to access sensor information without user consent due to improper     cache handling       (bsc#1250441).
    - CVE-2025-43368: processing maliciously crafted web content may lead to an unexpected process crash due     to a       use-after-free issue (bsc#1250442).
    - CVE-2025-43392: websites may exfiltrate image data cross-origin due to issues with cache handling     (bsc#1254165).
    - CVE-2025-43419: processing maliciously crafted web content may lead to memory corruption due to improper     memory       handling (bsc#1254166).
    - CVE-2025-43421: processing maliciously crafted web content may lead to an unexpected process crash due     to enabled       array allocation sinking (bsc#1254167).
    - CVE-2025-43425: processing maliciously crafted web content may lead to an unexpected process crash due     to improper       memory handling (bsc#1254168).
    - CVE-2025-43427: processing maliciously crafted web content may lead to an unexpected process crash due     to issues with       state management (bsc#1254169).
    - CVE-2025-43429: processing maliciously crafted web content may lead to an unexpected process crash due     to a buffer       overflow issue (bsc#1254174).
    - CVE-2025-43430: processing maliciously crafted web content may lead to an unexpected process crash due     to issues with       state management (bsc#1254172).
    - CVE-2025-43431: processing maliciously crafted web content may lead to memory corruption due to improper     memory       handling (bsc#1254170).
    - CVE-2025-43432: processing maliciously crafted web content may lead to an unexpected process crash due     to a       use-after-free issue (bsc#1254171).
    - CVE-2025-43434: processing maliciously crafted web content may lead to an unexpected process crash due     to a       use-after-free issue (bsc#1254179).
    - CVE-2025-43440: processing maliciously crafted web content may lead to an unexpected process crash due     to missing       checks (bsc#1254177).
    - CVE-2025-43443: processing maliciously crafted web content may lead to an unexpected process crash due     to missing       checks (bsc#1254176).
    - CVE-2025-43458: processing maliciously crafted web content may lead to an unexpected process crash due     to issues with       state management (bsc#1254498).
    - CVE-2025-43501: processing maliciously crafted web content may lead to an unexpected process crash due     to a buffer       overflow issue (bsc#1255194).
    - CVE-2025-43529: processing maliciously crafted web content may lead to arbitrary code execution due to a       use-after-free issue (bsc#1255198).
    - CVE-2025-43531: processing maliciously crafted web content may lead to an unexpected process crash due     to a race       condition (bsc#1255183).
    - CVE-2025-43535: processing maliciously crafted web content may lead to an unexpected process crash due     to improper       memory handling (bsc#1255195).
    - CVE-2025-43536: processing maliciously crafted web content may lead to an unexpected process crash due     to a       use-after-free issue (bsc#1255200).
    - CVE-2025-43541: processing maliciously crafted web content may lead to an unexpected process crash due     to type       confusion (bsc#1255191).
    - CVE-2025-66287: processing maliciously crafted web content may lead to an unexpected process crash due     to improper       memory handling (bsc#1254509).

    Other issues fixed and changes:

    - Version 2.50.4:
      * Correctly handle the program name passed to the sleep disabler.
      * Ensure GStreamer is initialized before using the Quirks.
      * Fix several crashes and rendering issues.

    - Version 2.50.3:
      * Fix seeking and looping of media elements that set the loop property.
      * Fix several crashes and rendering issues.

    - Version 2.50.2:
      * Prevent unsafe URI schemes from participating in media playback.
      * Make jsc_value_array_buffer_get_data() function introspectable.
      * Fix logging in to Google accounts that have a WebAuthn second factor configured.
      * Fix loading webkit://gpu when there are no threads configured for GPU rendering.
      * Fix rendering gradiants that use the CSS hue interpolation method.
      * Fix pasting image data from the clipboard.
      * Fix font-family selection when the font name contains spaces.
      * Fix the build with standard C libraries that lack execinfo.h, like Musl or uClibc.
      * Fix capturing canvas snapshots in the Web Inspector.
      * Fix several crashes and rendering issues.

    - Version 2.50.1:
      * Improve text rendering performance.
      * Fix audio playback broken on instagram.
      * Fix rendering of layers with fractional transforms.
      * Fix the build with ENABLE(VIDEO) disabled.
      * Fix the build in s390x.
      * Fix several crashes and rendering issues.

