The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1159-1 advisory.

    - CVE-2026-32776: NULL pointer dereference when processing empty external parameter entities inside an     entity       declaration value (bsc#1259726).
    - CVE-2026-32777: denial of service due to infinite loop in DTD content parsing (bsc#1259711).
    - CVE-2026-32778: NULL pointer dereference in `setContext` on retry after an out-of-memory condition     (bsc#1259729).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the expat packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    libexpat before 2.7.5 allows an infinite loop while parsing DTD content.(CVE-2026-32777)

    libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity     content.(CVE-2026-32776)

    libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML     document.(CVE-2026-41080)

    In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial     of service via moderately sized crafted XML input.(CVE-2026-45186)

    libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an     earlier ouf-of-memory condition.(CVE-2026-32778)

Tenable has extracted the preceding description block directly from the EulerOS expat security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the  package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    libexpat before 2.7.5 allows an infinite loop while parsing DTD content.(CVE-2026-32777)

    libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity     content.(CVE-2026-32776)

    libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML     document.(CVE-2026-41080)

    In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial     of service via moderately sized crafted XML input.(CVE-2026-45186)

    libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an     earlier ouf-of-memory condition.(CVE-2026-32778)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the expat package has been released.

According to the versions of the expat packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an     earlier ouf-of-memory condition.(CVE-2026-32778)

    libexpat before 2.7.5 allows an infinite loop while parsing DTD content.(CVE-2026-32777)

    libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity     content.(CVE-2026-32776)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization expat security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of firefox installed on the remote host is prior to 140.8.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2FIREFOX-2026-055 advisory.

    A flaw was found in libexpat. A remote attacker could exploit this vulnerability by providing specially     crafted XML content with empty external parameter entities. This could lead to a NULL pointer dereference,     causing the application to crash and resulting in a Denial of Service (DoS). (CVE-2026-32776)

    A flaw was found in libexpat. A remote attacker could exploit this vulnerability by providing specially     crafted Document Type Definition (DTD) content. This could lead to an infinite loop during parsing,     resulting in a Denial of Service (DoS) for the application using libexpat. (CVE-2026-32777)

    A flaw was found in libexpat. This vulnerability allows an attacker to trigger a NULL pointer dereference     in the `setContext` function. This occurs when the system attempts to retry an operation after an out-of-     memory condition, which can lead to a Denial of Service (DoS) for the affected application.
    (CVE-2026-32778)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1870-1 advisory.

    This update for mozjs115 fixes the following issues

    - CVE-2026-32776: libexpat: NULL pointer dereference when processing empty external parameter entities     inside an entity       declaration value (bsc#1259728).
    - CVE-2026-32777: libexpat: denial of service due to infinite loop in DTD content parsing (bsc#1259713).
    - CVE-2026-32778: libexpat: NULL pointer dereference in `setContext` on retry after an out-of-memory     condition       (bsc#1259731).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1956-1 advisory.

    This update for mozjs78 fixes the following issues

    - CVE-2026-32776: libexpat: NULL pointer dereference when processing empty external parameter entities     inside an entity       declaration value (bsc#1259728).
    - CVE-2026-32777: libexpat: denial of service due to infinite loop in DTD content parsing (bsc#1259713).
    - CVE-2026-32778: libexpat: NULL pointer dereference in `setContext` on retry after an out-of-memory     condition       (bsc#1259731).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6404 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6404-1                   security@debian.org     https://www.debian.org/security/                                  Aron Xu     July 30, 2026                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : expat     CVE ID         : CVE-2025-59375 CVE-2026-24515 CVE-2026-25210 CVE-2026-32776                      CVE-2026-32777 CVE-2026-32778 CVE-2026-41080 CVE-2026-45186                      CVE-2026-50219 CVE-2026-56131 CVE-2026-56132 CVE-2026-56403                      CVE-2026-56404 CVE-2026-56405 CVE-2026-56406 CVE-2026-56407                      CVE-2026-56408 CVE-2026-56409 CVE-2026-56410 CVE-2026-56411                      CVE-2026-56412

    Multiple security issues were discovered in expat, an XML parsing C library,     including integer overflows, out-of-bounds write, NULL pointer dereferences,     excessive resource consumption, and memory corruption through re-entrant     parser API calls, which may result in denial of service or potentially the     execution of arbitrary code.

