The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21924-1 advisory.

    Changes in cloudflared:

    - Update version to 2026.9.1
      * Update vendor (boo#1278643, CVE-2026-56854, CVE-2026-78662, CVE-2026-56855)
      * Propagate edge registration errors over QUIC and fix supervisor error         classification
      * Negotiate protected mode during Quick Tunnel provisioning

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21927-1 advisory.

    Changes in apptainer:

    - Fix potential authentication bypass and deadlocks in the       crypto/ssh library by updating golang.org/x/crypto to v0.56.0.
      CVE-2026-56854,CVE-2026-78662,CVE-2026-56855 (bsc#1278666)
    - Fix
      * a potential DoS via crash due to missing ':authority' and         'Host' headers in gRPC-Go xDS servers CVE-2026-84445 (bsc#1279033),
      * a potential heap memory exhaustion via HTTP/2 DATA frame          fragmentation CVE-2026-84304 (bsc#1279236),
      * a potential bypass of authorization policies via mixed-case         or canonical-case header matches due to an xDS RBAC HTTP filter         implementation issue CVE-2026-84303 (bsc#1279333)       by updating google.golang.org/grpc to v1.83.2

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of rclone installed on the remote host is prior to 1.55.1-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3947 advisory.

    The source-address critical option in the Permissions returned by an authentication callback was only     enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for     CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback,     NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's     remote address, so a source-address restriction set by those callbacks was silently ignored. The check is     now applied to the Permissions returned by any authentication callback. (CVE-2026-56854)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4292-1 advisory.

    - CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing     allows for DoS       via oversized inputs (bsc#1276722).
    - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input     (bsc#1272118).
    - CVE-2026-56854: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library     (bsc#1278597).
    - CVE-2026-56855: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library     (bsc#1278597).
    - CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library     (bsc#1278597).
    - CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of     authorization       policies via mixed-case or canonical-case header matches (bsc#1279297).
    - CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation     (bsc#1279414).
    - CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in     gRPC-Go xDS       servers (bsc#1278967).

    Changes for google-osconfig-agent:

    - Update to version 20260908.00

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3129 advisory.

    On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root     when the final path component of the a path is a symbolic link and the path ends in /. For example,     'root.Open(symlink/)' will open symlink even when symlink is a symbolic link pointing outside of the     root. (CVE-2026-39822)

    Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a     disclosure of pre-shared key identities in the unencrypted client hello. (CVE-2026-42505)

    VP8L decoding in golang.org/x/image/vp8l can allocate an excessive amount of memory when processing a     crafted VP8L image containing many unused Huffman tree groups. This allows a remote attacker to cause a     denial of service via memory exhaustion. (CVE-2026-46603)

    The source-address critical option in the Permissions returned by an authentication callback was only     enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for     CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback,     NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's     remote address, so a source-address restriction set by those callbacks was silently ignored. The check is     now applied to the Permissions returned by any authentication callback. (CVE-2026-56854)

    Previously, after a channel has been established, a malicious peer could send crafted messages that would     deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled     explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of     buffering and blocking. (CVE-2026-56855)

    Rclone is a command-line program to sync files and directories to and from different cloud storage     providers. Prior to 1.74.4, rclone archive extract can write extracted files outside the user-selected     destination prefix when extracting a crafted archive containing parent path components such as ../,     allowing creation or overwrite of sibling objects in the same bucket or path scope. This issue is fixed in     version 1.74.4. (CVE-2026-59732)

    rclone is a command-line program to sync files and directories to and from different cloud storage     providers. From v1.51.0 until v1.75.0, the local backend in backend/local/local.go relies on the     configurable filename encoder to prevent remote filename data from becoming operating-system path syntax,     so a local destination using Slash, None, Raw, or on Windows an encoding that preserves backslash can     decode a standard-encoded fullwidth dot-dot component or native backslash form into an actual parent-     directory component before filepath.Join resolves it outside the configured local root, allowing an     attacker-controlled source object to create or overwrite files outside the selected destination directory     as the rclone process. This issue is fixed in v1.75.0. (CVE-2026-71313)

    Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious     peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an     atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every     packet other than the open confirmation/failure, without blocking and without tearing down the connection.
    (CVE-2026-78662)

    rclone versions >= v1.72.0 and <= v1.74.4 (fixed in v1.75.0) contain multiple denial-of-service     vulnerabilities in the archive backend's SquashFS parser, which relies on the github.com/diskfs/go-diskfs     dependency. The parser fails to validate attacker-controlled superblock and metadata values before use. An     attacker who can place or modify a SquashFS image in storage exposed through an rclone :archive: remote     can craft a malicious image that triggers an integer division-by-zero panic (zero block size), an out-of-     bounds slice panic (out-of-range inode metadata offset), or a non-progress CPU loop (truncated metadata     stream). Variants 1 and 2 terminate the rclone process and, via 'rclone serve sftp', can crash the entire     SFTP server; variant 3 causes sustained CPU consumption. Parsing is lazy, so a victim or remote client     must address or descend into the malicious archive object to trigger it. (CVE-2026-79775)

    rclone before 1.75.0 mounts the pprof debug handler as its own router route, bypassing the fail-closed     authentication rule in the main handler. Attackers can access the /debug/pprof/cmdline endpoint     unauthenticated to retrieve the full process argv including backend credentials. (CVE-2026-79776)

    rclone before v1.75.0 includes full Go stack traces in RC API error responses when panics occur. Attackers     can trigger panics to leak internal file paths, module versions, goroutine states, and memory addresses.
    (CVE-2026-79777)

    rclone before v1.75.0 contains a denial of service vulnerability in the WebDAV TUS creation handler that     dereferences a nil response before checking for transport errors. A malicious or compromised configured     endpoint can reset connections during TUS uploads to trigger a panic that terminates unrecovered     goroutines and halts unrelated work in long-lived processes. (CVE-2026-79778)

    rclone versions before v1.75.0 fail to reject transport downgrades in redirect handling, allowing Basic     authorization and Cookie headers to be replayed over plaintext HTTP after same-host HTTPS-to-HTTP     redirects. An on-path attacker observing the plaintext hop can capture and reuse credentials to perform     WebDAV operations with the compromised account's permissions. (CVE-2026-79779)

    rclone before v1.75.0 fails to sanitize IBM IAM bearer tokens and SSE-C encryption keys during S3 redirect     callbacks, allowing credentials to be preserved across scheme or host changes. Attackers observing network     traffic from a trusted endpoint can capture reusable IBM IAM tokens on same-host HTTPS-to-HTTP downgrades     or SSE-C keys on cross-origin redirects to access protected S3 objects. (CVE-2026-79780)

    rclone serve s3 before 1.74.4 contains a path traversal vulnerability that allows attackers to read and     overwrite root-level files by using dot-dot segments in S3 object keys. Attackers can send requests with     object keys like ../root-secret.txt to escape the bucket namespace and access files in the serve root     directory. (CVE-2026-79781)

    rclone before 1.74.4 fails to strip the X-Amz-Security-Token header when an S3 redirect changes scheme     from HTTPS to HTTP on the same host. Attackers can intercept plaintext HTTP traffic to capture AWS STS     session tokens sent in request headers. (CVE-2026-79782)

    rclone before 1.74.4 fails to mask special permission bits when applying source-supplied mode metadata in     the local backend, allowing attackers to set setuid/setgid bits on attacker-controlled files. When copying     with metadata preservation from an untrusted remote, attackers can plant a setuid binary that escalates     privileges to root if rclone runs as root, or to the service account user otherwise. (CVE-2026-79783)

    rclone is a command-line program to sync files and directories to and from different cloud storage     providers. From 1.49.0 until 1.75.1, the HTTP backend attaches headers configured through --http-headers     or headers= to requests in backend/http/http.go, while its fshttp.NewClient client follows redirects     without a backend-specific http.Client.CheckRedirect policy. A configured remote that redirects to another     host can therefore cause custom secrets such as X-Api-Key to be resent to that untrusted destination, and     a same-host HTTPS-to-HTTP redirect can expose Authorization or Cookie headers in cleartext. Listing, stat,     download, mount, and serve operations can trigger the leak during normal use. This issue is fixed in     version 1.75.1. (CVE-2026-88013)

    rclone is a command-line program to sync files and directories to and from different cloud storage     providers. From 1.72.0 until 1.75.1, the archive ZIP backend method (*Fs).readZip in     backend/archive/zip/zip.go accepts archive/zip.File.Name values from an untrusted central directory and     exposes cleaned entry names without ensuring that they remain inside the archive namespace. Entries such     as ../../etc/cron.d/evil can survive path.Clean and become Object.Remote() values that fs/sync and     fs/operations use as destination-relative paths, allowing rclone copy or sync to write outside the     selected destination on backends that do not independently confine the path. The non-empty root check also     used strings.HasPrefix without a path boundary, so root foo could incorrectly include sibling foobar     entries. This issue is fixed in version 1.75.1. (CVE-2026-88014)

    rclone is a command-line program to sync files and directories to and from different cloud storage     providers. Prior to 1.75.1, backend/local with --links or links=true exposes symlink targets as     .rclonelink objects, and fs.RangeOption.Decode can pass an unchecked positive Range start through     Object.Open and openTranslatedLink. The function slices the target string as linkdst[offset:], so a Range     start larger than the target length causes a deterministic slice-bounds panic when lib/http/serve exposes     the object through HTTP or WebDAV. Go net/http normally recovers the panic per connection, causing     request-level denial of service rather than terminating the entire process. This issue is fixed in version     1.75.1. (CVE-2026-88015)

    rclone is a command-line program to sync files and directories to and from different cloud storage     providers. Prior to 1.75.1, when backend/local runs with --links, a source .rclonelink object can plant a     symlink in the destination and later directory metadata is applied through that path. MkdirMetadata,     writeMetadataToFile, and setTimes operate when Directory.translatedLink=false, so os.Chown, os.Chmod,     os.Chtimes, and birth-time handling can bypass os.Root confinement and follow the symlink. An attacker     controlling source contents can therefore apply selected ownership, permissions, modification times, or     birth times to a file or directory outside the destination, with --metadata required for chmod and chown     while modification time is applied by the normal directory workflow. This issue is fixed in version     1.75.1. (CVE-2026-88016)

    rclone is a command-line program to sync files and directories to and from different cloud storage     providers. From 1.64.0 until 1.75.1, the FTP auth-proxy driver in cmd/serve/ftp/ftp.go stores one obscured     password per username in the server-wide userPass map[string]string instead of binding the credential or     VFS to the authenticated session. If two accepted credentials use the same username but resolve to     different proxy backends, a later CheckPasswd login overwrites userPass[user], and subsequent getVFS     operations on the first session are reauthorized with the later password. The first session can then read,     create, overwrite, rename, or delete objects using the second credential's backend authority. Exploitation     requires the later same-username login to occur while the first session remains open. This issue is fixed     in version 1.75.1. (CVE-2026-88017)

    rclone is a command-line program to sync files and directories to and from different cloud storage     providers. Prior to 1.75.1, rclone serve s3 configured with --auth-proxy but without --auth-key allows     authPairMiddleware to register any client-chosen accessKeyID with an empty ws.s3Secret. gofakes3 then     verifies the request's SigV4 signature against that same empty secret, while Server.auth passes the access     key identifier as both the user and authentication value to the proxy without an independent per-identity     secret. An unauthenticated network attacker can therefore choose an arbitrary access key, sign with an     empty secret, and reach whatever backend the auth-proxy script resolves for that identity. This issue is     fixed in version 1.75.1. (CVE-2026-88018)

    rclone is a command-line program to sync files and directories to and from different cloud storage     providers. From 1.70.0 until 1.75.1, the serve/start RC interface accepts per-server proxyOpt.AuthProxy     settings, and the FTP and S3 constructors in cmd/serve/ftp/ftp.go and cmd/serve/s3/server.go incorrectly     check the process-global proxy.Opt.AuthProxy value instead. When the global value is empty, the request-     local authentication proxy is ignored: FTP falls back to the fixed filesystem with username anonymous and     any password, while S3 with AuthKey serves the fixed RC fs rather than the backend selected by the proxy.
    The dedicated command-line servers that configure the global option are not affected. This issue is fixed     in version 1.75.1. (CVE-2026-88044)

    rclone is a command-line program to sync files and directories to and from different cloud storage     providers. Prior to 1.75.1, rclone core does not reject parent-directory segments in source     Object.Remote() values before fs/list, fs/walk, fs/sync, and fs/operations pass those values to     destination backends. A flat-keyspace source object store populated with native non-rclone tooling can     contain a raw .. key segment, and affected b2, swift, qingstor, oracleobjectstorage, internetarchive, smb,     storj, sftp, webdav, ftp, filelu, shade, and sia destinations use path.Join(root, remote) before EncodeDot     can neutralize the segment. A copy or upload can therefore escape the configured root into another bucket,     share, or path reachable by the victim credential, with sftp and smb potentially reaching other filesystem     or share locations under the same login authority. This issue is fixed in version 1.75.1. (CVE-2026-88046)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The source-address critical option in the Permissions returned by an authentication callback was only     enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for     CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback,     NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's     remote address, so a source-address restriction set by those callbacks was silently ignored. The check is     now applied to the Permissions returned by any authentication callback. (CVE-2026-56854)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21861-1 advisory.

    Changes in gh:

    Update to version 2.100.0, fixing two deadlock issues in the vendored     golang.org/x/crypto/ssh library reachable via crafted SSH channel     messages (CVE-2026-56854, CVE-2026-56855, CVE-2026-78662, bsc#1278604):

    * Fix gh api telemetry disablement
    * Bump go-gh to v2.16.0
    * Expose per-host API host config
    * chore: bump toolchain to go1.26.8
    * chore: bump golang.org/x/crypto to 0.56.0
    * Record attachment invocation telemetry
    * Add webhook as an official extension
    * Merge pull request #14318 from cli/issue-triage-improvements
    * Refine GHES support wording
    * Use version-neutral GHES support link
    * Clarify supported GHES versions
    * Bump go-gh to v2.15.0
    * Remove redundant searcher comment
    * Remove unnecessary 204 on release edit
    * Remove redundant comment in gist create
    * Comment api command api_host usage
    * Comment missing api-client-rollout todo
    * Document when telemetry disabling is overzealous
    * Refactor AddAuthTokenHeader
    * Rename tokenGetter to config
    * build(deps): bump go-gh to rebased per-host api_host branch
    * refactor(attachments): send uploads through api.Client.DoRequest
    * test(internal/attachments): add new method required by interface
    * fix(api): compare request hostname without port when attaching auth token
    * test(acceptance): fix scriptfilter table field alignment
    * build(deps): bump go-gh to per-host api_host branch
    * chore(codeql): cover api.Client.Request in SafeURL path query
    * fix(auth/shared): route GetScopes path through safeurl
    * test(config): add coverage for APIHostForHost
    * test(config): cover deterministic api_host collision resolution
    * test(api): assert DoRequest preserves an explicit ContentLength
    * test(acceptance): cover selecting multiple scripts in one directory
    * refactor(api): use errors.AsType for HTTP error checks
    * fix(config): resolve api_host collisions deterministically
    * docs(api): clarify redirect method-rewriting in comments
    * Send release asset uploads and downloads through api.Client
    * Let callers set headers on a shared client request
    * Let a caller stop a request following redirects
    * Let a caller name the scopes an endpoint needs
    * Add a raw response request surface to api.Client
    * Send RenameRepo to a relative path
    * Make gh api honour api_host for relative paths
    * Send a host's token to its configured api_host
    * Add the api_host gateway harness
    * Let GH_ACCEPTANCE_SCRIPT name several scripts
    * Wait longer for the search index in the issues script
    * Add acceptance coverage for gist
    * Fix discussion acceptance test flags
    * Resolve aliases to their target when rendering full help on error
    * Print full help on command misuse for invoking agents

    Update to version 2.99.0:

    * Add repeatable --attach flag to upload local images/videos to       issues, pull requests, and comments (max 50 files per call)
    * Add worktree checkout support to gh issue develop --checkout
      --worktree
    * Fix repo sync to avoid corrupting a linked worktree and to       explain when the target branch is checked out elsewhere
    * Fix pr merge --delete-branch to safely handle linked worktrees
    * Reject --comments combined with --json on view commands

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4209-1 advisory.

    - CVE-2025-58058: github.com/ulikunitz/xz: github.com/ulikunitz/xz leaks memory (bsc#1248946).
    - CVE-2026-25680: golang.org/x/net/html: denial of service when parsing arbitrary HTML (bsc#1267176).
    - CVE-2026-25681: golang.org/x/net/html: incorrect handling of character references in DOCTYPE nodes     (bsc#1267176).
    - CVE-2026-27136: golang.org/x/net/html: duplicate attributes can cause XSS (bsc#1267176).
    - CVE-2026-42502: golang.org/x/net/html: incorrect handling of HTML elements in foreign content     (bsc#1267176).
    - CVE-2026-42506: golang.org/x/net/html: incorrect handling of namespaced elements in foreign content     (bsc#1267176).
    - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad     SETTINGS_MAX_FRAME_SIZE       (bsc#1265799).
    - CVE-2026-34986: github.com/go-jose/go-jose/v3: crafted JWE input with a missing encrypted key can lead     to a denial of       service (bsc#1262952).
    - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for     validation       bypass and privilege escalation (bsc#1266639).
    - CVE-2026-39827: golang.org/x/crypto/ssh: newChannel leak after Reject() (bsc#1266179).
    - CVE-2026-39828: golang.org/x/crypto/ssh: bypass of certificate restrictions (bsc#1266179).
    - CVE-2026-39829: golang.org/x/crypto/ssh: pathological RSA/DSA parameters may cause DoS (bsc#1266179).
    - CVE-2026-39830: golang.org/x/crypto/ssh: client can cause server deadlock on unexpected responses     (bsc#1266179).
    - CVE-2026-39831: golang.org/x/crypto/ssh: bypass of FIDO/U2F security keys physical interaction     (bsc#1266179).
    - CVE-2026-39832: golang.org/x/crypto/ssh: remote agent constraint extensions dropped (bsc#1266179).
    - CVE-2026-39833: golang.org/x/crypto/ssh: lifetime without confirm constraint (bsc#1266179).
    - CVE-2026-39834: golang.org/x/crypto/ssh: infinite loop on large channel writes (bsc#1266179).
    - CVE-2026-39835: golang.org/x/crypto/ssh: server panic during CheckHostKey/Authenticate (bsc#1266179).
    - CVE-2026-42508: golang.org/x/crypto/ssh: failure to enforce @revoked status (bsc#1266179).
    - CVE-2026-46595: golang.org/x/crypto/ssh: VerifiedPublicKeyCallback permissions skip enforcement     (bsc#1266179).
    - CVE-2026-46597: golang.org/x/crypto/ssh: byte arithmetic causes underflow and panic (bsc#1266179).
    - CVE-2026-46598: golang.org/x/crypto/ssh: pathological inputs can lead to client panic (bsc#1266179).
    - CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing     allows for DoS       via oversized inputs (bsc#1276687).
    - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input     (bsc#1272064).
    - CVE-2026-56854: golang.org/x/crypto/ssh: source-address restriction bypassed in 5 callback families     (bsc#1278621).
    - CVE-2026-56855: golang.org/x/crypto/ssh: prevent DoS on deadlocked established channel (bsc#1278621).
    - CVE-2026-78662: golang.org/x/crypto/ssh: prevent DoS on deadlocked undecided channel (bsc#1278621).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4392-1 advisory.

    - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input     (bsc#1272117).
    - CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and     deadlocks in the       crypto/ssh library (bsc#1278614).
    - CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025).
    - CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation     (bsc#1279215).
    - Verification bypass via public key in legacy bundle (bsc#1282542).

    Changes for cosign:

    - update to 3.1.3:
     * Auto-detect default digest algorithm for public keys
     * fix(pkcs11key): return an error instead of panicking when no      key pair matches
     * Supporting OCI Signing with X.509 Certificate Chain
     * fix: prevent shell completions for various options not taking      filenames
     * fix(blob): compare file checksums case-insensitively in
     * Verification bypass via public key in legacy bundle (GHSA-      fx35-mq7g-6g98, bsc#1282542)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21884-1 advisory.

    - CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and     deadlocks in the       crypto/ssh library (bsc#1278681).
    - CVE-2026-71556: github.com/go-git/go-git/v5: arbitrary file read/write via symbolic link resolution     (bsc#1276981).
    - CVE-2026-71557: github.com/go-git/go-git/v5: malicious reference names may modify files outside the     reference storage       (bsc#1276994).

    Changes for amazon-ssm-agent:

    - Update to version 3.3.5390.0
     * Bump github.com/gorilla/websocket from v1.4.2 to v1.5.3
     * Bump golang.org/x/crypto from v0.53.0 to v0.56.0
     * Bump golang.org/x/net from v0.56.0 to v0.57.0
     * Bump golang.org/x/sys from v0.46.0 to v0.47.0
     * Upgrade GoLang version from 1.25 to 1.26
     * Mint control-channel token after dial to fix AZ-fault token expiry
     * Resume patch documents interrupted by an external shutdown
     * Use systemctl for systemd in aws: configureDocker on Amazon Linux
     * Update greengrass component version to 1.3.5

    - Update to version 3.3.5226.0
     * Add bounds check for HeaderLength in AgentMessage Deserialize
     * Bump github.com/go-git/go-git/v5 to v5.19.2
     * Bump golang.org/x/sync to v0.21.0
     * Detect Azure Linux and potential future unregistered Linux platforms
     * Fix Windows session command parsing by removing shlex
     * Fix shell injection in Windows domainjoin plugin parameters
     * Prevent control channel deadlock on ProcessorBufferFull
     * Revert migration from aws-sdk-go v1 to aws-sdk-go-v2 change
     * Update the logic for loading RegistrationInfo
     * Upgrade Go version to 1.25.13

    - Update to version 3.3.5068.0

     * Migrate from aws-sdk-go v1 to aws-sdk-go-v2
     * Fix flaky registration/connection channel tests
     * Sync AWS SDK fork in extra/ with multicloud vendor changes
     * Harden function create file with permissions in a single syscall
     * Upgrade Go version to 1.25.12
     * Bump golang.org/x/net@v0.55.0 to golang.org/x/net@v0.56.0
     * Fix loopback bypass in remote-host port forwarding denylist

    - Update to version 3.3.4851.0

     * Add ECS/EKS credential endpoints and loopback to port-forward denylist
     * Canonicalize IP addresses before port-forwarding denylist check
     * Pass the ActiveDirectory domain password via stdin using -y /dev/stdin      instead of the -w flag
     * Fix false StuckAtInProgress timeout for associations with rate >= 2h
     * Fix non-interactive session big file transfer issues
     * Prevent ssm-user race condition with flock-based serialization
     * Send AWS::EC2::Instance as source type when registered with provider EC2
     * Validate process name in orphan worker detection

    - Update to version 3.3.4793.0

     * Add multicloud support enabling SSM Agent registration with      Azure cloud providers
     * Add support for the upcoming public key in the agent code

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21846-1 advisory.

    Changes in keybase-client:

    - CVE-2026-56855,CVE-2026-56854,CVE-2026-78662: authentication bypass and deadlocks in the crypto/ssh     library
      * Add update-go-crypto.patch to update affected dependency (bsc#1278586).
    - Update to go 1.26 as required to update go crypto library

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22032-1 advisory.

    - CVE-2026-2303: go.mongodb.org/mongo-driver: mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error     Handling       (bsc#1269861).
    - CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method     of a POST       request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277996).
    - CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing     allows for DoS       via oversized inputs (bsc#1276742).
    - CVE-2026-45679: go.opentelemetry.io/obi: Redis error text is exported in span status messages and can     lead to       exfiltration of sensitive data (bsc#1267482).
    - CVE-2026-45680: go.opentelemetry.io/obi: unbounded BPF internal metrics replay can exhaust CPU and cause     a DoS       (bsc#1267483).
    - CVE-2026-45681: go.opentelemetry.io/obi: CPU-mismatch fallback uses 256-byte buffer with 8KB size and     can cause OBI       out-of-bounds reads to leak memory into telemetry (bsc#1267484).
    - CVE-2026-45683: go.opentelemetry.io/obi: Java TLS ioctl kprobe allows a user to point OBI at kernel     memory and cause       that memory to be copied into telemetry (bsc#1267486).
    - CVE-2026-45684: go.opentelemetry.io/obi: log enricher mishandled `writev` buffers and allows multi-     segment calls to       read and overwrite memory beyond the first segment (bsc#1267487).
    - CVE-2026-46600: golang.org/x/net/dns/dnsmessage: Parsing an invalid SVCB or HTTPS RR can panic when the     size of a       parameter value overflows the message buffer (bsc#1272418).
    - CVE-2026-48496: opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the     ebpf-profiler       agent (bsc#1268982).
    - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input     (bsc#1272028).
    - CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and     deadlocks in the       crypto/ssh library (bsc#1278671).
    - CVE-2026-71556: github.com/go-git/go-git/v5: Arbitrary file read/write via symbolic link resolution     (bsc#1276982).
    - CVE-2026-71557: github.com/go-git/go-git/v5: Malicious reference names may modify files outside the     reference storage       (bsc#1276992).
    - CVE-2026-75889: arbitrary file reads due to the `prometheus.operator.servicemonitors` component allowing     users who can       modify `ServiceMonitor` resources in a watched namespace to specify an arbitrary local file through     `bearerTokenFile`       (bsc#1277429).
    - CVE-2026-81521: go.mongodb.org/mongo-driver: MongoDB Go Driver: Write redirection via unvalidated     database name in       Client.BulkWrite (bsc#1278693).
    - CVE-2026-89090: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream: malformed EventStream response     frames       containing a crafted header value type byte outside the valid range can cause the host process to     terminate       (bsc#1280671).

    Changes for alloy:

    Update to version 1.19.2:

     * Remove withdrawn lib/pq CVEs from govulncheck
     * Add backticks to component name in generated doc output
     * BREAKING CHANGE: prometheus.operator.servicemonitors now      rejects endpoints that reference local files by default. Set      allow_arbitrary_file_access = true to preserve previous      behavior.
     * prometheus.enrich: Support multi-label matching
     * prometheus.relabel: Add opt-in TTL cache mode
     * telemetry: Add new metrics for graph connections and      pyroscope forwarded entries
     * database_observability: Exclude system schemas from MySQL      health checks and redact query text in explain_plans
     * Add nop receiver to OTel Engine
     * Backport dependency upgrades to address GO-2026-6061

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4272-1 advisory.

    - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2     :path pseudo-       header.
    - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input     (bsc#1272118).
    - CVE-2026-56854: golang.org/x/crypto/ssh: source-address critical option not enforced for non-public-key     auth callbacks (bsc#1278597)
    - CVE-2026-56855: golang.org/x/crypto/ssh: prevent DoS on deadlocked established channel (bsc#1278597)
    - CVE-2026-78662: golang.org/x/crypto/ssh: prevent DoS on deadlocked undecided channel (bsc#1278597).
    - CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of     authorization       policies via mixed-case or canonical-case header matches (bsc#1279297).
    - CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation     (bsc#1279414).
    - CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in     gRPC-Go xDS       servers (bsc#1278967).

    Changes for google-guest-agent:

    - Updated to version 20260903.01

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4270-1 advisory.

    - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2     :path pseudo-       header (bsc#1260264).
    - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input     (bsc#1272118).
    - CVE-2026-56854: golang.org/x/crypto/ssh: source-address critical option not enforced for non-public-key     auth callbacks (bsc#1278597)
    - CVE-2026-56855: golang.org/x/crypto/ssh: prevent DoS on deadlocked established channel (bsc#1278597)
    - CVE-2026-78662: golang.org/x/crypto/ssh: prevent DoS on deadlocked undecided channel (bsc#1278597).
    - CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of     authorization       policies via mixed-case or canonical-case header matches (bsc#1279297).
    - CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation     (bsc#1279414).
    - CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in     gRPC-Go xDS       servers (bsc#1278967).

    Changes for google-guest-agent:

    - Updated to version 20260903.01

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21835-1 advisory.

    - CVE-2026-53495: containerd: CRI ExecSync goroutine leak can lead to node-level denial of service     (bsc#1280111).
    - CVE-2026-56854: golang.org/x/crypto/ssh: unenforced source-address restrictions across non-public-key     authentication       callbacks can cause authorization bypasses and unauthorized client logins (bsc#1278624).
    - CVE-2026-56855: golang.org/x/crypto/ssh: unhandled RFC 4254 channel messages can cause connection     deadlocks and       denial of service (bsc#1278624).
    - CVE-2026-78662: golang.org/x/crypto/ssh: unvalidated incoming requests on unestablished channels can     cause connection       deadlocks and denial of service (bsc#1278624).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
350164	openSUSE 16 Security Update : cloudflared (openSUSE-SU-2026:21924-1)	Nessus	SuSE Local Security Checks	2026/9/25	2026/9/25	critical
350144	openSUSE 16 Security Update : apptainer (openSUSE-SU-2026:21927-1)	Nessus	SuSE Local Security Checks	2026/9/25	2026/9/25	high
351070	Amazon Linux 2 : rclone (ALAS-2026-3947)	Nessus	Amazon Linux Local Security Checks	2026/9/29	2026/9/29	high
349609	SUSE SLES12 Security Update : google-osconfig-agent (SUSE-SU-2026:4292-1)	Nessus	SuSE Local Security Checks	2026/9/24	2026/9/24	high
351086	Amazon Linux 2023 : rclone (ALAS2023-2026-3129)	Nessus	Amazon Linux Local Security Checks	2026/9/29	2026/9/29	critical
341532	Linux Distros Unpatched Vulnerability : CVE-2026-56854	Nessus	Misc.	2026/8/29	2026/10/29	high
362530	openSUSE 16 Security Update : rclone (openSUSE-SU-2026:21999-1)	Nessus	SuSE Local Security Checks	2026/10/2	2026/10/2	high
347918	openSUSE 16 Security Update : gh (openSUSE-SU-2026:21861-1)	Nessus	SuSE Local Security Checks	2026/9/18	2026/9/18	high
346799	SUSE SLES15 Security Update : containerized-data-importer (SUSE-SU-2026:4209-1)	Nessus	SuSE Local Security Checks	2026/9/17	2026/9/17	high
351406	SUSE SLED15 / SLES15 Security Update : cosign (SUSE-SU-2026:4392-1)	Nessus	SuSE Local Security Checks	2026/9/30	2026/9/30	high
350145	openSUSE 16 Security Update : amazon-ssm-agent (openSUSE-SU-2026:21884-1)	Nessus	SuSE Local Security Checks	2026/9/25	2026/9/25	high
346190	openSUSE 16 Security Update : keybase-client (openSUSE-SU-2026:21846-1)	Nessus	SuSE Local Security Checks	2026/9/16	2026/9/16	high
364343	openSUSE 16 Security Update : alloy (openSUSE-SU-2026:22032-1)	Nessus	SuSE Local Security Checks	2026/10/9	2026/10/9	high
348725	SUSE SLES12 Security Update : google-guest-agent (SUSE-SU-2026:4272-1)	Nessus	SuSE Local Security Checks	2026/9/22	2026/9/23	high
348727	SUSE SLES15 Security Update : google-guest-agent (SUSE-SU-2026:4270-1)	Nessus	SuSE Local Security Checks	2026/9/22	2026/9/23	high
346193	openSUSE 16 Security Update : trivy (openSUSE-SU-2026:21835-1)	Nessus	SuSE Local Security Checks	2026/9/16	2026/9/16	medium

检测

插件搜索

critical

high

high

high

critical

high

high

high

high

high

high

high

high

high

high

medium