The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2025:20160-1 advisory.

    - Update to version 1.3.1 (bsc#1251516, CVE-2025-47911,       bsc#1251891, CVE-2025-11579, bsc#1251651, CVE-2025-58190,       bsc#1248937, CVE-2025-58058):
      * bump github.com/containerd/containerd (#474)
      * another fix to tests for new tests (#472)
      * fixed typo in testdata (#471)
      * fixed/cleaned new tests (#470)
      * trying a new way for hauler testing (#467)
      * update for cosign v3 verify (#469)
      * added digests view to info (#465)
      * bump github.com/nwaples/rardecode/v2 from 2.1.1 to 2.2.0 in the go_modules group across 1 directory     (#457)
      * update oras-go to v1.2.7 for security patches (#464)
      * update cosign to v3.0.2+hauler.1 (#463)
      * fixed homebrew directory deprecation (#462)
      * add registry logout command (#460)

    - Update to version 1.3.0:
      * bump the go_modules group across 1 directory with 2 updates (#455)
      * upgraded versions/dependencies/deprecations (#454)
      * allow loading of docker tarballs (#452)
      * bump the go_modules group across 1 directory with 2 updates (#449)

    - update to 1.2.5 (bsc#1246722, CVE-2025-46569):
      * Bump github.com/open-policy-agent/opa from 1.1.0 to 1.4.0 in         the go_modules group across 1 directory (CVE-2025-46569)
      * deprecate auth from hauler store copy
      * Bump github.com/cloudflare/circl from 1.3.7 to 1.6.1 in the         go_modules group across 1 directory
      * Bump github.com/go-viper/mapstructure/v2 from 2.2.1 to 2.3.0         in the go_modules group across 1 directory
      * upgraded go and dependencies versions

    - Update to version 1.2.5:
      * upgraded go and dependencies versions (#444)
      * Bump github.com/go-viper/mapstructure/v2 (#442)
      * bump github.com/cloudflare/circl (#441)
      * deprecate auth from hauler store copy (#440)
      * Bump github.com/open-policy-agent/opa (#438)

    - update to 1.2.4 (CVE-2025-22872, bsc#1241804):
      * Bump golang.org/x/net from 0.37.0 to 0.38.0 in the go_modules         group across 1 directory
      * minor tests updates

    - Update to version 1.2.3:
      * formatting and flag text updates
      * add keyless signature verification (#434)
      * bump helm.sh/helm/v3 in the go_modules group across 1 directory (#430)
      * add --only flag to hauler store copy (for images) (#429)
      * fix tlog verification error/warning output (#428)

    - Update to version 1.2.2 (bsc#1241184, CVE-2024-0406):
      * cleanup new tlog flag typos and add shorthand (#426)
      * default public transparency log verification to false to be airgap friendly but allow override (#425)
      * bump github.com/golang-jwt/jwt/v4 (#423)
      * bump the go_modules group across 1 directory with 2 updates (#422)
      * bump github.com/go-jose/go-jose/v3 (#417)
      * bump github.com/go-jose/go-jose/v4 (#415)
      * clear default manifest name if product flag used with sync (#412)
      * updates for v1.2.0 (#408)
      * fixed remote code (#407)
      * added remote file fetch to load (#406)
      * added remote and multiple file fetch to sync (#405)
      * updated save flag and related logs (#404)
      * updated load flag and related logs [breaking change] (#403)
      * updated sync flag and related logs [breaking change] (#402)
      * upgraded api update to v1/updated dependencies (#400)
      * fixed consts for oci declarations (#398)
      * fix for correctly grabbing platform post cosign 2.4 updates (#393)
      * use cosign v2.4.1+carbide.2 to address containerd annotation in index.json (#390)
      * Bump the go_modules group across 1 directory with 2 updates (#385)
      * replace mholt/archiver with mholt/archives (#384)
      * forked cosign bump to 2.4.1 and use as a library vs embedded binary (#383)
      * cleaned up registry and improved logging (#378)
      * Bump golang.org/x/crypto in the go_modules group across 1 directory (#377)
    - bump net/html dependencies (bsc#1235332, CVE-2024-45338)

