The remote SUSE Linux SLES15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0770-1 advisory.

    - Update to version 0.0.20250226T025151 2025-02-26T02:51:51Z.
      (jsc#PED-11136)

      * GO-2025-3487 CVE-2025-22869
      * GO-2025-3488 CVE-2025-22868

    - Update to version 0.0.20250218T203201 2025-02-18T20:32:01Z.
      (jsc#PED-11136)

      * GO-2024-3321 CVE-2024-45337 GHSA-v778-237x-gjrc

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0378 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2025-22869:
    SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from     clients which complete the key exchange slowly, or not at all, causing pending content to be read into     memory, but never transmitted.

    CVE-2024-45337:
    Applications and libraries which misuse connection.serverAuthenticate (via callback field     ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for     ServerConfig.PublicKeyCallback says that A call to this function does not guarantee that the key offered     is in fact used to authenticate. Specifically, the SSH protocol allows clients to inquire about whether a     public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be     called with multiple keys, and the order in which the keys were provided cannot be used to infer which key     the client successfully authenticated with, if any. Some applications, which store the key(s) passed to     PublicKeyCallback (or derived information) and make security relevant determinations based on it once the     connection is established, may make incorrect assumptions. For example, an attacker may send public keys A     and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then     with B. A vulnerable application may then make authorization decisions based on key B for which the     attacker does not actually control the private key. Since this API is widely misused, as a partial     mitigation golang.org/x/cry...@v0.31.0 enforces the property that, when successfully authenticating via     public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the     connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that     the client may still not control the last key passed to PublicKeyCallback if the connection is then     authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or     NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various     authentication callbacks to record data associated with the authentication attempt instead of referencing     external state. Once the connection is established the state corresponding to the successful     authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party     libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party     libraries should refer to the relevant projects for guidance.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2025-20143-1 advisory.

    Changes in git-bug:

    - Revendor to include fixed version of depending libraries:
      - GO-2025-4116 (CVE-2025-47913, bsc#1253506) upgrade         golang.org/x/crypto to v0.43.0
      - GO-2025-3900 (GHSA-2464-8j7c-4cjm) upgrade         github.com/go-viper/mapstructure/v2 to v2.4.0
      - GO-2025-3787 (GHSA-fv92-fjc5-jj9h) included in the previous
      - GO-2025-3754 (GHSA-2x5j-vhc8-9cwm) upgrade         github.com/cloudflare/circl to v1.6.1
      - GO-2025-4134 (CVE-2025-58181, bsc#1253930) upgrade         golang.org/x/crypto/ssh to v0.45.0
      - GO-2025-4135 (CVE-2025-47914, bsc#1254084) upgrade         golang.org/x/crypto/ssh/agent to v0.45.0

    - Revendor to include golang.org/x/net/html v 0.45.0 to prevent       possible DoS by various algorithms with quadratic complexity       when parsing HTML documents (bsc#1251463, CVE-2025-47911 and       bsc#1251664, CVE-2025-58190).

    Update to version 0.10.1:

      - cli: ignore missing sections when removing configuration (ddb22a2f)

    Update to version 0.10.0:

      - bridge: correct command used to create a new bridge (9942337b)
      - web: simplify header navigation (7e95b169)
      - webui: remark upgrade + gfm + syntax highlighting (6ee47b96)
      - BREAKING CHANGE: dev-infra: remove gokart (89b880bd)

    Update to version 0.10.0:

      - bridge: correct command used to create a new bridge (9942337b)
      - web: simplify header navigation (7e95b169)
      - web: remark upgrade + gfm + syntax highlighting (6ee47b96)

    Update to version 0.9.0:

      - completion: remove errata from string literal (aa102c91)
      - tui: improve readability of the help bar (23be684a)

    Update to version 0.8.1+git.1746484874.96c7a111:

      * docs: update install, contrib, and usage documentation (#1222)
      * fix: resolve the remote URI using url.*.insteadOf (#1394)
      * build(deps): bump the go_modules group across 1 directory with 3 updates (#1376)
      * chore: gofmt simplify gitlab/export_test.go (#1392)
      * fix: checkout repo before setting up go environment (#1390)
      * feat: bump to go v1.24.2 (#1389)
      * chore: update golang.org/x/net (#1379)
      * fix: use -0700 when formatting time (#1388)
      * fix: use correct url for gitlab PATs (#1384)
      * refactor: remove depdendency on pnpm for auto-label action (#1383)
      * feat: add action: auto-label (#1380)
      * feat: remove lifecycle/frozen (#1377)
      * build(deps): bump the npm_and_yarn group across 1 directory with 12 updates (#1378)
      * feat: support new exclusion label: lifecycle/pinned (#1375)
      * fix: refactor how gitlab title changes are detected (#1370)
      * revert: Create Dependabot config file (#1374)
      * refactor: rename //:git-bug.go to //:main.go (#1373)
      * build(deps): bump github.com/vektah/gqlparser/v2 from 2.5.16 to 2.5.25 (#1361)
      * fix: set GitLastTag to an empty string when git-describe errors (#1355)
      * chore: update go-git to v5@masterupdate_mods (#1284)
      * refactor: Directly swap two variables to optimize code (#1272)
      * Update README.md Matrix link to new room (#1275)

    - Update to version 0.8.0+git.1742269202.0ab94c9:
      * deps(crypto): bump golang.org/x/crypto from v0.26.0 to v0.31.0 (fix for CVE-2024-45337) (#1312)

    - Update golang.org/x/crypto/ssh to v0.35.0 (bsc#1239494,       CVE-2025-22869).

