The version of OpenSSL installed on the remote host is prior to 3.2.6. It is, therefore, affected by multiple vulnerabilities as referenced in the 3.2.6 advisory.

  - Issue summary: A timing side-channel which could potentially allow remote recovery of the private key     exists in the SM2 algorithm implementation on 64 bit ARM platforms. Impact summary: A timing side-channel     in SM2 signature computations on 64 bit ARM platforms could allow recovering the private key by an     attacker.. While remote key recovery over a network was not attempted by the reporter, timing measurements     revealed a timing signal which may allow such an attack. OpenSSL does not directly support certificates     with SM2 keys in TLS, and so this CVE is not relevant in most TLS contexts. However, given that it is     possible to add support for such certificates via a custom provider, coupled with the fact that in such a     custom provider context the private key may be recoverable via remote timing measurements, we consider     this to be a Moderate severity issue. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected     by this issue, as SM2 is not an approved algorithm. (CVE-2025-9231)

  - Issue summary: An application using the OpenSSL HTTP client API functions may trigger an out-of-bounds     read if the 'no_proxy' environment variable is set and the host portion of the authority component of the     HTTP URL is an IPv6 address. Impact summary: An out-of-bounds read can trigger a crash which leads to     Denial of Service for an application. The OpenSSL HTTP client API functions can be used directly by     applications but they are also used by the OCSP client functions and CMP (Certificate Management Protocol)     client implementation in OpenSSL. However the URLs used by these implementations are unlikely to be     controlled by an attacker. In this vulnerable code the out of bounds read can only trigger a crash.
    Furthermore the vulnerability requires an attacker-controlled URL to be passed from an application to the     OpenSSL function and the user has to have a 'no_proxy' environment variable set. For the aforementioned     reasons the issue was assessed as Low severity. The vulnerable code was introduced in the following patch     releases: 3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and     3.0 are not affected by this issue, as the HTTP client implementation is outside the OpenSSL FIPS module     boundary. (CVE-2025-9232)

  - Issue summary: An application trying to decrypt CMS messages encrypted using password based encryption can     trigger an out-of-bounds read and write. Impact summary: This out-of-bounds read may trigger a crash which     leads to Denial of Service for an application. The out-of-bounds write can cause a memory corruption which     can have various consequences including a Denial of Service or Execution of attacker-supplied code.
    Although the consequences of a successful exploit of this vulnerability could be severe, the probability     that the attacker would be able to perform it is low. Besides, password based (PWRI) encryption support in     CMS messages is very rarely used. For that reason the issue was assessed as Moderate severity according to     our Security Policy. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue,     as the CMS implementation is outside the OpenSSL FIPS module boundary. (CVE-2025-9230)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-e6f76d56fc advisory.

    Resolves: CVE-2025-9230, CVE-2025-9231, CVE-2025-9232

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the openssl package has been released.

The versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2026 CPU advisory.

  - Vulnerability in the Oracle Spatial and Graph (OpenJPEG) component of Oracle Database Server. Supported     versions that are affected are 23.4.0-23.26.0. Easily exploitable vulnerability allows low privileged     attacker having None privilege with logon to the infrastructure where Oracle Spatial and Graph (OpenJPEG)     executes to compromise Oracle Spatial and Graph (OpenJPEG). Successful attacks require human interaction     from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized     ability to cause a partial denial of service (partial DOS) of Oracle Spatial and Graph (OpenJPEG).
    (CVE-2025-54874)

  - Vulnerability in the Fleet Patching and Provisioning (Eclipse Jersey) component of Oracle Database Server.
    Supported versions that are affected are 23.4.0-23.26.0. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Fleet Patching and Provisioning     (Eclipse Jersey). Successful attacks of this vulnerability can result in unauthorized creation, deletion     or modification access to critical data or all Fleet Patching and Provisioning (Eclipse Jersey) accessible     data as well as unauthorized access to critical data or complete access to all Fleet Patching and     Provisioning (Eclipse Jersey) accessible data. (CVE-2025-12383)

  - Vulnerability in the SQLcl component of Oracle Database Server. Supported versions that are affected are     23.4.0-23.26.0. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the     infrastructure where SQLcl executes to compromise SQLcl. Successful attacks require human interaction from     a person other than the attacker. Successful attacks of this vulnerability can result in takeover of     SQLcl. (CVE-2026-21939)