    - Update to version 1.1.1:
      * fixed cli desc for store env var (#374)
      * updated versions for go/k8s/helm (#373)
      * updated version flag to internal/flags (#369)
      * renamed incorrectly named consts (#371)
      * added store env var (#370)
      * adding ignore errors and retries for continue on error/fail on error (#368)
      * updated/fixed hauler directory (#354)
      * standardize consts (#353)
      * removed cachedir code (#355)
      * removed k3s code (#352)
      * updated dependencies for go, helm, and k8s (#351)
      * [feature] build with boring crypto where available (#344)
      * updated workflow to goreleaser builds (#341)
      * added timeout to goreleaser workflow (#340)
      * trying new workflow build processes (#337)
      * improved workflow performance (#336)
      * have extract use proper ref (#335)
      * yet another workflow goreleaser fix (#334)
      * even more workflow fixes (#333)
      * added more fixes to github workflow (#332)
      * fixed typo in hauler store save (#331)
      * updates to fix build processes (#330)
      * added integration tests for non hauler tarballs (#325)
      * bump: golang >= 1.23.1 (#328)
      * add platform flag to store save (#329)
      * Update feature_request.md
      * updated/standardize command descriptions (#313)
      * use new annotation for 'store save' manifest.json (#324)
      * enable docker load for hauler tarballs (#320)
      * bump to cosign v2.2.3-carbide.3 for new annotation (#322)
      * continue on error when adding images to store (#317)
      * Update README.md (#318)
      * fixed completion commands (#312)
      * github.com/rancherfederal/hauler => hauler.dev/go/hauler (#311)
      * pages: enable go install hauler.dev/go/hauler (#310)
      * Create CNAME
      * pages: initial workflow (#309)
      * testing and linting updates (#305)
      * feat-273: TLS Flags (#303)
      * added list-repos flag (#298)
      * fixed hauler login typo (#299)
      * updated cobra function for shell completion (#304)
      * updated install.sh to remove github api (#293)
      * fix image ref keys getting squashed when containing sigs/atts (#291)
      * fix missing versin info in release build (#283)
      * bump github.com/docker/docker in the go_modules group across 1 directory (#281)
      * updated install script (`install.sh`) (#280)
      * fix digest images being lost on load of hauls (Signed). (#259)
      * feat: add readonly flag (#277)
      * fixed makefile for goreleaser v2 changes (#278)
      * updated goreleaser versioning defaults (#279)
      * update feature_request.md (#274)
      * updated old references
      * updated actions workflow user
      * added dockerhub to github actions workflow
      * removed helm chart
      * added debug container and workflow
      * updated products flag description
      * updated chart for release
      * fixed workflow errors/warnings
      * fixed permissions on testdata
      * updated chart versions (will need to update again)
      * last bit of fixes to workflow
      * updated unit test workflow
      * updated goreleaser deprecations
      * added helm chart release job
      * updated github template names
      * updated imports (and go fmt)
      * formatted gitignore to match dockerignore
      * formatted all code (go fmt)
      * updated chart tests for new features
      * Adding the timeout flag for fileserver command
      * Configure chart commands to use helm clients for OCI and private registry support
      * Added some documentation text to sync command
      * Bump golang.org/x/net from 0.17.0 to 0.23.0
      * fix for dup digest smashing in cosign
      * removed vagrant scripts
      * last bit of updates and formatting of chart
      * updated hauler testdata
      * adding functionality and cleaning up
      * added initial helm chart
      * removed tag in release workflow
      * updated/fixed image ref in release workflow
      * updated/fixed platforms in release workflow
      * updated/cleaned github actions (#222)
      * Make Product Registry configurable (#194)
      * updated fileserver directory name (#219)
      * fix logging for files
      * add extra info for the tempdir override flag
      * tempdir override flag for load
      * deprecate the cache flag instead of remove
      * switch to using bci-golang as builder image
      * fix: ensure /tmp for hauler store load
      * added the copy back for now
      * remove copy at the image sync not needed with cosign update
      * removed misleading cache flag
      * better logging when adding to store
      * update to v2.2.3 of our cosign fork
      * add: dockerignore
      * add: Dockerfile
      * Bump google.golang.org/protobuf from 1.31.0 to 1.33.0
      * Bump github.com/docker/docker
      * updated and added new logos
      * updated github files

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21367-1 advisory.

    Changes in lux:

    - CVE-2026-25680, CVE-2026-42502, CVE-2026-27136, CVE-2026-25681, CVE-2026-42506:
      Issues when parsing HTML files (bsc#1267110)
    - CVE-2024-45338: Denial of service due to non-linear parsing of case-insensitive content (bsc#1235304)
    - CVE-2025-22872: Incorrectly interpreted tags can cause content to be placed wrong scope during DOM     construction (bsc#1241766)
    - CVE-2025-47911: Various algorithms with quadratic complexity when parsing HTML documents (bsc#1251460)
    - CVE-2025-58190: Excessive memory consumption (bsc#1251627)       Bump x/net to 0.57.0

    - Update to 0.24.1:
      * ci: bump go version to 1.22 #1350

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0371 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2025-4123:
    A flaw was found in Grafana's custom frontend plugin handling. This vulnerability allows an attacker to     perform a cross-site scripting (XSS) attack by exploiting a client path traversal and an open redirect     issue, leading to arbitrary JavaScript execution and potential user redirection to malicious websites.
    This attack can be carried out without requiring elevated privileges if anonymous access is enabled.

    CVE-2024-45339:
    When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a     privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When     that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix     that, glog now causes the program to exit (with status code 2) when it finds that the configured log file     already exists.

    CVE-2024-45338:
    An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to     its length, resulting in extremely slow parsing. This could cause a denial of service.

    CVE-2025-22870:
    Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For     example, when the NO_PROXY environment variable is set to *.example.com, a request to     [::1%25.example.com]:80` will incorrectly match and not be proxied.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of runfinch-finch installed on the remote host is prior to 1.6.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2025-048 advisory.

    An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to     its length, resulting in extremely slow parsing. This could cause a denial of service. (CVE-2024-45338)

    golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in     `ParseWithClaims` can lead to situation where users are potentially not checking errors in the way they     should be. Especially, if a token is both expired and invalid, the errors returned by `ParseWithClaims`     return both error codes. If users only check for the `jwt.ErrTokenExpired ` using `error.Is`, they will     ignore the embedded `jwt.ErrTokenSignatureInvalid` and thus potentially accept invalid tokens. A fix has     been back-ported with the error handling logic from the `v5` branch to the `v4` branch. In this logic, the     `ParseWithClaims` function will immediately return in dangerous situations (e.g., an invalid signature),     limiting the combined errors only to situations where the signature is valid, but further validation     failed (e.g., if the signature is valid, but is expired AND has the wrong audience). This fix is part of     the 4.5.1 release. We are aware that this changes the behaviour of an established function and is not 100     % backwards compatible, so updating to 4.5.1 might break your code. In case you cannot update to 4.5.0,     please make sure that you are properly checking for all errors (dangerous ones first), so that you are     not running in the case detailed above. (CVE-2024-51744)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20279-1 advisory.

    Update to version 1.64.0.

    Security issues fixed:

    - CVE-2024-28180: improper handling of highly compressed data (bsc#1235204).
    - CVE-2024-45338: denial of service due to non-linear parsing of case-insensitive content (bsc#1235365).
    - CVE-2025-22868: unexpected memory consumption during token parsing in golang.org/x/oauth2 (bsc#1239205).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of application-gateway-kubernetes-ingress / cert-manager / cf-cli / cni / cni-plugins installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-45338 advisory.

  - An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to     its length, resulting in extremely slow parsing. This could cause a denial of service. (CVE-2024-45338)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0321 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2024-45338:
    An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to     its length, resulting in extremely slow parsing. This could cause a denial of service.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
278653	openSUSE 16 Security Update : hauler (openSUSE-SU-2025:20160-1)	Nessus	SuSE Local Security Checks	2025/12/15	2025/12/16	high
327812	openSUSE 16 Security Update : lux (openSUSE-SU-2026:21367-1)	Nessus	SuSE Local Security Checks	2026/7/19	2026/7/19	high
275983	TencentOS Server 4: grafana (TSSA-2025:0371)	Nessus	Tencent Local Security Checks	2025/11/20	2025/11/20	high
214619	Amazon Linux 2 : runfinch-finch (ALASDOCKER-2025-048)	Nessus	Amazon Linux Local Security Checks	2025/1/24	2025/1/24	low
300773	openSUSE 16 Security Update : containerized-data-importer (openSUSE-SU-2026:20279-1)	Nessus	SuSE Local Security Checks	2026/3/5	2026/3/5	high
213588	CBL Mariner 2.0 Security Update: application-gateway-kubernetes-ingress / cert-manager / cf-cli / cni / cni-plugins (CVE-2024-45338)	Nessus	MarinerOS Local Security Checks	2025/1/9	2025/2/11	medium
275966	TencentOS Server 4: osbuild-composer (TSSA-2025:0321)	Nessus	Tencent Local Security Checks	2025/11/20	2025/12/4	high
277007	openSUSE 16 Security Update : trivy (openSUSE-SU-2025-20117-1)	Nessus	SuSE Local Security Checks	2025/12/2	2025/12/2	medium
315032	openSUSE 16 Security Update : apptainer (openSUSE-SU-2026:20730-1)	Nessus	SuSE Local Security Checks	2026/5/16	2026/5/16	high
310201	openSUSE 16 Security Update : rclone (openSUSE-SU-2026:20620-1)	Nessus	SuSE Local Security Checks	2026/4/25	2026/4/28	critical

检测

插件搜索

high

high

high

low

high

medium

high

medium

high

critical