The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1704-1 advisory.

    Update to upstream tag jdk-25.0.3+9 (April 2026 CPU).

    Security issues fixed:

    - CVE-2026-22007: Security: unauthenticated attacker with logon to the infrastructure where java executes     can gain       unauthorized read access to a subset of accessible data (bsc#1262490).
    - CVE-2026-22008: Libraries: unauthenticated attacker with network access via multiple protocols can gain     unauthorized       update, insert or delete access to data (bsc#1262493).
    - CVE-2026-22013: JGSS: unauthenticated attacker with network access via multiple protocols can gain     unauthorized       access to critical data (bsc#1262494).
    - CVE-2026-22016: JAXP: unauthenticated attacker with network access via multiple protocols can gain     unauthorized       to access critical data (bsc#1262495).
    - CVE-2026-22018: Libraries: unauthenticated attacker with network access via multiple protocols can cause     a partial       denial of service (bsc#1262496).
    - CVE-2026-22021: JSSE: unauthenticated attacker with network access via HTTPS can cause a partial denial     of service       (bsc#1262497).
    - CVE-2026-23865: freetype2: integer overflow in the `tt_var_load_item_variation_store` function allows     for an       out-of-bounds read when parsing HVAR/VVAR/MVAR tables in OpenType variable fonts(bsc#1259118).
    - CVE-2026-34268: Security: unauthenticated attacker with logon to the infrastructure where java executes     can gain       unauthorized read access to a subset of data (bsc#1262500).
    - CVE-2026-34282: Networking: unauthenticated attacker with network access via multiple protocols can     cause a hang or       frequently repeatable crash (bsc#1262501).

    Other updates and bugfixes:

    - Provide the timezone-java and tzdata-java (jsc#PED-15898).
    - Migrate to the new logic of FIPS patch developed by RedHat in https://github.com/rh-     openjdk/jdk/tree/fips-25u.
    - Add the sources of /nss-native-fips-key-import-export-adapter.
      * This native library is an adapter for OpenJDK to use the NSS PKCS #11 software token (libsoftokn3.so)     in FIPS mode.
    - Allow overriding of gcc name.
    - Don't make missing system crypto-policies fatal.
    - Add create-crypto-properties-files.bash that generates during the build the config files for different     fips and       non-fips scenarios.
    - Add TestSecurityProperties.java to test the loading of system security properties where applicable.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20672-1 advisory.

    Update to upstream tag jdk-25.0.3+9 (April 2026 CPU).

    Security issues fixed:

    - CVE-2026-22007: Security: unauthenticated attacker with logon to the infrastructure where java executes     can gain       unauthorized read access to a subset of accessible data (bsc#1262490).
    - CVE-2026-22008: Libraries: unauthenticated attacker with network access via multiple protocols can gain     unauthorized       update, insert or delete access to data (bsc#1262493).
    - CVE-2026-22013: JGSS: unauthenticated attacker with network access via multiple protocols can gain     unauthorized       access to critical data (bsc#1262494).
    - CVE-2026-22016: JAXP: unauthenticated attacker with network access via multiple protocols can gain     unauthorized       to access critical data (bsc#1262495).
    - CVE-2026-22018: Libraries: unauthenticated attacker with network access via multiple protocols can cause     a partial       denial of service (bsc#1262496).
    - CVE-2026-22021: JSSE: unauthenticated attacker with network access via HTTPS can cause a partial denial     of service       (bsc#1262497).
    - CVE-2026-23865: freetype2: integer overflow in the `tt_var_load_item_variation_store` function allows     for an       out-of-bounds read when parsing HVAR/VVAR/MVAR tables in OpenType variable fonts(bsc#1259118).
    - CVE-2026-34268: Security: unauthenticated attacker with logon to the infrastructure where java executes     can gain       unauthorized read access to a subset of data (bsc#1262500).
    - CVE-2026-34282: Networking: unauthenticated attacker with network access via multiple protocols can     cause a hang or       frequently repeatable crash (bsc#1262501).