  - Vulnerability in the RDBMS (Python) component of Oracle Database Server. Supported versions that are     affected are 21.3-21.20 and 23.4.0-23.26.0. Easily exploitable vulnerability allows high privileged     attacker having Authenticated User privilege with logon to the infrastructure where RDBMS (Python)     executes to compromise RDBMS (Python). Successful attacks of this vulnerability can result in takeover of     RDBMS (Python). (CVE-2025-13836, CVE-2025-13837, CVE-2025-6069, CVE-2025-6075, CVE-2025-8194,     CVE-2025-8291, CVE-2025-8869)

  - Vulnerability in the Oracle Graal Development Kit for Micronaut (Nimbus JOSE+JWT) component of Oracle     Database Server. Supported versions that are affected are 19.3-19.29 and 23.4.0-23.26.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise     Oracle Graal Development Kit for Micronaut (Nimbus JOSE+JWT). Successful attacks of this vulnerability can     result in unauthorized update, insert or delete access to some of Oracle Graal Development Kit for     Micronaut (Nimbus JOSE+JWT) accessible data as well as unauthorized read access to a subset of Oracle     Graal Development Kit for Micronaut (Nimbus JOSE+JWT) accessible data. (CVE-2025-67735)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 7.5.0.5. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-7.5.0.5 advisory.

  - Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker     to inject forged data into the cache. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0     through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1     through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1. (CVE-2025-40778)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u461,     8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle GraalVM     Enterprise Edition: 21.3.15. Easily exploitable vulnerability allows unauthenticated attacker with network     access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical     data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition     accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g.,     through a web service which supplies data to the APIs. This vulnerability also applies to Java     deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets,     that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox     for security. (CVE-2025-53066)

  - Spring Framework MVC applications can be vulnerable to a Path Traversal Vulnerability when deployed on a     non-compliant Servlet container. An application can be vulnerable when all the following are true: * the     application is deployed as a WAR or with an embedded Servlet container * the Servlet container does not     reject suspicious sequences https://jakarta.ee/specifications/servlet/6.1/jakarta-servlet-     spec-6.1.html#uri-path-canonicalization * the application serves static resources     https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title     with Spring resource handling We have verified that applications deployed on Apache Tomcat or Eclipse     Jetty are not vulnerable, as long as default security features are not disabled in the configuration.
    Because we cannot check exploits against all Servlet containers and configuration variants, we strongly     recommend upgrading your application. (CVE-2025-41242)

  - libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small     document that is submitted for parsing. (CVE-2025-59375)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u461,     8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle GraalVM     Enterprise Edition: 21.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion     or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the     specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and     rely on the Java sandbox for security. (CVE-2025-53057)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of OpenSSL installed on the remote host is prior to 3.3.5. It is, therefore, affected by multiple vulnerabilities as referenced in the 3.3.5 advisory.

  - Issue summary: A timing side-channel which could potentially allow remote recovery of the private key     exists in the SM2 algorithm implementation on 64 bit ARM platforms. Impact summary: A timing side-channel     in SM2 signature computations on 64 bit ARM platforms could allow recovering the private key by an     attacker.. While remote key recovery over a network was not attempted by the reporter, timing measurements     revealed a timing signal which may allow such an attack. OpenSSL does not directly support certificates     with SM2 keys in TLS, and so this CVE is not relevant in most TLS contexts. However, given that it is     possible to add support for such certificates via a custom provider, coupled with the fact that in such a     custom provider context the private key may be recoverable via remote timing measurements, we consider     this to be a Moderate severity issue. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected     by this issue, as SM2 is not an approved algorithm. (CVE-2025-9231)

  - Issue summary: An application using the OpenSSL HTTP client API functions may trigger an out-of-bounds     read if the 'no_proxy' environment variable is set and the host portion of the authority component of the     HTTP URL is an IPv6 address. Impact summary: An out-of-bounds read can trigger a crash which leads to     Denial of Service for an application. The OpenSSL HTTP client API functions can be used directly by     applications but they are also used by the OCSP client functions and CMP (Certificate Management Protocol)     client implementation in OpenSSL. However the URLs used by these implementations are unlikely to be     controlled by an attacker. In this vulnerable code the out of bounds read can only trigger a crash.
    Furthermore the vulnerability requires an attacker-controlled URL to be passed from an application to the     OpenSSL function and the user has to have a 'no_proxy' environment variable set. For the aforementioned     reasons the issue was assessed as Low severity. The vulnerable code was introduced in the following patch     releases: 3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and     3.0 are not affected by this issue, as the HTTP client implementation is outside the OpenSSL FIPS module     boundary. (CVE-2025-9232)