    - Add missing Requires to completion subpackages.

    Update to version 0.8.0+git.1733745604.d499b6e:

      * fix typos in docs (#1266)
      * build(deps): bump github.com/go-git/go-billy/v5 from 5.5.0 to 5.6.0 (#1289)

    - bump golang.org/x/crypto from v0.26.0 to v0.31.0 (fix for CVE-2024-45337, bsc#1234565).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Applications and libraries which misuse connection.serverAuthenticate (via callback field     ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for     ServerConfig.PublicKeyCallback says that A call to this function does not guarantee that the key offered     is in fact used to authenticate. Specifically, the SSH protocol allows clients to inquire about whether a     public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be     called with multiple keys, and the order in which the keys were provided cannot be used to infer which key     the client successfully authenticated with, if any. Some applications, which store the key(s) passed to     PublicKeyCallback (or derived information) and make security relevant determinations based on it once the     connection is established, may make incorrect assumptions. For example, an attacker may send public keys A     and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then     with B. A vulnerable application may then make authorization decisions based on key B for which the     attacker does not actually control the private key. Since this API is widely misused, as a partial     mitigation golang.org/x/cry...@v0.31.0 enforces the property that, when successfully authenticating via     public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the     connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that     the client may still not control the last key passed to PublicKeyCallback if the connection is then     authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or     NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various     authentication callbacks to record data associated with the authentication attempt instead of referencing     external state. Once the connection is established the state corresponding to the successful     authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party     libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party     libraries should refer to the relevant projects for guidance. (CVE-2024-45337)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21481-1 advisory.

    - CVE-2024-45337: golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause     authorization bypass in       golang.org/x/crypto (bsc#1234486).
    - CVE-2025-22868: golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in     golang.org/x/oauth2       (bsc#1239186).
    - CVE-2025-22869: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of     golang.org/x/crypto/ssh       (bsc#1239323).
    - CVE-2025-22870: golang.org/x/net/proxy: proxy bypass using IPv6 zone IDs (bsc#1238683).
    - CVE-2025-27144: github.com/go-jose/go-jose/v4,github.com/go-jose/go-jose/v3: Go JOSE's Parsing     Vulnerable to Denial of       Service (bsc#1237611).
    - CVE-2025-30204: github.com/golang-jwt/jwt/v4: jwt-go allows excessive memory allocation during header     parsing       (bsc#1240444).
    - CVE-2025-58181: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory     consumption       (bsc#1253802).
    - CVE-2026-22772: github.com/sigstore/fulcio: bypass MetaIssuer URL validation bypass can trigger SSRF to     arbitrary       internal services (bsc#1256535).
    - CVE-2026-24137: github.com/sigstore/sigstore/pkg/tuf: legacy TUF client allows for arbitrary file writes     with target       cache path traversal (bsc#1257138).

    Changes for vexctl:

    - Update to version 0.4.4+git20.5d61136:

     * build(deps): Bump github.com/sigstore/cosign/v2
     * build(deps): Bump actions/setup-go from 6.5.0 to 7.0.0
     * build(deps): Bump the all group across 1 directory with 5 updates
     * build(deps): Bump github.com/sigstore/rekor in the all group
     * build(deps): Bump the all group with 4 updates
     * build(deps): Bump github.com/google/go-containerregistry
     * build(deps): Bump actions/setup-go from 6.4.0 to 6.5.0 in the all group
     * build(deps): Bump the all group across 1 directory with 2 updates
     * build(deps): Bump actions/checkout from 6.0.3 to 7.0.0
     * build(deps): Bump chainguard-dev/actions in the all group

    - Update to version 0.4.4:

     * fix signature duplication
     * fix lints
     * housekeeping - deps update and ci cleanup
     * build(deps): Bump the all group with 2 updates
     * build(deps): Bump github.com/sigstore/sigstore in the all group
     * build(deps): Bump golangci/golangci-lint-action in the all group

    - Update to version 0.4.1+git147.b7e6ef0:

     * build(deps): Bump goreleaser/goreleaser-action in the all group
     * Bump sigstore/cosign-installer from 4.1.1 to 4.1.2 in the all group
     * Bump chainguard-dev/actions from 1.6.17 to 1.6.19 in the all group
     * Bump chainguard-dev/actions from 1.6.16 to 1.6.17 in the all group
     * Bump github.com/package-url/packageurl-go in the all group
     * Bump the all group with 2 updates

    - Update to version 0.4.1+git133.efecaf7:

     * Bump github.com/secure-systems-lab/go-securesystemslib

    - Update to version 0.4.1+git129.c7f3066:

     * Bump github.com/google/go-containerregistry in the all group
     * Bump github.com/sigstore/timestamp-authority/v2 from 2.0.3 to 2.0.6
     * Bump softprops/action-gh-release from 2.6.1 to 3.0.0
     * Bump chainguard-dev/actions from 1.6.13 to 1.6.14 in the all group
     * Bump actions/upload-artifact from 7.0.0 to 7.0.1 in the all group
     * Bump github.com/sigstore/cosign/v2 from 2.6.2 to 2.6.3 in the all group
     * Bump kubernetes-sigs/release-actions in the all group
     * Bump github.com/in-toto/in-toto-golang from 0.9.0 to 0.10.0
     * Bump the all group across 1 directory with 2 updates
     * Bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4
     * fix(add): allow add without --product flag
     * Use gomod version, bump linter
     * Port vexctl to intoto/attestation
     * Bump the all group across 1 directory with 5 updates
     * Bump google.golang.org/grpc from 1.78.0 to 1.79.3

    - Update to version 0.4.1+git96.558125d:

     * Bump the all group across 1 directory with 3 updates
     * Bump chainguard-dev/actions from 1.6.5 to 1.6.6 in the all group
     * Bump github.com/google/go-containerregistry from 0.20.7 to 0.21.0
     * Bump actions/upload-artifact from 6.0.0 to 7.0.0
     * Bump goreleaser/goreleaser-action from 6.4.0 to 7.0.0
     * Bump chainguard-dev/actions from 1.6.2 to 1.6.4 in the all group

    - Update to version 0.4.1+git78.f951e3a:

     * Bump chainguard-dev/actions from 1.6.1 to 1.6.2 in the all group

    - Update to version 0.4.1+git76.10d7a2e:

     * Bump chainguard-dev/actions from 1.6.0 to 1.6.1 in the all group
     * Bump chainguard-dev/actions from 1.5.16 to 1.6.0 in the all group
     * Bump chainguard-dev/actions from 1.5.14 to 1.5.16 in the all group
     * Bump chainguard-dev/actions from 1.5.13 to 1.5.14 in the all group
     * Bump github.com/sigstore/rekor from 1.4.3 to 1.5.0
     * Bump github.com/theupdateframework/go-tuf/v2 from 2.3.0 to 2.4.1
     * Bump actions/setup-go from 6.1.0 to 6.2.0 in the all group
     * Bump github.com/sigstore/fulcio from 1.8.4 to 1.8.5
     * Bump github.com/sigstore/cosign/v2 from 2.6.1 to 2.6.2 in the all group
     * Bump chainguard-dev/actions from 1.5.10 to 1.5.11 in the all group
     * Bump github.com/sigstore/fulcio from 1.7.1 to 1.8.3
     * Bump github.com/sigstore/sigstore
     * Bump actions/upload-artifact from 5.0.0 to 6.0.0
     * bump golangci-lint
     * update gorelease sing to works with cosign 3.0+
     * Bump github.com/spf13/cobra from 1.10.1 to 1.10.2 in the all group
     * Bump golangci/golangci-lint-action from 9.1.0 to 9.2.0 in the all group
     * Bump actions/checkout from 6.0.0 to 6.0.1 in the all group
     * Bump softprops/action-gh-release from 2.4.2 to 2.5.0 in the all group
     * Bump chainguard-dev/actions from 1.5.9 to 1.5.10 in the all group
     * Bump golangci/golangci-lint-action from 8.0.0 to 9.1.0
     * Bump actions/checkout from 5.0.1 to 6.0.0
     * Bump actions/setup-go from 6.0.0 to 6.1.0 in the all group
     * Bump golang.org/x/crypto from 0.43.0 to 0.45.0
     * Bump github.com/sigstore/rekor from 1.4.2 to 1.4.3 in the all group
     * Bump actions/upload-artifact from 4.6.2 to 5.0.0
     * Bump chainguard-dev/actions from 1.5.6 to 1.5.7 in the all group
     * Bump sigstore/cosign-installer from 3.10.0 to 4.0.0
     * Bump chainguard-dev/actions from 1.5.4 to 1.5.6 in the all group
     * Bump softprops/action-gh-release from 2.3.4 to 2.4.0 in the all group
     * Bump github.com/sigstore/cosign/v2 from 2.6.0 to 2.6.1 in the all group

    - Update to version 0.4.1:

     * Reverse platform+os naming scheme

    - Update to version 0.4.0:

     * update go, goreleaser and update/clean ci
     * Bump sigs.k8s.io/release-utils from 0.12.1 to 0.12.2 in the all group

    - Packaging improvements:

     * Update to BuildRequires: golang(API) >= 1.25 matching go.mod

    - Update to version 0.3.0+git181.33bac59:

     * Bump sigstore/cosign-installer from 3.9.2 to 3.10.0 in the all group
     * Fix break w/cosign 2.6.0
     * Bump cosign & go-vex
     * Fix 2.4 linter nits
     * Bump softprops/action-gh-release from 2.3.2 to 2.3.3 in the all group
     * Bump github.com/spf13/cobra from 1.9.1 to 1.10.1
     * Bump actions/setup-go from 5.5.0 to 6.0.0
     * Bump github.com/stretchr/testify from 1.11.0 to 1.11.1 in the all group
     * Bump github.com/stretchr/testify from 1.10.0 to 1.11.0
     * Bump github.com/go-viper/mapstructure/v2 in the go_modules group
     * Bump goreleaser/goreleaser-action from 6.3.0 to 6.4.0 in the all group
     * update release-utils and fix pkg name
     * Bump actions/checkout from 4.2.2 to 5.0.0
     * Bump github.com/secure-systems-lab/go-securesystemslib in the all group
     * Bump github.com/sigstore/rekor from 1.3.10 to 1.4.0
     * Bump sigs.k8s.io/release-utils from 0.11.1 to 0.12.0
     * Bump sigstore/cosign-installer from 3.9.1 to 3.9.2 in the all group
     * Bump github.com/sigstore/cosign/v2 from 2.5.2 to 2.5.3 in the all group
     * Bump sigstore/cosign-installer from 3.9.0 to 3.9.1 in the all group
     * Bump github.com/sigstore/cosign/v2 from 2.5.1 to 2.5.2 in the all group
     * Bump sigstore/cosign-installer from 3.8.2 to 3.9.0 in the all group
     * migrate config to v2
     * Bump golangci/golangci-lint-action from 6.5.2 to 8.0.0

    - Update to version 0.3.0+git133.ff97560:

     * Bump softprops/action-gh-release from 2.3.0 to 2.3.2 in the all group
     * Bump github.com/cloudflare/circl in the go_modules group
     * Bump softprops/action-gh-release from 2.2.2 to 2.3.0 in the all group
     * Bump actions/setup-go from 5.4.0 to 5.5.0 in the all group
     * Bump github.com/sigstore/sigstore from 1.9.3 to 1.9.4 in the all group
     * Bump sigstore/cosign-installer from 3.8.1 to 3.8.2 in the all group
     * Bump softprops/action-gh-release from 2.2.1 to 2.2.2 in the all group
     * Bump ko-build/setup-ko from 0.8 to 0.9 in the all group
     * Bump github.com/sigstore/cosign/v2 from 2.4.3 to 2.5.0
     * Bump goreleaser/goreleaser-action from 6.2.1 to 6.3.0 in the all group
     * Bump sigs.k8s.io/release-utils from 0.11.0 to 0.11.1 in the all group
     * Bump github.com/golang-jwt/jwt/v4 in the go_modules group
     * Bump golangci/golangci-lint-action from 6.5.1 to 6.5.2 in the all group
     * Bump github.com/sigstore/sigstore from 1.8.15 to 1.9.1
     * Bump golang.org/x/net from 0.35.0 to 0.36.0 in the go_modules group
     * Bump golangci/golangci-lint-action from 6.5.0 to 6.5.1 in the all group
     * Bump github.com/go-jose/go-jose/v3 in the go_modules group
     * Bump github.com/go-jose/go-jose/v4 in the go_modules group
     * Bump actions/upload-artifact from 4.6.0 to 4.6.1 in the all group
     * Bump sigstore/cosign-installer from 3.8.0 to 3.8.1 in the all group
     * use go1.24 and update golangci-lint
     * Bump golangci/golangci-lint-action from 6.3.3 to 6.5.0 in the all group
     * Bump github.com/spf13/cobra from 1.8.1 to 1.9.1
     * Bump github.com/sigstore/sigstore from 1.8.12 to 1.8.14 in the all group
     * Bump golangci/golangci-lint-action from 6.3.2 to 6.3.3 in the all group
     * Bump goreleaser/goreleaser-action from 6.1.0 to 6.2.1 in the all group
     * Bump golangci/golangci-lint-action from 6.3.0 to 6.3.2 in the all group
     * Bump sigstore/cosign-installer from 3.7.0 to 3.8.0 in the all group
     * Bump golangci/golangci-lint-action from 6.2.0 to 6.3.0 in the all group
     * Bump sigs.k8s.io/release-utils from 0.9.0 to 0.10.0
     * Bump github.com/sigstore/rekor from 1.3.8 to 1.3.9 in the all group
     * Bump actions/setup-go from 5.2.0 to 5.3.0 in the all group
     * Bump golangci/golangci-lint-action from 6.1.1 to 6.2.0 in the all group
     * Bump sigs.k8s.io/release-utils from 0.8.5 to 0.9.0
     * Bump go dependencies manually
     * Bump ko-build/setup-ko from 0.7 to 0.8 in the all group
     * Bump actions/upload-artifact from 4.5.0 to 4.6.0 in the all group
     * Bump softprops/action-gh-release from 2.2.0 to 2.2.1 in the all group
     * Bump actions/upload-artifact from 4.4.3 to 4.5.0 in the all group
     * Bump golang.org/x/crypto from 0.28.0 to 0.31.0 in the go_modules group
     * Bump softprops/action-gh-release from 2.0.9 to 2.1.0 in the all group
     * Bump goreleaser/goreleaser-action from 6.0.0 to 6.1.0 in the all group
     * Bump softprops/action-gh-release from 2.0.8 to 2.0.9 in the all group
     * Update verify.yaml
     * Update release.yaml
     * Update ci-build-test.yaml
     * Bump actions/setup-go from 5.0.2 to 5.1.0 in the all group
     * Bump actions/checkout from 4.2.1 to 4.2.2 in the all group
     * Bump github.com/sigstore/sigstore from 1.8.9 to 1.8.10 in the all group
     * Bump actions/upload-artifact from 4.4.2 to 4.4.3 in the all group
     * Bump actions/upload-artifact from 4.4.1 to 4.4.2 in the all group
     * Bump sigstore/cosign-installer from 3.6.0 to 3.7.0 in the all group
     * Bump golangci/golangci-lint-action from 6.1.0 to 6.1.1 in the all group
     * Bump github.com/sigstore/cosign/v2 from 2.4.0 to 2.4.1 in the all group
     * Bump actions/checkout from 4.1.7 to 4.2.0 in the all group
     * Bump sigs.k8s.io/release-utils from 0.8.4 to 0.8.5 in the all group
     * upgrade to go1.23

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20609-1 advisory.

    Update to version 20250506.01 (bsc#1243254, bsc#1243505).

    Security issues fixed:

    - CVE-2024-45337: golang.org/x/crypto/ssh: misuse of the ServerConfig.PublicKeyCallback callback can lead     to       authorization bypass in applications (bsc#1234563).
    - CVE-2023-45288: golang.org/x/net/http2: no limit set for number of HTTP/2 CONTINUATION frames that can     be read for an       HTTP/2 request can lead to excessive CPU consumption and a DoS (bsc#1236533).

    Other updates and bugfixes:

    - Version 20250506.01:
      * Make sure agent added connections are activated by NM (#534)
    - Version 20250506.00:
      * Wrap NSS cache refresh in a goroutine (#533)
    - Version 20250502.01:
      * Wicked: Only reload interfaces for which configurations are written or changed. (#524)
    - Version 20250502.00:
      * Add AuthorizedKeysCompat to windows packaging (#530)
      * Remove error messages from gce_workload_cert_refresh and metadata script runner (#527)
      * Update guest-logging-go dependency (#526)
      * Add 'created-by' metadata, and pass it as option to logging library (#508)
      * Revert oslogin: Correctly handle newlines at the end of modified files (#520) (#523)
      * Re-enable disabled services if the core plugin was enabled (#522)
      * Enable guest services on package upgrade (#519)
      * oslogin: Correctly handle newlines at the end of modified files (#520)
      * Fix core plugin path (#518)
      * Fix package build issues (#517)
      * Fix dependencies ran go mod tidy -v (#515)
      * Fix debian build path (#514)
      * Bundle compat metadata script runner binary in package (#513)
      * Bump golang.org/x/net from 0.27.0 to 0.36.0 (#512)
      * Update startup/shutdown services to launch compat manager (#503)
      * Bundle new gce metadata script runner binary in agent package (#502)
      * Revert Revert bundling new binaries in the package (#509) (#511)
    - Version 20250418.00:
      * Re-enable disabled services if the core plugin was enabled (#521)
    - Version 20250414.00:
      * Add AuthorizedKeysCompat to windows packaging (#530)
      * Remove error messages from gce_workload_cert_refresh and metadata script runner (#527)
      * Update guest-logging-go dependency (#526)
      * Add 'created-by' metadata, and pass it as option to logging library (#508)
      * Revert oslogin: Correctly handle newlines at the end of modified files (#520) (#523)
      * Re-enable disabled services if the core plugin was enabled (#522)
      * Enable guest services on package upgrade (#519)
      * oslogin: Correctly handle newlines at the end of modified files (#520)
      * Fix core plugin path (#518)
      * Fix package build issues (#517)
      * Fix dependencies ran go mod tidy -v (#515)
      * Fix debian build path (#514)
      * Bundle compat metadata script runner binary in package (#513)
      * Bump golang.org/x/net from 0.27.0 to 0.36.0 (#512)
      * Update startup/shutdown services to launch compat manager (#503)
      * Bundle new gce metadata script runner binary in agent package (#502)
      * Revert Revert bundling new binaries in the package (#509) (#511)
    - Version 20250327.01 (bsc#1239763, bsc#1239866):
      * Remove error messages from gce_workload_cert_refresh and         metadata script runner (#527)
    - Version 20250327.00:
      * Update guest-logging-go dependency (#526)
      * Add 'created-by' metadata, and pass it as option to logging library (#508)
      * Revert oslogin: Correctly handle newlines at the end of         modified files (#520) (#523)
      * Re-enable disabled services if the core plugin was enabled (#522)
      * Enable guest services on package upgrade (#519)
      * oslogin: Correctly handle newlines at the end of modified files (#520)
      * Fix core plugin path (#518)
      * Fix package build issues (#517)
      * Fix dependencies ran go mod tidy -v (#515)
      * Fix debian build path (#514)
      * Bundle compat metadata script runner binary in package (#513)
      * Bump golang.org/x/net from 0.27.0 to 0.36.0 (#512)
      * Update startup/shutdown services to launch compat manager (#503)
      * Bundle new gce metadata script runner binary in agent package (#502)
      * Revert Revert bundling new binaries in the package (#509) (#511)
    - Version 20250326.00:
      * Re-enable disabled services if the core plugin was enabled (#521)
    - Version 20250324.00:
      * Enable guest services on package upgrade (#519)
      * oslogin: Correctly handle newlines at the end of modified files (#520)
      * Fix core plugin path (#518)
      * Fix package build issues (#517)
      * Fix dependencies ran go mod tidy -v (#515)
      * Fix debian build path (#514)
      * Bundle compat metadata script runner binary in package (#513)
      * Bump golang.org/x/net from 0.27.0 to 0.36.0 (#512)
      * Update startup/shutdown services to launch compat manager (#503)
      * Bundle new gce metadata script runner binary in agent package (#502)
      * Revert Revert bundling new binaries in the package (#509) (#511)
      * Revert bundling new binaries in the package (#509)
      * Fix typo in windows build script (#501)
      * Include core plugin binary for all packages (#500)
      * Start packaging compat manager (#498)
      * Start bundling ggactl_plugin_cleanup binary in all agent packages (#492)
      * scripts: introduce a wrapper to locally build deb package (#490)
      * Introduce compat-manager systemd unit (#497)
    - Version 20250317.00:
      * Revert Revert bundling new binaries in the package (#509) (#511)
      * Revert bundling new binaries in the package (#509)
      * Fix typo in windows build script (#501)
      * Include core plugin binary for all packages (#500)
      * Start packaging compat manager (#498)
      * Start bundling ggactl_plugin_cleanup binary in all agent packages (#492)
      * scripts: introduce a wrapper to locally build deb package (#490)
      * Introduce compat-manager systemd unit (#497)
    - Version 20250312.00:
      * Revert bundling new binaries in the package (#509)
      * Fix typo in windows build script (#501)
      * Include core plugin binary for all packages (#500)
      * Start packaging compat manager (#498)
      * Start bundling ggactl_plugin_cleanup binary in all agent packages (#492)
      * scripts: introduce a wrapper to locally build deb package (#490)
      * Introduce compat-manager systemd unit (#497)
    - Version 20250305.00:
      * Revert bundling new binaries in the package (#509)
      * Fix typo in windows build script (#501)
      * Include core plugin binary for all packages (#500)
      * Start packaging compat manager (#498)
      * Start bundling ggactl_plugin_cleanup binary in all agent packages (#492)
      * scripts: introduce a wrapper to locally build deb package (#490)
      * Introduce compat-manager systemd unit (#497)
    - Version 20250304.01:
      * Fix typo in windows build script (#501)
    - Version 20250214.01:
      * Include core plugin binary for all packages (#500)
    - Version 20250212.00:
      * Start packaging compat manager (#498)
      * Start bundling ggactl_plugin_cleanup binary in all agent packages (#492)
    - Version 20250211.00:
      * scripts: introduce a wrapper to locally build deb package (#490)
      * Introduce compat-manager systemd unit (#497)
    - Version 20250207.00:
      * vlan: toggle vlan configuration in debian packaging (#495)
      * vlan: move config out of unstable section (#494)
      * Add clarification to comments regarding invalid NICs and the         `invalid` tag. (#493)
      * Include interfaces in lists even if it has an invalid MAC. (#489)
      * Fix windows package build failures (#491)
      * vlan: don't index based on the vlan ID (#486)
      * Revert PR #482 (#488)
      * Remove Amy and Zach from OWNERS (#487)
      * Skip interfaces in interfaceNames() instead of erroring if there is an (#482)
      * Fix Debian packaging if guest agent manager is not checked out (#485)
    - Version 20250204.02:
      * force concourse to move version forward.
    - Version 20250204.01:
      * vlan: toggle vlan configuration in debian packaging (#495)
    - Version 20250204.00:
      * vlan: move config out of unstable section (#494)
      * Add clarification to comments regarding invalid NICs and the         `invalid` tag. (#493)
    - Version 20250203.01:
      * Include interfaces in lists even if it has an invalid MAC. (#489)
    - Version 20250203.00:
      * Fix windows package build failures (#491)
      * vlan: don't index based on the vlan ID (#486)
      * Revert PR #482 (#488)
      * Remove Amy and Zach from OWNERS (#487)
      * Skip interfaces in interfaceNames() instead of erroring if there is an (#482)
      * Fix Debian packaging if guest agent manager is not checked out (#485)
    - Version 20250122.00:
      * networkd(vlan): remove the interface in addition to config (#468)
      * Implement support for vlan dynamic removal, update dhclient to         remove only if configured (#465)
      * Update logging library (#479)
      * Remove Pat from owners file. (#478)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-8f83d0ed92 advisory.

    Fix CVE-2024-45337

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-0912cd3ad9 advisory.

    Update to 6.8 to get various features and fixes

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-7839-1 advisory.

    Damien Tournoud, Patrick Dawkins, Vince Parker, and Jules Duvivier discovered that Go Cryptography     incorrectly handled public keys during SSH operations. An attacker could possibly use this issue to bypass     authorization mechanisms.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0393 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2025-22869:
    SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from     clients which complete the key exchange slowly, or not at all, causing pending content to be read into     memory, but never transmitted.

    CVE-2024-45337:
    Applications and libraries which misuse connection.serverAuthenticate (via callback field     ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for     ServerConfig.PublicKeyCallback says that A call to this function does not guarantee that the key offered     is in fact used to authenticate. Specifically, the SSH protocol allows clients to inquire about whether a     public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be     called with multiple keys, and the order in which the keys were provided cannot be used to infer which key     the client successfully authenticated with, if any. Some applications, which store the key(s) passed to     PublicKeyCallback (or derived information) and make security relevant determinations based on it once the     connection is established, may make incorrect assumptions. For example, an attacker may send public keys A     and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then     with B. A vulnerable application may then make authorization decisions based on key B for which the     attacker does not actually control the private key. Since this API is widely misused, as a partial     mitigation golang.org/x/cry...@v0.31.0 enforces the property that, when successfully authenticating via     public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the     connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that     the client may still not control the last key passed to PublicKeyCallback if the connection is then     authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or     NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various     authentication callbacks to record data associated with the authentication attempt instead of referencing     external state. Once the connection is established the state corresponding to the successful     authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party     libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party     libraries should refer to the relevant projects for guidance.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0380 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2025-22872:
    The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character     (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked     as self-closing, and when using the Parse functions, this can result in content following such tags as     being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g.
    <math>, <svg>, etc contexts).

    CVE-2025-22869:
    SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from     clients which complete the key exchange slowly, or not at all, causing pending content to be read into     memory, but never transmitted.

    CVE-2024-45337:
    Applications and libraries which misuse connection.serverAuthenticate (via callback field     ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for     ServerConfig.PublicKeyCallback says that A call to this function does not guarantee that the key offered     is in fact used to authenticate. Specifically, the SSH protocol allows clients to inquire about whether a     public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be     called with multiple keys, and the order in which the keys were provided cannot be used to infer which key     the client successfully authenticated with, if any. Some applications, which store the key(s) passed to     PublicKeyCallback (or derived information) and make security relevant determinations based on it once the     connection is established, may make incorrect assumptions. For example, an attacker may send public keys A     and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then     with B. A vulnerable application may then make authorization decisions based on key B for which the     attacker does not actually control the private key. Since this API is widely misused, as a partial     mitigation golang.org/x/cry...@v0.31.0 enforces the property that, when successfully authenticating via     public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the     connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that     the client may still not control the last key passed to PublicKeyCallback if the connection is then     authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or     NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various     authentication callbacks to record data associated with the authentication attempt instead of referencing     external state. Once the connection is established the state corresponding to the successful     authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party     libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party     libraries should refer to the relevant projects for guidance.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0601-1 advisory.

    - CVE-2025-21613: Fixed argument injection via the URL field (bsc#1235573).
    - CVE-2024-45337: Fixed authorization bypass in golang.org/x/crypto via the ServerConfig.PublicKeyCallback     callback       (bsc#1234597).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2581-1 advisory.

    - CVE-2026-39827: Update golang.org/x/crypto dependency (bsc#1266171).
    - CVE-2026-39828: Update golang.org/x/crypto dependency (bsc#1266171).
    - CVE-2026-39829: Update golang.org/x/crypto dependency (bsc#1266171).
    - CVE-2026-39830: Update golang.org/x/crypto dependency (bsc#1266171).
    - CVE-2026-39831: Update golang.org/x/crypto dependency (bsc#1266171).
    - CVE-2026-39832: Update golang.org/x/crypto dependency (bsc#1266171).
    - CVE-2026-39833: Update golang.org/x/crypto dependency (bsc#1266171).
    - CVE-2026-39834: Update golang.org/x/crypto dependency (bsc#1266171).
    - CVE-2026-39835: Update golang.org/x/crypto dependency (bsc#1266171).
    - CVE-2026-42508: Update golang.org/x/crypto dependency (bsc#1266171).
    - CVE-2026-46595: Update golang.org/x/crypto dependency (bsc#1266171).
    - CVE-2026-46597: Update golang.org/x/crypto dependency (bsc#1266171).
    - CVE-2026-46598: Update golang.org/x/crypto dependency (bsc#1266171).
    - CVE-2024-45337: Update golang.org/x/crypto/ssh dependency (bsc#1234563).
    - CVE-2026-39821: Update golang.org/x/net dependency (bsc#1266603).
    - CVE-2023-45288: Update golang.org/x/net/http2 dependency (bsc#1236533).
    - CVE-2025-22869: Update golang.org/x/crypto dependency (bsc#1239334).
    - CVE-2025-22869: Update golang.org/x/crypto dependency (bsc#1253889).
    - CVE-2026-33814: Update golang.org/x/net/http2 dependency (bsc#1265762).
    - CVE-2026-33186: Update google.golang.org/grpc dependency (bsc#1260264).
    - CVE-2026-34986: Fix crafted JWE input with a missing encrypted key can lead to a denial of service     (bsc#1262926).

    Bug fixes:

    - Update to version 20260402.00 (bsc#1257010).
    - Update to version 20250506.01 (bsc#1243254, bsc#1243505).
    - Install google_metadata_script_runner_adapt script (bsc#1245759).
    - Add -buildmode=pie to go build command line (bsc#1239944).
    - Re-enable binary stripping and debuginfo (bsc#1210938).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
218740	SUSE SLES15 / openSUSE 15 Security Update : govulncheck-vulndb (SUSE-SU-2025:0770-1)	Nessus	SuSE Local Security Checks	2025/3/4	2025/3/4	critical
276084	TencentOS Server 4: buildah (TSSA-2025:0378)	Nessus	Tencent Local Security Checks	2025/11/20	2025/11/20	critical
277676	openSUSE 16 Security Update : git-bug (openSUSE-SU-2025-20143-1)	Nessus	SuSE Local Security Checks	2025/12/8	2026/2/26	medium
246552	Linux Distros Unpatched Vulnerability : CVE-2024-45337	Nessus	Misc.	2025/8/9	2026/7/18	critical
331568	openSUSE 16 Security Update : vexctl (openSUSE-SU-2026:21481-1)	Nessus	SuSE Local Security Checks	2026/8/1	2026/8/1	high
310080	openSUSE 16 Security Update : google-guest-agent (openSUSE-SU-2026:20609-1)	Nessus	SuSE Local Security Checks	2026/4/24	2026/4/24	critical
213035	Fedora 40 : golang-x-crypto (2024-8f83d0ed92)	Nessus	Fedora Local Security Checks	2024/12/16	2024/12/20	critical
213396	Fedora 41 : incus (2024-0912cd3ad9)	Nessus	Fedora Local Security Checks	2024/12/26	2024/12/26	critical
271398	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS : Go Cryptography vulnerability (USN-7839-1)	Nessus	Ubuntu Local Security Checks	2025/10/24	2025/10/24	critical
276010	TencentOS Server 4: cri-o (TSSA-2025:0393)	Nessus	Tencent Local Security Checks	2025/11/20	2025/12/4	critical
276210	TencentOS Server 4: gvisor-tap-vsock (TSSA-2025:0380)	Nessus	Tencent Local Security Checks	2025/11/20	2025/12/4	medium
277007	openSUSE 16 Security Update : trivy (openSUSE-SU-2025-20117-1)	Nessus	SuSE Local Security Checks	2025/12/2	2025/12/2	medium
310201	openSUSE 16 Security Update : rclone (openSUSE-SU-2026:20620-1)	Nessus	SuSE Local Security Checks	2026/4/25	2026/4/28	critical
216633	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : brise (SUSE-SU-2025:0601-1)	Nessus	SuSE Local Security Checks	2025/2/22	2025/2/22	critical
323027	SUSE SLES12 Security Update : google-guest-agent (SUSE-SU-2026:2581-1)	Nessus	SuSE Local Security Checks	2026/6/26	2026/6/26	high
315032	openSUSE 16 Security Update : apptainer (openSUSE-SU-2026:20730-1)	Nessus	SuSE Local Security Checks	2026/5/16	2026/5/16	high

检测

插件搜索

critical

critical

medium

critical

high

critical

critical

critical

critical

critical

medium

medium

critical

critical

high

high