The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-1458:04 advisory.

    * github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in     remote read endpoint (CVE-2026-42154)
      * github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via     config API (CVE-2026-42151)
      * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)
      * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode     label processing (CVE-2026-39821)
      * golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting     (CVE-2026-25681)
      * crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries     (CVE-2026-27145)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RLSA-2026:34359 advisory.

    * github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in     remote read endpoint (CVE-2026-42154)

    * github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via     config API (CVE-2026-42151)

    * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)

    * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label     processing (CVE-2026-39821)

    * golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting     (CVE-2026-25681)

    * crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries     (CVE-2026-27145)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RLSA-2026:34357 advisory.

    * github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in     remote read endpoint (CVE-2026-42154)

    * github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via     config API (CVE-2026-42151)

    * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)

    * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label     processing (CVE-2026-39821)

    * golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting     (CVE-2026-25681)

    * crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries     (CVE-2026-27145)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:34357 advisory.

    Collector with the supported components for a Red Hat build of OpenTelemetry

    Security Fix(es):

    * github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in     remote read endpoint (CVE-2026-42154)

    * github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via     config API (CVE-2026-42151)

    * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)

    * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label     processing (CVE-2026-39821)

    * golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting     (CVE-2026-25681)

    * crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries     (CVE-2026-27145)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:36796 advisory.

    Red Hat Edge Manager (RHEM) provides simple, scalable, and security-focused     management of edge devices and applications. It supports image-mode RHEL and     container workloads that run on Podman/Docker or Kubernetes.

    RHEM is now available as a standalone feature, providing greater flexibility for     edge deployments. In addition to the standalone version, RHEM continues to be     offered as a plugin for the following platforms:

    Red Hat Advanced Cluster Management (RHACM): Extends fleet management to edge     devices.
    Red Hat Ansible Automation Platform (AAP): Integrates edge management with     Ansible automation.

    This integration enables organizations to optimize the management and     orchestration of their fleets of edge devices; whether its thousands of     dispersed retail point-of-sale systems or industrial machinery on remote factory     floors.

    Value for customers and partners:

    * This solution not only helps customers manage thousands of devices but helps     scale operations.
    * To manage large-scale deployments, customers need to be able to integrate with     their existing management systems, support remote configuration and over-the-air     updates, and collect telemetry data for advanced analytics.
    * Red Hat Edge Manager offers a simple and security-focused lifecycle     management, from onboarding to decommissioning of edge devices.

    This complete end-to-end solution empowers organizations to gain the most value     from the fleets of devices that generate data, all from a centralized location.

    Security fixes:

    * golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate (CVE-2026-39835)
    * golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses     (CVE-2026-39830)
    * golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters     (CVE-2026-39829)
    * golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions (CVE-2026-39828)
    * golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation (CVE-2026-46595)
    * golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions     (CVE-2026-39832)
    * golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey (CVE-2026-42508)
    * golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)
    * Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)
    * Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281)
    * Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application     (CVE-2026-33810)
    * Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)
    * Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)
    * Go crypto/x509: Incorrect enforcement of email constraints (CVE-2026-27137)
    * Go net/url: Incorrect parsing of IPv6 host literals (CVE-2026-25679)
    * golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729)
    * github.com/jackc/pgx: Memory-safety vulnerability (CVE-2026-33815)
    * github.com/jackc/pgx: Memory-safety vulnerability (CVE-2026-33816)
    * gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186)
    * Prometheus: Information disclosure of Azure OAuth client secret via config API (CVE-2026-42151)
    * Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint     (CVE-2026-42154)
    * Root.Chmod can follow symlinks out of the root (CVE-2026-32282)
    * Kubelet, CRI-O, kube-apiserver: Denial of Service via SPDY streaming code (CVE-2026-35469)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-ebaf2bfd71 advisory.

    Update to 3.12.0

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:34357 advisory.

    * github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in     remote read endpoint (CVE-2026-42154)
      * github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via     config API (CVE-2026-42151)
      * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)
      * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode     label processing (CVE-2026-39821)
      * golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting     (CVE-2026-25681)
      * crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries     (CVE-2026-27145)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:34359 advisory.

    Collector with the supported components for a Red Hat build of OpenTelemetry

    Security Fix(es):

    * github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in     remote read endpoint (CVE-2026-42154)

    * github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via     config API (CVE-2026-42151)

    * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)

    * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label     processing (CVE-2026-39821)

    * golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting     (CVE-2026-25681)

    * crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries     (CVE-2026-27145)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:53413 advisory.

    Collector with the supported components for a Red Hat build of OpenTelemetry

    Security Fix(es):

    * github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in     remote read endpoint (CVE-2026-42154)

    * github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via     config API (CVE-2026-42151)

    * apache-thrift: Apache Thrift: Denial of Service via multiple vulnerabilities (CVE-2026-43870)

    * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)

    * golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect     Punycode label processing (CVE-2026-39821)

    * golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass     (CVE-2026-27136)

    * golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting     (CVE-2026-25681)

    * crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries     (CVE-2026-27145)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:53415 advisory.

    Collector with the supported components for a Red Hat build of OpenTelemetry

    Security Fix(es):

    * github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in     remote read endpoint (CVE-2026-42154)

    * github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via     config API (CVE-2026-42151)

    * apache-thrift: Apache Thrift: Denial of Service via multiple vulnerabilities (CVE-2026-43870)

    * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)

    * golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect     Punycode label processing (CVE-2026-39821)

    * golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass     (CVE-2026-27136)

    * golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting     (CVE-2026-25681)

    * crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries     (CVE-2026-27145)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
332231	MiracleLinux 9 : opentelemetry-collector-0.152.1-1.el9_8 (AXSA:2026-1458:04)	Nessus	Miracle Linux Local Security Checks	2026/8/5	2026/8/5	high
325275	RockyLinux 9 : opentelemetry-collector (RLSA-2026:34359)	Nessus	Rocky Linux Local Security Checks	2026/7/6	2026/7/6	high
325384	RockyLinux 10 : opentelemetry-collector (RLSA-2026:34357)	Nessus	Rocky Linux Local Security Checks	2026/7/7	2026/7/7	high
324605	RHEL 10 : opentelemetry-collector (RHSA-2026:34357)	Nessus	Red Hat Local Security Checks	2026/7/1	2026/7/1	high
325733	RHEL 9 : Red Hat Edge Manager Version 1.0.3 Security Update (Important) (RHSA-2026:36796)	Nessus	Red Hat Local Security Checks	2026/7/9	2026/8/4	high
322124	Fedora 44 : prometheus (2026-ebaf2bfd71)	Nessus	Fedora Local Security Checks	2026/6/22	2026/6/22	low
325496	AlmaLinux 10 : opentelemetry-collector (ALSA-2026:34357)	Nessus	Alma Linux Local Security Checks	2026/7/7	2026/7/7	high
324597	RHEL 9 : opentelemetry-collector (RHSA-2026:34359)	Nessus	Red Hat Local Security Checks	2026/7/1	2026/7/1	high
334538	RHEL 10 : opentelemetry-collector (RHSA-2026:53413)	Nessus	Red Hat Local Security Checks	2026/8/11	2026/8/11	high
334549	RHEL 9 : opentelemetry-collector (RHSA-2026:53415)	Nessus	Red Hat Local Security Checks	2026/8/11	2026/8/11	high

检测

插件搜索

high

high

high

high

high

low

high

high

high

high