The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-016788 advisory.

    An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.
    `.QuerySet.order_by()` is subject to SQL injection in column aliases containing periods when the same     alias is, using a suitably crafted dictionary, with dictionary expansion, used in `FilteredRelation`.
    Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be     affected.
    Django would like to thank Solomon Kebede for reporting this issue.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20184-1 advisory.

    Changes in python-Django:

    - CVE-2026-1312: Fixed potential SQL injection via QuerySet.order_by and FilteredRelation (bsc#1257408).
    - CVE-2026-1287: Fixed potential SQL injection in column aliases via control characters (bsc#1257407).
    - CVE-2026-1207: Fixed potential SQL injection via raster lookups on PostGIS (bsc#1257405).
    - CVE-2026-1285: Fixed potential denial-of-service in django.utils.text.Truncator HTML methods     (bsc#1257406).
    - CVE-2025-13473: Fixed username enumeration through timing difference in mod_wsgi authentication handler     (bsc#1257401).
    - CVE-2025-14550: Fixed potential denial-of-service via repeated headers when using ASGI (bsc#1257403).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-3adb735295 advisory.

    - Fixes CVE-2025-13473: Username enumeration through timing difference in mod_wsgi authentication handler
    - Fixes CVE-2025-14550: Potential denial-of-service vulnerability via repeated headers when using ASGI
    - Fixes CVE-2026-1207: Potential SQL injection via raster lookups on PostGIS
    - Fixes CVE-2026-1285: Potential denial-of-service vulnerability in django.utils.text.Truncator HTML     methods
    - Fixes CVE-2026-1287: Potential SQL injection in column aliases via control characters
    - Fixes CVE-2026-1312: Potential SQL injection via QuerySet.order_by and FilteredRelation
    - Fixed a bug in Django 5.2 where data exceeding max_length was silently truncated by     QuerySet.bulk_create() on PostgreSQL
    - Fixed a bug where management command colorized help (introduced in Python 3.14) ignored the --no-color     option and the DJANGO_COLORS setting


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:14835 advisory.

    Red Hat Satellite is a system management solution that allows organizations     to configure and maintain their systems without the necessity to provide     public Internet access to their servers or other client systems. It     performs provisioning and configuration management of predefined standard     operating environments.

    Security Fix(es):

    * python3.12-django: Django: SQL Injection via crafted column aliases     (CVE-2026-1287)
    * python3.12-django: Django: SQL Injection via RasterField band index     parameter (CVE-2026-1207)
    * python3.12-django: Django: SQL injection via crafted column aliases in     QuerySet.order_by() (CVE-2026-1312)
    * python3.12-django: Django: Denial of Service via crafted HTML inputs     (CVE-2026-1285)
    * python3.12-django: Django: Denial of Service via crafted request with     duplicate headers (CVE-2025-14550)
    * python3.12-markdown: markdown: Denial of Service via malformed     HTML-like sequences (CVE-2025-69534)
    * python3.12-pyOpenSSL: pyOpenSSL: DTLS cookie callback buffer overflow     (CVE-2026-27459)
    * rubygem-activesupport: Active Support: Denial of Service via large     scientific notation strings (CVE-2026-33176)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
313486	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python-django (UTSA-2026-016788)	Nessus	Unity Linux Local Security Checks	2026/5/9	2026/5/9	medium
298350	openSUSE 16 Security Update : python-Django (openSUSE-SU-2026:20184-1)	Nessus	SuSE Local Security Checks	2026/2/9	2026/2/9	critical
300515	Fedora 43 : python-django5 (2026-3adb735295)	Nessus	Fedora Local Security Checks	2026/3/4	2026/3/4	critical
313104	RHEL 9 : Satellite 6.18.5 Async Update (Important) (RHSA-2026:14835)	Nessus	Red Hat Local Security Checks	2026/5/7	2026/5/7	critical

检测

插件搜索

medium

critical

critical

critical