  - Issue summary: An application trying to decrypt CMS messages encrypted using password based encryption can     trigger an out-of-bounds read and write. Impact summary: This out-of-bounds read may trigger a crash which     leads to Denial of Service for an application. The out-of-bounds write can cause a memory corruption which     can have various consequences including a Denial of Service or Execution of attacker-supplied code.
    Although the consequences of a successful exploit of this vulnerability could be severe, the probability     that the attacker would be able to perform it is low. Besides, password based (PWRI) encryption support in     CMS messages is very rarely used. For that reason the issue was assessed as Moderate severity according to     our Security Policy. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue,     as the CMS implementation is outside the OpenSSL FIPS module boundary. (CVE-2025-9230)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 00e912c5-9e92-11f0-bc5f-8447094a420f advisory.

    The OpenSSL project reports reports:
    Out-of-bounds read & write in RFC 3211 KEK Unwrap     Timing side-channel in SM2 algorithm on 64-bit ARM     Fix Out-of-bounds read in HTTP client no_proxy handling

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1225 advisory.

    Issue summary: An application trying to decrypt CMS messages encrypted usingpassword based encryption can     trigger an out-of-bounds read and write.

    Impact summary: This out-of-bounds read may trigger a crash which leads toDenial of Service for an     application. The out-of-bounds write can causea memory corruption which can have various consequences     includinga Denial of Service or Execution of attacker-supplied code.

    Although the consequences of a successful exploit of this vulnerabilitycould be severe, the probability     that the attacker would be able toperform it is low. Besides, password based (PWRI) encryption support in     CMSmessages is very rarely used. For that reason the issue was assessed asModerate severity according to     our Security Policy.

    The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by thisissue, as the CMS     implementation is outside the OpenSSL FIPS moduleboundary. (CVE-2025-9230)

    Issue summary: A timing side-channel which could potentially allow remoterecovery of the private key     exists in the SM2 algorithm implementation on 64 bitARM platforms.

    Impact summary: A timing side-channel in SM2 signature computations on 64 bitARM platforms could allow     recovering the private key by an attacker..

    While remote key recovery over a network was not attempted by the reporter,timing measurements revealed a     timing signal which may allow such an attack.

    OpenSSL does not directly support certificates with SM2 keys in TLS, and sothis CVE is not relevant in     most TLS contexts.  However, given that it ispossible to add support for such certificates via a custom     provider, coupledwith the fact that in such a custom provider context the private key may berecoverable     via remote timing measurements, we consider this to be a Moderateseverity issue.

    The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by thisissue, as SM2 is not an     approved algorithm. (CVE-2025-9231)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2025:20164-1 advisory.

    - CVE-2025-9230: Fixed out-of-bounds read & write in RFC 3211 KEK unwrap (bsc#1250232)
    - CVE-2025-9231: Fixedk timing side-channel in SM2 algorithm on 64 bit ARM (bsc#1250233)
    - CVE-2025-9232: Fixed out-of-bounds read in HTTP client no_proxy handling (bsc#1250234)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 7.5.1. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-7.5.1 advisory.

  - A vulnerability has been found in GNU Binutils 2.45. The affected element is the function elf_swap_shdr in     the library bfd/elfcode.h of the component Linker. The manipulation leads to heap-based buffer overflow.
    The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The     identifier of the patch is 9ca499644a21ceb3f946d1c179c38a83be084490. To fix this issue, it is recommended     to deploy a patch. The code maintainer replied with [f]ixed for 2.46. (CVE-2025-11083)

  - Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in     Apache Commons FileUpload. This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from     2.0.0-M1 before 2.0.0-M4. Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the     issue. (CVE-2025-48976)

  - The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts (`[]`), allowing     hosts that weren't IPv6 or IPvFuture. This behavior was not conformant to RFC 3986 and potentially enabled     SSRF if a URL is processed by more than one URL parser. (CVE-2024-11168)

  - CPython 3.9 and earlier doesn't disallow configuring an empty list ([]) for     SSLContext.set_npn_protocols() which is an invalid value for the underlying OpenSSL API. This results in a     buffer over-read when NPN is used (see CVE-2024-5535 for OpenSSL). This vulnerability is of low severity     due to NPN being not widely used and specifying an empty list likely being uncommon in-practice (typically     a protocol name would be configured). (CVE-2024-5642)