    - Version 2.50.0:
      * Improved rendering performance by recording each layer once and replaying every dirty region in     different worker         threads.
      * Enable damage propagation to the UI process by default.
      * CSS property font-variant-emoji is now enabled by default.
      * Font synthesis properties (bold/italic) are now properly handled.
      * Ensure web view is focused on tap gesture.
      * Added new API to get the theme color of a WebKitWebView.

    - Version 2.49.90:
      * Add support for font collection / fragment identifiers.
      * Fix web process deadlock on exit.
      * Fix stuttering when playing WebP animations
      * Fix CSS animations with cubic-bezier timing function.
      * Do not start the MemoryPressureMonitor if its disabled
      * Fix several crashes and rendering issues.
      * Updated translations.

    - Version 2.48.6:
      * Fix emojis incorrectly rendered in their text variant.
      * Add support for font collection / fragment identifiers.
      * Fix web process deadlock on exit.
      * Fix stuttering when playing WebP animations.
      * Fix CSS animations with cubic-bezier timing function.
      * Do not start the MemoryPressureMonitor if it's disabled.
      * Fix several crashes and rendering issues.

    - Fix a11y regression where AT-SPI roles were mapped incorrectly.
    - Disable skia on ppc64le.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1150-1 advisory.

    Update to version 2.52.0:

    - CVE-2023-43010: processing maliciously crafted web content may lead to memory corruption (bsc#1259950).
    - CVE-2025-31223: processing maliciously crafted web content may lead to memory corruption (bsc#1259949).
    - CVE-2025-31277: processing maliciously crafted web content may lead to memory corruption (bsc#1259948).
    - CVE-2025-43213: processing maliciously crafted web content may lead to an unexpected crash     (bsc#1259947).
    - CVE-2025-43214: processing maliciously crafted web content may lead to an unexpected crash     (bsc#1259946).
    - CVE-2025-43433: processing maliciously crafted web content may lead to memory corruption (bsc#1259945).
    - CVE-2025-43438: processing maliciously crafted web content may lead to an unexpected crash     (bsc#1259944).
    - CVE-2025-43441: processing maliciously crafted web content may lead to an unexpected process crash     (bsc#1259943).
    - CVE-2025-43457: processing maliciously crafted web content may lead to an unexpected crash     (bsc#1259942).
    - CVE-2025-43511: processing maliciously crafted web content may lead to an unexpected process crash     (bsc#1259941).
    - CVE-2025-46299: processing maliciously crafted web content may disclose internal states of an app     (bsc#1259940).
    - CVE-2026-20608: processing maliciously crafted web content may lead to an unexpected process crash     (bsc#1259939).
    - CVE-2026-20635: processing maliciously crafted web content may lead to an unexpected process crash     (bsc#1259938).
    - CVE-2026-20636: processing maliciously crafted web content may lead to an unexpected process crash     (bsc#1259937).
    - CVE-2026-20644: processing maliciously crafted web content may lead to an unexpected process crash     (bsc#1259936).
    - CVE-2026-20652: a remote attacker may be able to cause a denial-of-service (bsc#1259935).
    - CVE-2026-20676: a website may be able to track users through web extensions (bsc#1259934).

    Changelog:

     - Make scrolling with touch input smoother for small movements.
     + Fix estimated load progress of downloads when Content-Length      value is wrong.
     + Ensure that 'scrollend' events are correctly emitted after      scroll animations.
     + Fix several crashes and rendering issues.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
277925	AlmaLinux 8 : webkit2gtk3 (ALSA-2025:22789)	Nessus	Alma Linux Local Security Checks	2025/12/9	2026/3/17	high
284645	TencentOS Server 2: webkitgtk4 (TSSA-2025:0982)	Nessus	Tencent Local Security Checks	2026/1/14	2026/1/14	critical
281839	SUSE SLED15: WebKitGTK-4.0-lang / WebKitGTK-4.1-lang / WebKitGTK-6.0-lang / etc (SUSE-SU-2026:0021-1)	Nessus	SuSE Local Security Checks	2026/1/6	2026/6/26	high
294939	openSUSE 16 Security Update : webkit2gtk3 (openSUSE-SU-2026:20065-1)	Nessus	SuSE Local Security Checks	2026/1/22	2026/3/10	critical
304484	SUSE SLES15 Security Update : webkit2gtk3 (SUSE-SU-2026:1150-1)	Nessus	SuSE Local Security Checks	2026/4/1	2026/4/1	medium

检测

插件搜索

high

critical

high

critical

medium