    For the stable distribution (trixie), this problem has been fixed in     version 2.8.2-1~deb13u1.

    We recommend that you upgrade your expat packages.

    For the detailed security status of expat please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/expat

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an     earlier ouf-of-memory condition. (CVE-2026-32778)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to the versions of the expat packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an     earlier ouf-of-memory condition.(CVE-2026-32778)

    libexpat before 2.7.5 allows an infinite loop while parsing DTD content.(CVE-2026-32777)

    libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity     content.(CVE-2026-32776)

Tenable has extracted the preceding description block directly from the EulerOS expat security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1817-1 advisory.

    This update for mozjs60 fixes the following issues

    - CVE-2026-32776: libexpat: NULL pointer dereference when processing empty external parameter entities     inside an entity       declaration value (bsc#1259728).
    - CVE-2026-32777: libexpat: denial of service due to infinite loop in DTD content parsing (bsc#1259713).
    - CVE-2026-32778: libexpat: NULL pointer dereference in `setContext` on retry after an out-of-memory     condition       (bsc#1259731).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the expat package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    libexpat before 2.7.5 allows an infinite loop while parsing DTD content.(CVE-2026-32777)

    libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity     content.(CVE-2026-32776)

    libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML     document.(CVE-2026-41080)

    In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial     of service via moderately sized crafted XML input.(CVE-2026-45186)

    libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an     earlier ouf-of-memory condition.(CVE-2026-32778)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization expat security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
304483	SUSE SLES12 Security Update : expat (SUSE-SU-2026:1159-1)	Nessus	SuSE Local Security Checks	2026/4/1	2026/4/1	medium
326155	EulerOS 2.0 SP12 : expat (EulerOS-SA-2026-2526)	Nessus	Huawei Local Security Checks	2026/7/10	2026/7/10	high
328632	EulerOS Virtualization 2.12.1 (EulerOS-SA-2026-2725)	Nessus	Huawei Local Security Checks	2026/7/21	2026/7/21	high
310094	Photon OS 5.0: Expat PHSA-2026-5.0-0830	Nessus	PhotonOS Local Security Checks	2026/4/24	2026/4/24	medium
320740	EulerOS Virtualization 2.13.0 : expat (EulerOS-SA-2026-2398)	Nessus	Huawei Local Security Checks	2026/6/12	2026/6/12	medium
304599	Amazon Linux 2 : firefox, --advisory ALAS2FIREFOX-2026-055 (ALASFIREFOX-2026-055)	Nessus	Amazon Linux Local Security Checks	2026/4/1	2026/4/1	medium
315059	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : mozjs115 (SUSE-SU-2026:1870-1)	Nessus	SuSE Local Security Checks	2026/5/16	2026/5/16	medium
315277	SUSE SLES15 Security Update : mozjs78 (SUSE-SU-2026:1956-1)	Nessus	SuSE Local Security Checks	2026/5/19	2026/5/19	medium
330837	Debian dsa-6404 : expat - security update	Nessus	Debian Local Security Checks	2026/7/30	2026/7/30	high
302512	Linux Distros Unpatched Vulnerability : CVE-2026-32778	Nessus	Misc.	2026/3/16	2026/7/30	medium
323185	EulerOS 2.0 SP15 : expat (EulerOS-SA-2026-2480)	Nessus	Huawei Local Security Checks	2026/6/27	2026/6/27	medium
315055	SUSE SLED15 / SLES15 Security Update : mozjs60 (SUSE-SU-2026:1817-1)	Nessus	SuSE Local Security Checks	2026/5/16	2026/5/16	medium
328640	EulerOS Virtualization 2.12.0 : expat (EulerOS-SA-2026-2771)	Nessus	Huawei Local Security Checks	2026/7/21	2026/7/21	high

检测

插件搜索

medium

high

high

medium

medium

medium

medium

medium

high

medium

medium

medium

high