  - A vulnerability has been found in the CPython `venv` module and CLI where path names provided when     creating a virtual environment were not quoted properly, allowing the creator to inject commands into     virtual environment activation scripts (ie source venv/bin/activate). This means that attacker-     controlled virtual environments are able to run commands when the virtual environment is activated.
    Virtual environments which are not created by an attacker or which aren't activated before being used (ie     ./venv/bin/python) are not affected. (CVE-2024-9287)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of OpenSSL installed on the remote host is prior to 3.5.4. It is, therefore, affected by multiple vulnerabilities as referenced in the 3.5.4 advisory.

  - Issue summary: A timing side-channel which could potentially allow remote recovery of the private key     exists in the SM2 algorithm implementation on 64 bit ARM platforms. Impact summary: A timing side-channel     in SM2 signature computations on 64 bit ARM platforms could allow recovering the private key by an     attacker.. While remote key recovery over a network was not attempted by the reporter, timing measurements     revealed a timing signal which may allow such an attack. OpenSSL does not directly support certificates     with SM2 keys in TLS, and so this CVE is not relevant in most TLS contexts. However, given that it is     possible to add support for such certificates via a custom provider, coupled with the fact that in such a     custom provider context the private key may be recoverable via remote timing measurements, we consider     this to be a Moderate severity issue. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected     by this issue, as SM2 is not an approved algorithm. (CVE-2025-9231)

  - Issue summary: An application using the OpenSSL HTTP client API functions may trigger an out-of-bounds     read if the 'no_proxy' environment variable is set and the host portion of the authority component of the     HTTP URL is an IPv6 address. Impact summary: An out-of-bounds read can trigger a crash which leads to     Denial of Service for an application. The OpenSSL HTTP client API functions can be used directly by     applications but they are also used by the OCSP client functions and CMP (Certificate Management Protocol)     client implementation in OpenSSL. However the URLs used by these implementations are unlikely to be     controlled by an attacker. In this vulnerable code the out of bounds read can only trigger a crash.
    Furthermore the vulnerability requires an attacker-controlled URL to be passed from an application to the     OpenSSL function and the user has to have a 'no_proxy' environment variable set. For the aforementioned     reasons the issue was assessed as Low severity. The vulnerable code was introduced in the following patch     releases: 3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and     3.0 are not affected by this issue, as the HTTP client implementation is outside the OpenSSL FIPS module     boundary. (CVE-2025-9232)

  - Issue summary: An application trying to decrypt CMS messages encrypted using password based encryption can     trigger an out-of-bounds read and write. Impact summary: This out-of-bounds read may trigger a crash which     leads to Denial of Service for an application. The out-of-bounds write can cause a memory corruption which     can have various consequences including a Denial of Service or Execution of attacker-supplied code.
    Although the consequences of a successful exploit of this vulnerability could be severe, the probability     that the attacker would be able to perform it is low. Besides, password based (PWRI) encryption support in     CMS messages is very rarely used. For that reason the issue was assessed as Moderate severity according to     our Security Policy. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue,     as the CMS implementation is outside the OpenSSL FIPS module boundary. (CVE-2025-9230)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:21213-1 advisory.

    - CVE-2025-9230: Fixed out-of-bounds read & write in RFC 3211 KEK unwrap (bsc#1250232)
    - CVE-2025-9231: Fixedk timing side-channel in SM2 algorithm on 64 bit ARM (bsc#1250233)
    - CVE-2025-9232: Fixed out-of-bounds read in HTTP client no_proxy handling (bsc#1250234)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 / 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6015 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6015-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     October 01, 2025                      https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : openssl     CVE ID         : CVE-2025-9230 CVE-2025-9231 CVE-2025-9232

    Multiple vulnerabilities have been discovered in OpenSSL, a Secure     Sockets Layer toolkit, which may result in denial of service or     information leaks.

    Additional details can be found in the upstream advisory:
    https://openssl-library.org/news/secadv/20250930.txt

    For the oldstable distribution (bookworm), these problems have been fixed     in version 3.0.17-1~deb12u3.

    For the stable distribution (trixie), these problems have been fixed in     version 3.5.1-1+deb13u1.

    We recommend that you upgrade your openssl packages.

    For the detailed security status of openssl please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/openssl

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-c355a1291c advisory.

