The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check     for hardlink entries uses different path resolution semantics than the actual hardlink creation logic.
    This mismatch allows an attacker to craft a malicious TAR archive that bypasses path traversal protections     and creates hardlinks to arbitrary files outside the extraction directory. Version 7.5.7 contains a fix     for the issue. (CVE-2026-24842)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Atlassian Jira Service Management Data Center and Server (Jira Service Desk) running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-16529 advisory.

  - node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check     for hardlink entries uses different path resolution semantics than the actual hardlink creation logic.
    This mismatch allows an attacker to craft a malicious TAR archive that bypasses path traversal protections     and creates hardlinks to arbitrary files outside the extraction directory. Version 7.5.7 contains a fix     for the issue. (CVE-2026-24842)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:18480 advisory.

    The Intel SGX SDK is a collection of APIs, libraries, documentations and tools that allow software     developers to create and debug Intel SGX enabled applications in C/C++.

    Security Fix(es):

    * qs: qs: Denial of Service via improper input validation in array parsing (CVE-2025-15284)

    * node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in     archives (CVE-2026-23745)

    * node-tar: tar: node-tar: Arbitrary file overwrite via Unicode path collision race condition     (CVE-2026-23950)

    * lodash: prototype pollution in _.unset and _.omit functions (CVE-2025-13465)

    * node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check     (CVE-2026-24842)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 10 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:18868 advisory.

    The Intel SGX SDK is a collection of APIs, libraries, documentations and tools that allow software     developers to create and debug Intel SGX enabled applications in C/C++.

    Security Fix(es):

    * qs: qs: Denial of Service via improper input validation in array parsing (CVE-2025-15284)

    * node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in     archives (CVE-2026-23745)

    * node-tar: tar: node-tar: Arbitrary file overwrite via Unicode path collision race condition     (CVE-2026-23950)

    * lodash: prototype pollution in _.unset and _.omit functions (CVE-2025-13465)

    * node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check     (CVE-2026-24842)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:18868 advisory.

    * qs: qs: Denial of Service via improper input validation in array parsing (CVE-2025-15284)

    * node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in     archives (CVE-2026-23745)

    * node-tar: tar: node-tar: Arbitrary file overwrite via Unicode path collision race condition     (CVE-2026-23950)

    * lodash: prototype pollution in _.unset and _.omit functions (CVE-2025-13465)

    * node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check     (CVE-2026-24842)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-18480 advisory.

    [2.26-7]
    - Fix pccs npm security flaws

    [2.26-6]
    - Port to pycryptography and pyasn1 and make keyring optional

    [2.26-5]
    - Sync specfile changes from Fedora

    [2.26-4]
    - Drop sgx-mpa dep from sgx-pccs

    [2.26-3]
    - Add scriptlets for PCCS

    [2.26-2]
    - Enable pccsadmin everywhere

    [2.26-1]
    - Update to SGX 2.26 / DCAP 1.23, adding PCCS service

    [2.25-7]
    - Trigger udev to set perms on /dev/sgx_provision

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
297040	Linux Distros Unpatched Vulnerability : CVE-2026-24842	Nessus	Misc.	2026/1/28	2026/7/19	high
305912	Atlassian Jira Service Management Data Center and Server 5.15.2 < 10.3.18 / 10.4.x < 11.3.3 (JSDSERVER-16529)	Nessus	Misc.	2026/4/10	2026/4/10	high
315307	RHEL 10 : linux-sgx (RHSA-2026:18480)	Nessus	Red Hat Local Security Checks	2026/5/19	2026/5/19	high
315374	RHEL 9 : linux-sgx (RHSA-2026:18868)	Nessus	Red Hat Local Security Checks	2026/5/19	2026/5/19	high
317439	RockyLinux 9 : linux-sgx (RLSA-2026:18868)	Nessus	Rocky Linux Local Security Checks	2026/5/28	2026/5/28	high
327008	Oracle Linux 10 : linux-sgx (ELSA-2026-18480)	Nessus	Oracle Linux Local Security Checks	2026/7/15	2026/7/15	high

检测

插件搜索

high

high

high

high

high

high