    Other updates and bugfixes:

    - Provide the timezone-java and tzdata-java (jsc#PED-15898).
    - Migrate to the new logic of FIPS patch developed by RedHat in https://github.com/rh-     openjdk/jdk/tree/fips-25u.
    - Add the sources of /nss-native-fips-key-import-export-adapter.
      * This native library is an adapter for OpenJDK to use the NSS PKCS #11 software token (libsoftokn3.so)     in FIPS mode.
    - Allow overriding of gcc name.
    - Don't make missing system crypto-policies fatal.
    - Add create-crypto-properties-files.bash that generates during the build the config files for different     fips and       non-fips scenarios.
    - Add TestSecurityProperties.java to test the loading of system security properties where applicable.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Azul Zulu installed on the remote host is 6 prior to 6.79.0.14 / 7 prior to 7.85.0.12 / 8 prior to 8.93.0.18 / 11 prior to 11.87.18 / 17 prior to 17.65.18 / 21 prior to 21.49.18 / 25 prior to 25.33.16 / 26 prior to 26.30.12. It is, therefore, affected by multiple vulnerabilities as referenced in the 2026-04-21 advisory.

  - The issue was addressed with improved memory handling. This issue is fixed in Safari 26.3, iOS 18.7.5 and     iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, visionOS 26.3. A remote attacker may be able to     cause a denial-of-service. (CVE-2026-20652)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u481,     8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and 21.0.10;
    Oracle GraalVM Enterprise Edition: 21.3.17. Difficult to exploit vulnerability allows unauthenticated     attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a     subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note:
    This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service     which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients     running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code     (e.g., code that comes from the internet) and rely on the Java sandbox for security. (CVE-2026-22007,     CVE-2026-34268)

  - Vulnerability in Oracle Java SE (component: Libraries). The supported version that is affected is Oracle     Java SE: 25.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access     via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result     in unauthorized update, insert or delete access to some of Oracle Java SE accessible data. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java     deployments, typically in servers, that load and run only trusted code (e.g., code installed by an     administrator). (CVE-2026-22008)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: JGSS). Supported versions that are affected are Oracle Java SE: 8u481,     8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and 21.0.10;
    Oracle GraalVM Enterprise Edition: 21.3.17. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than     the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data     or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition     accessible data. Note: This vulnerability applies to Java deployments, typically in clients running     sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g.,     code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not     apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed     by an administrator). (CVE-2026-22013)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u481,     8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and 21.0.10;
    Oracle GraalVM Enterprise Edition: 21.3.17. Easily exploitable vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized     access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the     specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and     rely on the Java sandbox for security. (CVE-2026-22016)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6246 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6246-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     May 03, 2026                          https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : openjdk-25     CVE ID         : CVE-2026-22007 CVE-2026-22008 CVE-2026-22013 CVE-2026-22016                      CVE-2026-22018 CVE-2026-22021 CVE-2026-34268 CVE-2026-34282

    Several vulnerabilities have been discovered in the OpenJDK Java runtime,     which may result in incorrect generation of cryptographic keys, denial of     service, information disclosure, XEE/XEE attacks or incorrect validation     of Kerberos credentials.

    For the stable distribution (trixie), these problems have been fixed in     version 25.0.3+9-2~deb13u1.

    We recommend that you upgrade your openjdk-25 packages.

    For the detailed security status of openjdk-25 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/openjdk-25

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 25.10 / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8334-1 advisory.

    Thomas Beckers discovered that the JAXP component of CRaC JDK 25 did not correctly authenticate certain     APIs. A remote unauthenticated attacker could possibly use this issue to gain unauthorized access to     sensitive information. (CVE-2026-22016)

    It was discovered that the Networking component of CRaC JDK 25 did not correctly authenticate certain     APIs. A remote unauthenticated attacker could possibly use this issue to cause a denial of service.
    (CVE-2026-34282)

    It was discovered that the JSSE component of CRaC JDK 25 did not correctly authenticate certain APIs. A     remote unauthenticated attacker could possibly use this issue to cause a denial of service.
    (CVE-2026-22021)

    It was discovered that the JGSS component of CRaC JDK 25 did not correctly authenticate certain APIs. A     remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-22013)

    It was discovered that the 2D component of CRaC JDK 25 did not correctly handle certain integer     arithmetic. If a user or automated system were tricked into opening a specially crafted file, an attacker     could possibly use this issue to leak sensitive information. (CVE-2026-23865)

    It was discovered that the Libraries component of CRaC JDK 25 did not correctly authenticate certain APIs.
    A remote unauthenticated attacker could possibly use this issue to cause a denial of service or gain     unauthorized modification of data privileges. (CVE-2026-22008, CVE-2026-22018)

    Ken Pyle discovered that the Security component of CRaC JDK 25 did not correctly authenticate certain     APIs. A local attacker could possibly use this issue to leak sensitive information. (CVE-2026-22007,     CVE-2026-34268)

    In addition to security fixes, the updated packages contain bug fixes, new features, and possibly     incompatible changes.

    Please see the following for more information:
    https://openjdk.org/groups/vulnerability/advisories/2026-04-21

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Java installed on the remote host is affected by multiple vulnerabilities as referenced in the April 2026 CPU advisory.

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u481,     8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and 21.0.10;
    Oracle GraalVM Enterprise Edition: 21.3.17. Easily exploitable vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized     access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the     specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet)     and rely on the Java sandbox for security. (CVE-2026-22016)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u481-perf,     11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and 21.0.10; Oracle GraalVM Enterprise     Edition: 21.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via     multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.
    Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.
    Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web     service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in     clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted     code (e.g., code that comes from the internet) and rely on the Java sandbox for security. (CVE-2026-34282)

  - The issue was addressed with improved memory handling. This issue is fixed in Safari 26.3, iOS 18.7.5 and     iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, visionOS 26.3. A remote attacker may be able to     cause a denial-of-service. (CVE-2026-20652)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8339-1 advisory.

    Thomas Beckers discovered that the JAXP component of OpenJDK 25 did not correctly authenticate certain     APIs. A remote unauthenticated attacker could possibly use this issue to gain unauthorized access to     sensitive information. (CVE-2026-22016)

    It was discovered that the Networking component of OpenJDK 25 did not correctly authenticate certain APIs.
    A remote unauthenticated attacker could possibly use this issue to cause a denial of service.
    (CVE-2026-34282)

    It was discovered that the JSSE component of OpenJDK 25 did not correctly authenticate certain APIs. A     remote unauthenticated attacker could possibly use this issue to cause a denial of service.
    (CVE-2026-22021)

    It was discovered that the JGSS component of OpenJDK 25 did not correctly authenticate certain APIs. A     remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-22013)

    It was discovered that the 2D component of OpenJDK 25 did not correctly handle certain integer arithmetic.
    If a user or automated system were tricked into opening a specially crafted file, an attacker could     possibly use this issue to obtain sensitive information. (CVE-2026-23865)

    It was discovered that the Libraries component of OpenJDK 25 did not correctly authenticate certain APIs.
    A remote unauthenticated attacker could possibly use this issue to modify data. (CVE-2026-22008)

    It was discovered that the Libraries component of OpenJDK 25 did not correctly authenticate certain APIs.
    A remote unauthenticated attacker could possibly use this issue to cause a denial of service.
    (CVE-2026-22018)

    Ken Pyle discovered that the Security component of OpenJDK 25 did not correctly authenticate certain APIs.
    A local attacker could possibly use this issue to obtain sensitive information. (CVE-2026-22007,     CVE-2026-34268)

    In addition to security fixes, the updated packages contain bug fixes, new features, and possibly     incompatible changes.

    Please see the following for more information:
    https://openjdk.org/groups/vulnerability/advisories/2026-04-21

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 25.10 / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8341-1 advisory.

    Thomas Beckers discovered that the JAXP component of OpenJDK 26 did not correctly authenticate certain     APIs. A remote unauthenticated attacker could possibly use this issue to gain unauthorized access to     sensitive information. (CVE-2026-22016)

    It was discovered that the Networking component of OpenJDK 26 did not correctly authenticate certain APIs.
    A remote unauthenticated attacker could possibly use this issue to cause a denial of service.
    (CVE-2026-34282)

    It was discovered that the JSSE component of OpenJDK 26 did not correctly authenticate certain APIs. A     remote unauthenticated attacker could possibly use this issue to cause a denial of service.
    (CVE-2026-22021)

    It was discovered that the JGSS component of OpenJDK 26 did not correctly authenticate certain APIs. A     remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-22013)

    It was discovered that the 2D component of OpenJDK 26 did not correctly handle certain integer arithmetic.
    If a user or automated system were tricked into opening a specially crafted file, an attacker could     possibly use this issue to obtain sensitive information. (CVE-2026-23865)

    It was discovered that the Libraries component of OpenJDK 26 did not correctly authenticate certain APIs.
    A remote unauthenticated attacker could possibly use this issue to modify data. (CVE-2026-22008)

    It was discovered that the Libraries component of OpenJDK 26 did not correctly authenticate certain APIs.
    A remote unauthenticated attacker could possibly use this issue to cause a denial of service.
    (CVE-2026-22018)

    Ken Pyle discovered that the Security component of OpenJDK 26 did not correctly authenticate certain APIs.
    A local attacker could possibly use this issue to obtain sensitive information. (CVE-2026-22007,     CVE-2026-34268)

    In addition to security fixes, the updated packages contain bug fixes, new features, and possibly     incompatible changes.

    Please see the following for more information:
    https://openjdk.org/groups/vulnerability/advisories/2026-04-21

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Vulnerability in Oracle Java SE (component: Libraries). The supported version that is affected is Oracle     Java SE: 25.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access     via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result     in unauthorized update, insert or delete access to some of Oracle Java SE accessible data. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java     deployments, typically in servers, that load and run only trusted code (e.g., code installed by an     administrator). (CVE-2026-22008)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of OpenJDK installed on the remote host is 8 prior to 8u482 / 11.0.0 prior to 11.0.30 / 17.0.0 prior to 17.0.18 / 21.0.0 prior to 21.0.10 / 25.0.0 prior to 25.0.2 / 26.0.0 prior to 26.0.0. It is, therefore, affected by multiple vulnerabilities as referenced in the 2026-04-21 advisory.

Please Note: Java CVEs do not always include OpenJDK versions, but are confirmed separately by Tenable using the patch versions from the referenced OpenJDK security advisory.

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u481,     8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and 21.0.10;
    Oracle GraalVM Enterprise Edition: 21.3.17. Easily exploitable vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized     access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the     specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and     rely on the Java sandbox for security. (CVE-2026-22016)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE:
    8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and 21.0.10; Oracle     GraalVM Enterprise Edition: 21.3.17. Easily exploitable vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a     hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle     GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified     Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to     Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java     applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java     sandbox for security. (CVE-2026-34282)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u481,     8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and 21.0.10;
    Oracle GraalVM Enterprise Edition: 21.3.17. Easily exploitable vulnerability allows unauthenticated     attacker with network access via HTTPS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle     GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to     cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component,     e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java     deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets,     that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox     for security. (CVE-2026-22021)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: JGSS). Supported versions that are affected are Oracle Java SE: 8u481,     8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and 21.0.10;
    Oracle GraalVM Enterprise Edition: 21.3.17. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than     the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data     or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition     accessible data. Note: This vulnerability applies to Java deployments, typically in clients running     sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g.,     code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not     apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed     by an administrator). (CVE-2026-22013)

  - An integer overflow in the tt_var_load_item_variation_store function of the Freetype library in versions     2.13.2 and 2.13.3 may allow for an out of bounds read operation when parsing HVAR/VVAR/MVAR tables in     OpenType variable fonts. This issue is fixed in version 2.14.2. (CVE-2026-23865)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
313686	SUSE SLED15 / SLES15 Security Update : java-25-openjdk (SUSE-SU-2026:1704-1)	Nessus	SuSE Local Security Checks	2026/5/10	2026/5/10	high
313706	openSUSE 16 Security Update : java-25-openjdk (openSUSE-SU-2026:20672-1)	Nessus	SuSE Local Security Checks	2026/5/10	2026/5/10	high
309082	Azul Zulu Java Multiple Vulnerabilities (2026-04-21)	Nessus	Misc.	2026/4/21	2026/5/8	high
311815	Debian dsa-6246 : openjdk-25-dbg - security update	Nessus	Debian Local Security Checks	2026/5/3	2026/5/3	high
318103	Ubuntu 25.10 / 26.04 LTS : CRaC JDK 25 vulnerabilities (USN-8334-1)	Nessus	Ubuntu Local Security Checks	2026/6/1	2026/6/1	high
309197	Oracle Java SE Multiple Vulnerabilities (April 2026 CPU)	Nessus	Misc.	2026/4/22	2026/4/24	high
318113	Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : OpenJDK 25 vulnerabilities (USN-8339-1)	Nessus	Ubuntu Local Security Checks	2026/6/1	2026/6/1	high
318171	Ubuntu 25.10 / 26.04 LTS : OpenJDK 26 vulnerabilities (USN-8341-1)	Nessus	Ubuntu Local Security Checks	2026/6/2	2026/6/2	high
309648	Linux Distros Unpatched Vulnerability : CVE-2026-22008	Nessus	Misc.	2026/4/22	2026/7/16	low
310406	OpenJDK 8 <= 8u482 / 11.0.0 <= 11.0.30 / 17.0.0 <= 17.0.18 / 21.0.0 <= 21.0.10 / 25.0.0 <= 25.0.2 / 26.0.0 <= 26.0.0 Multiple Vulnerabilities (2026-04-21)	Nessus	Misc.	2026/4/27	2026/4/27	high

检测

插件搜索

high

high

high

high

high

high

high

high

low

high