    Resolves: CVE-2025-9230, CVE-2025-9231, CVE-2025-9232

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 7.3.1.5. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-7.3.1.5 advisory.

  - A vulnerability has been found in GNU Binutils 2.45. The affected element is the function elf_swap_shdr in     the library bfd/elfcode.h of the component Linker. The manipulation leads to heap-based buffer overflow.
    The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The     identifier of the patch is 9ca499644a21ceb3f946d1c179c38a83be084490. To fix this issue, it is recommended     to deploy a patch. The code maintainer replied with [f]ixed for 2.46. (CVE-2025-11083)

  - LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable     Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, an out-of-bounds read     vulnerability exists in png_image_read_composite when processing palette images with     PNG_FLAG_OPTIMIZE_ALPHA enabled. The palette compositing code in png_init_read_transformations incorrectly     applies background compositing during premultiplication, violating the invariant component  alpha  257     required by the simplified PNG API. This issue has been patched in version 1.6.51. (CVE-2025-64720)

  - LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable     Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, there is a heap buffer overflow     vulnerability in the libpng simplified API function png_image_finish_read when processing 16-bit     interlaced PNGs with 8-bit output format. Attacker-crafted interlaced PNG files cause heap writes beyond     allocated buffer bounds. This issue has been patched in version 1.6.51. (CVE-2025-65018)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: RMI). Supported versions that are affected are Oracle Java SE: 8u471,     8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9;
    Oracle GraalVM Enterprise Edition: 21.3.16. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized     update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE,     Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web     Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from     the internet) and rely on the Java sandbox for security. (CVE-2026-21925)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u471,     8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9;
    Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than     the attacker and while the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition, attacks may significantly impact additional products (scope change). Successful     attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle     Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized     read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition     accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g.,     through a web service which supplies data to the APIs. This vulnerability also applies to Java     deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets,     that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox     for security. (CVE-2026-21933)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
266319	OpenSSL 3.2.0 < 3.2.6 Multiple Vulnerabilities	Nessus	Web Servers	2025/10/1	2026/2/24	medium
270121	Fedora 41 : openssl (2025-e6f76d56fc)	Nessus	Fedora Local Security Checks	2025/10/13	2026/2/24	medium
334116	Photon OS 5.0: Openssl PHSA-2026-5.0-92-0878	Nessus	PhotonOS Local Security Checks	2026/8/10	2026/8/11	high
296378	Oracle Database Server (January 2026 CPU)	Nessus	Databases	2026/1/23	2026/4/30	critical
299031	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-7.5.0.5)	Nessus	Misc.	2026/2/13	2026/4/2	high
266293	OpenSSL 3.3.0 < 3.3.5 Multiple Vulnerabilities	Nessus	Web Servers	2025/9/30	2026/2/24	medium
266387	FreeBSD : OpenSSL -- multiple vulnerabilities (00e912c5-9e92-11f0-bc5f-8447094a420f)	Nessus	FreeBSD Local Security Checks	2025/10/1	2026/2/24	medium
270526	Amazon Linux 2023 : openssl, openssl-devel, openssl-fips-provider-latest (ALAS2023-2025-1225)	Nessus	Amazon Linux Local Security Checks	2025/10/15	2026/2/24	medium
279057	openSUSE 16 Security Update : openssl-3 (openSUSE-SU-2025:20164-1)	Nessus	SuSE Local Security Checks	2025/12/18	2025/12/18	medium
305057	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-7.5.1)	Nessus	Misc.	2026/4/6	2026/4/7	medium
266298	OpenSSL 3.5.0 < 3.5.4 Multiple Vulnerabilities	Nessus	Web Servers	2025/9/30	2026/3/30	medium
279362	SUSE SLES16: libopenssl-3-devel / libopenssl-3-fips-provider / etc (SUSE-SU-2025:21213-1)	Nessus	SuSE Local Security Checks	2025/12/19	2026/6/25	medium
266357	Debian dsa-6015 : libcrypto3-udeb - security update	Nessus	Debian Local Security Checks	2025/10/1	2025/10/1	medium
269689	Fedora 42 : openssl (2025-c355a1291c)	Nessus	Fedora Local Security Checks	2025/10/8	2026/2/24	medium
299799	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-7.3.1.5)	Nessus	Misc.	2026/2/23	2026/4/7	medium

检测

插件搜索

medium

medium

high

critical

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium