The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-2dfcf9d705 advisory.

    Automatic update for python3.12-3.12.13-3.fc45.

    ##### **Changelog**

    ```
    * Thu Apr 16 2026 Charalampos Stratakis <cstratak@redhat.com> - 3.12.13-3
    - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-6100, CVE-2026-2297, CVE-2026-3644,     CVE-2026-4224     Resolves: rhbz#2444705, rhbz#2448189, rhbz#2448205, rhbz#2457942, rhbz#2458014, rhbz#2458222

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-f684007460 advisory.

    Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-6100, CVE-2026-2297, CVE-2026-3644,     CVE-2026-4224

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-d494efe6a9 advisory.

    New prerelease version


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-ff5da930eb advisory.

    Update to python-3.11.15, backport fixes for CVE-2026-4519, CVE-2026-3644, CVE-2026-4224, CVE-2026-2297

    ----

    Update to python-3.11.15.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-952616f3d6 advisory.

    Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-6100, CVE-2026-2297, CVE 2026-3644,     CVE-2026-4224

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:10950 advisory.

    * expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small     document that is submitted for parsing (CVE-2025-59375)

    * python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075)

    * cpython: Out-of-memory when loading Plist (CVE-2025-13837)

    * cpython: Header injection via newlines in data URL mediatype in Python (CVE-2025-15282)

    * cpython: Header injection in http.cookies.Morsel in Python (CVE-2026-0672)

    * cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297)

    * cpython: Incomplete control character validation in http.cookies (CVE-2026-3644)

    * cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224)

    * python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502)

    * python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression     modules (CVE-2026-6100)

    * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API     (CVE-2026-4786)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1354-1 advisory.

    - Update to v3.13.13
    - CVE-2025-13462: incorrect parsing of TarInfo header when GNU long name and type AREGTYPE are combined     (bsc#1259611).
    - CVE-2026-2297: cpython: incorrectly handled hook in FileLoader can lead to validation bypass     (bsc#1259240).
    - CVE-2026-3479: python: improper resource argument validation can allow path traversal (bsc#1259989).
    - CVE-2026-3644: incomplete control character validation in http.cookies (bsc#1259734).
    - CVE-2026-4224: C stack overflow when parsing XML with deeply nested DTD content models (bsc#1259735).
    - CVE-2026-4519: leading dashes in URLs are accepted by the `webbrowser.open()` API and allow for web     browser command line option injection (bsc#1260026).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-13c6899032 advisory.

    Update to 3.13.13


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1583 advisory.

    When folding a long comment in an email header containing exclusively unfoldable characters, the     parenthesis would not be preserved. This could be used for injecting headers into email messages where     addresses are user-controlled and not sanitized. (CVE-2025-11468)

    User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in     the data URL mediatype. (CVE-2025-15282)

    When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP     headers into messages. Patch rejects all control characters within cookie names, values, and parameters.
    (CVE-2026-0672)

    User-controlled header names and values containing newlines can allow injecting HTTP headers.
    (CVE-2026-0865)

    The email module, specifically the BytesGenerator class, didn't properly quote newlines for email     headers when serializing an email message allowing for header injection when an email is serialized. This     is only applicable if using LiteralHeader writing headers that don't respect email folding rules, the     new behavior will reject the incorrectly folded headers in BytesGenerator. (CVE-2026-1299)

    The import hook in CPython that handles legacy *.pyc files (SourcelessFileLoader) is incorrectly handled     in FileLoader (a base class) and so does not use io.open_code() to read the .pyc files. sys.audit handlers     for this audit event therefore do not fire. (CVE-2026-2297)

    When an Expat parser with a registered ElementDeclHandler parses an inlinedocument type definition     containing a deeply nested content model a C stackoverflow occurs. (CVE-2026-4224)

    The webbrowser.open() API would accept leading dashes in the URL whichcould be handled as command line     options for certain web browsers. Newbehavior rejects leading dashes. Users are recommended to sanitize     URLsprior to passing to webbrowser.open(). (CVE-2026-4519)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1349-1 advisory.

    - Updated to Python 3.11.15
    - CVE-2025-6075: If the value passed to os.path.expandvars() is user-controlled a performance degradation     is possible when expanding environment variables (bsc#1252974).
    - CVE-2025-11468: header injection when folding a long comment in an email header containing exclusively     unfoldable characters (bsc#1257029).
    - CVE-2025-12084: cpython: python: cpython: Quadratic algorithm in xml.dom.minidom leads to denial of     service (bsc#1254997).
    - CVE-2025-13462: incorrect parsing of TarInfo header when GNU long name and type AREGTYPE are combined     (bsc#1259611).
    - CVE-2025-13836: When reading an HTTP response from a server, if no read amount is specified, the default     behavior will be to use Content-Length (bsc#1254400).
    - CVE-2025-13837: When loading a plist file, the plistlib module reads data in size specified by the file     itself, meaning a malicious file can cause OOM and DoS issues (bsc#1254401).
    - CVE-2025-15282: user-controlled data URLs parsed may allow injecting headers (bsc#1257046).
    - CVE-2026-0672: HTTP header injection via user-controlled cookie values and parameters when using     http.cookies.Morsel (bsc#1257031).
    - CVE-2026-0865: user-controlled header containing newlines can allow injecting HTTP headers     (bsc#1257042).
    - CVE-2026-1299: header injection when an email is serialized due to improper newline quoting in     `BytesGenerator` (bsc#1257181).
    - CVE-2026-2297: cpython: incorrectly handled hook in FileLoader can lead to validation bypass     (bsc#1259240).
    - CVE-2026-3479: python: improper resource argument validation can allow path traversal (bsc#1259989).
    - CVE-2026-3644: incomplete control character validation in http.cookies (bsc#1259734).
    - CVE-2026-4224: C stack overflow when parsing XML with deeply nested DTD content models (bsc#1259735).
    - CVE-2026-4519: leading dashes in URLs are accepted by the `webbrowser.open()` API and allow for web     browser command line option injection (bsc#1260026).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:10950 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small     document that is submitted for parsing (CVE-2025-59375)

    * python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075)

    * cpython: Out-of-memory when loading Plist (CVE-2025-13837)

    * cpython: Header injection via newlines in data URL mediatype in Python (CVE-2025-15282)

    * cpython: Header injection in http.cookies.Morsel in Python (CVE-2026-0672)

    * cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297)

    * cpython: Incomplete control character validation in http.cookies (CVE-2026-3644)

    * cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224)

    * python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502)

    * python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression     modules (CVE-2026-6100)

    * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API     (CVE-2026-4786)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The import hook in CPython that handles legacy *.pyc files (SourcelessFileLoader) is incorrectly handled     in FileLoader (a base class) and so does not use io.open_code() to read the .pyc files. sys.audit handlers     for this audit event therefore do not fire. (CVE-2026-2297)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-dd34c4467b advisory.

    Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-6100, CVE-2026-2297, CVE 2026-3644,     CVE-2026-4224

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-884eccdb03 advisory.

    New minor version of the Python interpreter

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1107-1 advisory.

    Update to Python 3.12.13:

    - CVE-2025-6075: quadratic complexity in os.path.expandvars() (bsc#1252974).
    - CVE-2025-11468: header injection with carefully crafted inputs (bsc#1257029).
    - CVE-2025-12084: quadratic complexity in xml.minidom node ID cache clearing (bsc#1254997).
    - CVE-2025-13836: potential memory denial of service in the http.client module (bsc#1254400).
    - CVE-2025-13837: potential memory denial of service in the plistlib module (bsc#1254401).
    - CVE-2025-15282: user-controlled data URLs parsed may allow injecting headers (bsc#1257046).
    - CVE-2026-0672: control characters in http.cookies.Morsel fields and values (bsc#1257031).
    - CVE-2026-0865: C0 control characters within wsgiref.headers.Headers fields, values, and parameters     (bsc#1257042).
    - CVE-2026-1299: header injection when an email is serialized due to improper newline quoting     (bsc#1257181).
    - CVE-2026-2297: validation bypass via incorrectly handled hook in FileLoader (bsc#1259240).

    Changelog:
     - gh-144125: BytesGenerator will now refuse to serialize      (write) headers that are unsafely folded or delimited; see      verify_generated_headers. (Contributed by Bas Bloemsaat and      Petr Viktorin in gh-121650) (bsc#1257181, CVE-2026-1299).
     - gh-143935: Fixed a bug in the folding of comments when      flattening an email message using a modern email policy.
     Comments consisting of a very long sequence of non-foldable      characters could trigger a forced line wrap that omitted      the required leading space on the continuation line,      causing the remainder of the comment to be interpreted as      a new header field. This enabled header injection with      carefully crafted inputs (bsc#1257029 CVE-2025-11468).
     - gh-143925: Reject control characters in data: URL media      types (bsc#1257046, CVE-2025-15282).
     - gh-143919: Reject control characters in http.cookies.Morsel      fields and values (bsc#1257031, CVE-2026-0672).
     - gh-143916: Reject C0 control characters within      wsgiref.headers.Headers fields, values, and parameters      (bsc#1257042, CVE-2026-0865).
     - gh-142145: Remove quadratic behavior in xml.minidom node ID      cache clearing. In order to do this without breaking      existing users, we also add the ownerDocument attribute to      xml.dom.minidom elements and attributes created by directly      instantiating the Element or Attr class. Note that this way      of creating nodes is not supported; creator functions like      xml.dom.Document.documentElement() should be used instead      (bsc#1254997, CVE-2025-12084).
     - gh-137836: Add support of the 'plaintext' element, RAWTEXT      elements 'xmp', 'iframe', 'noembed' and 'noframes', and      optionally RAWTEXT element 'noscript' in      html.parser.HTMLParser.
     - gh-136063: email.message: ensure linear complexity for      legacy HTTP parameters parsing. Patch by B?n?dikt Tran.
     - gh-136065: Fix quadratic complexity in      os.path.expandvars() (bsc#1252974, CVE-2025-6075).
     - gh-119451: Fix a potential memory denial of service in the      http.client module. When connecting to a malicious server,      it could cause an arbitrary amount of memory to be      allocated. This could have led to symptoms including      a MemoryError, swapping, out of memory (OOM) killed      processes or containers, or even system crashes      (CVE-2025-13836, bsc#1254400).
     - gh-119452: Fix a potential memory denial of service in the      http.server module. When a malicious user is connected to      the CGI server on Windows, it could cause an arbitrary      amount of memory to be allocated. This could have led to      symptoms including a MemoryError, swapping, out of memory      (OOM) killed processes or containers, or even system      crashes.
     - gh-119342: Fix a potential memory denial of service in the      plistlib module. When reading a Plist file received from      untrusted source, it could cause an arbitrary amount of      memory to be allocated. This could have led to symptoms      including a MemoryError, swapping, out of memory (OOM)      killed processes or containers, or even system crashes      (bsc#1254401, CVE-2025-13837).
     - Library
     - gh-144833: Fixed a use-after-free in ssl when SSL_new()      returns NULL in newPySSLSocket(). The error was reported      via a dangling pointer after the object had already been      freed.
     - gh-144363: Update bundled libexpat to 2.7.4
     - gh-90949: Add SetAllocTrackerActivationThreshold() and      SetAllocTrackerMaximumAmplification() to xmlparser objects      to prevent use of disproportional amounts of dynamic memory      from within an Expat parser. Patch by B?n?dikt Tran.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1117-1 advisory.

    Update to python 3.11.15:

    - CVE-2025-6075: quadratic complexity in os.path.expandvars() (bsc#1252974).
    - CVE-2025-11468: header injection with carefully crafted inputs (bsc#1257029).
    - CVE-2025-12084: quadratic complexity in xml.minidom node ID cache clearing (bsc#1254997).
    - CVE-2025-13836: potential memory denial of service in the http.client module (bsc#1254400).
    - CVE-2025-13837: potential memory denial of service in the plistlib module (bsc#1254401).
    - CVE-2025-15282: user-controlled data URLs parsed may allow injecting headers (bsc#1257046).
    - CVE-2026-0672: control characters in http.cookies.Morsel fields and values (bsc#1257031).
    - CVE-2026-0865: C0 control characters within wsgiref.headers.Headers fields, values, and parameters     (bsc#1257042).
    - CVE-2026-1299: header injection when an email is serialized due to improper newline quoting     (bsc#1257181).
    - CVE-2026-2297: validation bypass via incorrectly handled hook in FileLoader (bsc#1259240).

    Changelog:

     - gh-144125: BytesGenerator will now refuse to serialize      (write) headers that are unsafely folded or delimited; see      verify_generated_headers. (Contributed by Bas Bloemsaat and      Petr Viktorin in gh-121650) (bsc#1257181, CVE-2026-1299).
     - gh-143935: Fixed a bug in the folding of comments when      flattening an email message using a modern email policy.
     Comments consisting of a very long sequence of non-foldable      characters could trigger a forced line wrap that omitted      the required leading space on the continuation line,      causing the remainder of the comment to be interpreted as      a new header field. This enabled header injection with      carefully crafted inputs (bsc#1257029 CVE-2025-11468).
     - gh-143925: Reject control characters in data: URL media      types (bsc#1257046, CVE-2025-15282).
     - gh-143919: Reject control characters in http.cookies.Morsel      fields and values (bsc#1257031, CVE-2026-0672).
     - gh-143916: Reject C0 control characters within      wsgiref.headers.Headers fields, values, and parameters      (bsc#1257042, CVE-2026-0865).
     - gh-142145: Remove quadratic behavior in xml.minidom node ID      cache clearing. In order to do this without breaking      existing users, we also add the ownerDocument attribute to      xml.dom.minidom elements and attributes created by directly      instantiating the Element or Attr class. Note that this way      of creating nodes is not supported; creator functions like      xml.dom.Document.documentElement() should be used instead      (bsc#1254997, CVE-2025-12084).
     - gh-137836: Add support of the 'plaintext' element, RAWTEXT      elements 'xmp', 'iframe', 'noembed' and 'noframes', and      optionally RAWTEXT element 'noscript' in      html.parser.HTMLParser.
     - gh-136063: email.message: ensure linear complexity for      legacy HTTP parameters parsing. Patch by B?n?dikt Tran.
     - gh-136065: Fix quadratic complexity in      os.path.expandvars() (bsc#1252974, CVE-2025-6075).
     - gh-119451: Fix a potential memory denial of service in the      http.client module. When connecting to a malicious server,      it could cause an arbitrary amount of memory to be      allocated. This could have led to symptoms including      a MemoryError, swapping, out of memory (OOM) killed      processes or containers, or even system crashes      (CVE-2025-13836, bsc#1254400).
     - gh-119452: Fix a potential memory denial of service in the      http.server module. When a malicious user is connected to      the CGI server on Windows, it could cause an arbitrary      amount of memory to be allocated. This could have led to      symptoms including a MemoryError, swapping, out of memory      (OOM) killed processes or containers, or even system      crashes.
     - gh-119342: Fix a potential memory denial of service in the      plistlib module. When reading a Plist file received from      untrusted source, it could cause an arbitrary amount of      memory to be allocated. This could have led to symptoms      including a MemoryError, swapping, out of memory (OOM)      killed processes or containers, or even system crashes      (bsc#1254401, CVE-2025-13837).
     - Library
     - gh-144833: Fixed a use-after-free in ssl when SSL_new()      returns NULL in newPySSLSocket(). The error was reported      via a dangling pointer after the object had already been      freed.
     - gh-144363: Update bundled libexpat to 2.7.4
     - gh-90949: Add SetAllocTrackerActivationThreshold() and      SetAllocTrackerMaximumAmplification() to xmlparser objects      to prevent use of disproportional amounts of dynamic memory      from within an Expat parser. Patch by B?n?dikt Tran.
     - Core and Builtins
     - gh-120384: Fix an array out of bounds crash in      list_ass_subscript, which could be invoked via some      specificly tailored input: including concurrent      modification of a list object, where one thread assigns      a slice and another clears it.
     - gh-120298: Fix use-after free in list_richcompare_impl      which can be invoked via some specificly tailored evil      input.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
307390	Fedora 45 : python3.12 (2026-2dfcf9d705)	Nessus	Fedora Local Security Checks	2026/4/17	2026/4/17	critical
307483	Fedora 43 : python3.12 (2026-f684007460)	Nessus	Fedora Local Security Checks	2026/4/19	2026/4/19	critical
310433	Fedora 44 : python3.15 (2026-d494efe6a9)	Nessus	Fedora Local Security Checks	2026/4/27	2026/4/27	high
305021	Fedora 42 : mingw-python3 (2026-ff5da930eb)	Nessus	Fedora Local Security Checks	2026/4/5	2026/4/17	high
310595	Fedora 43 : python3.11 (2026-952616f3d6)	Nessus	Fedora Local Security Checks	2026/4/28	2026/4/28	critical
310642	RockyLinux 8 : python3.12 (RLSA-2026:10950)	Nessus	Rocky Linux Local Security Checks	2026/4/28	2026/4/28	critical
306689	SUSE SLED15 / SLES15 Security Update : python313 (SUSE-SU-2026:1354-1)	Nessus	SuSE Local Security Checks	2026/4/16	2026/4/16	high
310679	Fedora 42 : python3-docs / python3.13 (2026-13c6899032)	Nessus	Fedora Local Security Checks	2026/4/28	2026/4/28	medium
306206	Amazon Linux 2023 : python3, python3-devel, python3-idle (ALAS2023-2026-1583)	Nessus	Amazon Linux Local Security Checks	2026/4/13	2026/4/17	high
306693	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : python311 (SUSE-SU-2026:1349-1)	Nessus	SuSE Local Security Checks	2026/4/16	2026/4/16	high
310559	RHEL 8 : python3.12 (RHSA-2026:10950)	Nessus	Red Hat Local Security Checks	2026/4/27	2026/4/27	critical
301038	Linux Distros Unpatched Vulnerability : CVE-2026-2297	Nessus	Misc.	2026/3/6	2026/4/29	medium
307517	Fedora 42 : python3.11 (2026-dd34c4467b)	Nessus	Fedora Local Security Checks	2026/4/19	2026/4/19	critical
310436	Fedora 44 : python3-docs / python3.14 (2026-884eccdb03)	Nessus	Fedora Local Security Checks	2026/4/27	2026/4/27	medium
304121	SUSE SLES15 / openSUSE 15 Security Update : python312 (SUSE-SU-2026:1107-1)	Nessus	SuSE Local Security Checks	2026/3/28	2026/3/28	medium
304133	SUSE SLES15 Security Update : python311 (SUSE-SU-2026:1117-1)	Nessus	SuSE Local Security Checks	2026/3/28	2026/3/28	medium

检测

插件搜索

critical

critical

high

high

critical

critical

high

medium

high

high

critical

medium

critical

medium

medium

medium