The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1790168428 advisory.

  - When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of     C memory and a crash. (CVE-2026-33811)

  - Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive     structures. (CVE-2026-33818)

  - Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack     exhaustion. (CVE-2026-56859)

  - Previously, resolving relative paths containing parent directory ('..') segments performed string     conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory     allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for     '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.
    (CVE-2026-56860)

  - Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a     handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages     to force the server to keep performing key derivation operations indefinitely. (CVE-2026-56862)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 10.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_65116 advisory.

    * net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499)

    * net/mail: golang: Go net/mail: Denial of Service via crafted email inputs (CVE-2026-39820)

    * mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504)

    * github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage:
    go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers     (CVE-2026-41178)

    * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal     (CVE-2026-33818)

    * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution     (CVE-2026-56860)

    * net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service     (CVE-2026-56853)

    * html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)

    * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages     (CVE-2026-56862)

    * encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1790850483 advisory.

  - When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of     C memory and a crash. (CVE-2026-33811)

  - Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive     structures. (CVE-2026-33818)

  - When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection     to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when     doing this. (CVE-2026-56853)

  - Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to     inject arbitrary content, potentially leading to XSS. (CVE-2026-56858)

  - Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack     exhaustion. (CVE-2026-56859)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:76795 advisory.

    Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &     OpenTSDB.

    Security Fix(es):

    * crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)

    * crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint     application (CVE-2026-33810)

    * net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499)

    * net/mail: golang: Go net/mail: Denial of Service via crafted email inputs (CVE-2026-39820)

    * grafana: Grafana: Privilege escalation via dashboard overwrite (CVE-2026-33377)

    * grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default     (CVE-2026-33376)

    * golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect     Punycode label processing (CVE-2026-39821)

    * mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504)

    * grafana: Grafana: Denial of Service due to excessive memory allocation via large JSON payloads     (CVE-2026-42127)

    * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal     (CVE-2026-33818)

    * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution     (CVE-2026-56860)

    * net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service     (CVE-2026-56853)

    * html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)

    * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages     (CVE-2026-56862)

    * encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:82810 advisory.

  - encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal     (CVE-2026-33818)

  - net/mail: golang: Go net/mail: Denial of Service via crafted email inputs (CVE-2026-39820)

  - mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504)

  - net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service     (CVE-2026-56853)

  - html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Golang running on the remote host is 1.25.x prior to 1.25.13, or 1.26.x prior to 1.26.6. It is, therefore, affected by multiple vulnerabilities in the standard library and the toolchain, as referenced in the golang-announce advisory.

  - The ToASCII and ToUnicode functions incorrectly accepted Punycode-encoded labels that decode to an     ASCII-only label. This can lead to privilege escalation in programs using the idna package.
    (CVE-2026-39821)

  - When a server is configured to support unencrypted HTTP/2, it reads bytes from each new connection     to check for the HTTP/2 client preface. Previously this was done with no timeout. ReadHeaderTimeout     is now applied for this check. (CVE-2026-56853)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21696-1 advisory.

    Update to version 1.25.14 cut from the go1.25-fips-release branch at the revision tagged     go1.25.14-1-openssl-fips.

    Security issues fixed:

    - CVE-2026-33818: encoding/asn1: stack exhaustion when parsing deeply-nested, recursive structures can     lead to denial       of service (bsc#1275034).
    - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for     validation       bypass and privilege escalation (bsc#1266609).
    - CVE-2026-56853: net/http: first header read timeout not being applied when a server is configured to     support       unencrypted HTTP/2 allows for denial of service (bsc#1275028).
    - CVE-2026-56858: html/template: wrong JavaScript regexp context tracking after top-level `{` can lead to     XSS       (bsc#1275033).
    - CVE-2026-56859: encoding/xml: stack exhaustion due to recursion depth guard bypass during decoding     operations can       lead to denial of service (bsc#1275026).
    - CVE-2026-56860: net/url: quadratic complexity in `resolvePath` when processing backtrack path elements     can lead to       denial of service (bsc#1275029).
    - CVE-2026-56862: crypto/tls: handshake messages can bypass non-advancing record limit in TLS 1.3, which     can lead to       a denial of service (bsc#1275032).
    - CVE-2026-56864: x/mod/sumdb: a malicious `GOSUMDB` is capable of serving arbitrary module content not     contained       within the transparency log (bsc#1275025).
    - CVE-2026-56865: x/mod/sumdb/tlog: a malicious `GOPROXY` is capable of forging sumdb tiles, which allows     for bypass of       the `GOSUMDB` check and persistence of attacker-controlled module contents to a local Go module cache     (bsc#1275024).

    Other updates and bugfixes:

    - Update to version 1.25.14 cut from the go1.25-fips-release branch at the revision tagged     go1.25.14-1-openssl-fips:
      (jsc#SLE-18320):
      * Rebase to 1.25.14
    - go1.25.14 (released 2026-08-19, boo#1244485):
      * go#80926 net/http: `ReadHeaderTimeout` remains active after unencrypted HTTP/2 handoff
    - go1.25.13 (released 2026-08-13):
      * includes security fixes to the `go` command, and the `crypto/tls`, `encoding/asn1`, `encoding/xml`,     `html/template`,         `net/http`, and `net/url` packages, as well as bug fixes to the compiler, the runtime, and the     `crypto/tls` and `os`         packages.
      * go#79876 cmd/compile: `prove` miscompilation in `slicemask` folding leaves garbage in the upper bits
      * go#80098 cmd/compile: internal compiler error invalid heap allocated var without `Heapaddr`
      * go#80364 os: `Root`'s `MkdirAll` can't create paths ending in forward slashes
      * go#80366 os: `TestRootMultiReadFile` fails on `netbsd/arm64` after CL 797880
      * go#80368 os: `TestRootConsistencyRemoveAll` fails on Plan 9 after CL 797880
      * go#80393 runtime: `arm64` found pointer to free object with safe code
      * go#80440 runtime: uninitialized register due to wrong ABI in `mach_vm_region_trampoline` leads to     `libc` following         garbage stack data as a pointer
      * go#80477 cmd/compile: `riscv64` miscompiles struct copy, corrupting a `[]byte` slice field
      * go#80500 runtime: js/wasm: found bad pointer in Go heap -- link-layout-constant value recorded as a     pointer in the         write-barrier buffer
      * go#80578 cmd/compile: `regalloc` uses unreliable type data (like `v.Type.IsSigned()`) to choose the     restore of         spills
      * go#80605 crypto/tls: escape hatch for FIPS 140-3 mode Extended Master Secret enforcement
      * go#80614 cmd/compile: `mips64le` miscompiles `OffPtr` by a const which doesn't fit 32bits resulting in     panic
      * go#80616 cmd/compile: `mips`/`mips64`, multiply/divide results spilled from `HI`/`LO` corrupted w/ big     stack frames
      * go#80618 cmd/compile: `prove` bug causes invalid indirect call
      * go#80737 runtime: `fpTracebackPartialExpand` `SIGSEGV` under high panic load
    - Update to version 1.25.12 cut from the go1.25-fips-release branch at the revision tagged     go1.25.12-2-openssl-fips:
      * Limit openssl `RandReader` concurrency (#374)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 / 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:94063 advisory.

    Red Hat Satellite is a system management solution that allows organizations to configure and maintain     their systems without the necessity to provide public Internet access to their servers or other client     systems. It performs provisioning and configuration management of predefined standard operating     environments.

    Security Fix(es):

    * foreman_ygg_worker: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal     (CVE-2026-33818)
    * yggdrasil: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)
    * foreman_ygg_worker: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service     (CVE-2026-56853)
    * yggdrasil: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)
    * foreman_ygg_worker: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)
    * yggdrasil: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)
    * foreman_ygg_worker: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859)
    * yggdrasil: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859)
    * foreman_ygg_worker: golang net/url: Denial of Service from quadratic complexity in path resolution     (CVE-2026-56860)
    * yggdrasil: golang net/url: Denial of Service from quadratic complexity in path resolution     (CVE-2026-56860)
    * foreman_ygg_worker: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages     (CVE-2026-56862)
    * yggdrasil: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
353031	AlmaLinux 9.2 [TuxCare] Security Update: git-lfs Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1790168428)	Nessus	Alma Linux Local Security Checks	2026/9/30	2026/10/26	high
353914	Rocky Linux 10.2 [CIQ] Security Update: opentelemetry-collector Multiple Vulnerabilities (crlsa-2026_65116)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	high
359472	AlmaLinux 9.2 [TuxCare] Security Update: buildah / buildah-tests Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1790850483)	Nessus	Alma Linux Local Security Checks	2026/10/1	2026/10/22	high
363382	RHEL 9 : grafana (RHSA-2026:76795)	Nessus	Red Hat Local Security Checks	2026/10/6	2026/10/8	high
370899	RHCOS 4 : OpenShift Container Platform 4.15.70 (RHSA-2026:82810)	Nessus	Red Hat Local Security Checks	2026/10/22	2026/10/22	high
335411	Golang 1.25.x < 1.25.13 / 1.26.x < 1.26.6 Multiple Vulnerabilities	Nessus	Misc.	2026/8/14	2026/8/28	high
341653	SUSE SLED15 / SLES15 Security Update : go1.27 (SUSE-SU-2026:3830-1)	Nessus	SuSE Local Security Checks	2026/8/31	2026/8/31	high
342104	openSUSE 16 Security Update : go1.25-openssl (openSUSE-SU-2026:21696-1)	Nessus	SuSE Local Security Checks	2026/9/1	2026/9/1	high
375417	RHEL 10 / 8 / 9 : Satellite 6 Client Update (Important) (RHSA-2026:94063)	Nessus	Red Hat Local Security Checks	2026/11/3	2026/11/3	medium

检测

插件搜索

high

high

high

high

high

high

high

high

medium