The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Calling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND in the GNU C Library version 2.0 to     version 2.42 may cause the interface to return uninitialized memory in the we_wordv member, which on     subsequent calls to wordfree may abort the process. (CVE-2025-15281)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a2f3af8a86 advisory.

    This update switches the currency symbol for Bulgaria to the Euro.

    Furthermore, it addresses several security vulnerabilities:

    * A crash when `wordexp` is used with `WRDE_REUSE` (CVE-2025-15281)
    * Information leakage from the stack if `getnetbyaddr` is called for the zero address (CVE-2026-0915)
    * An integer overflow in `memalign` and related functions if they are called with out-of-bounds     size/alignment combinations (CVE-2026-0861)
    * `LD_PROFILE` is now ignored with a warning if `LD_PROFILE_OUTPUT` is not specified, rather than using     the insecure `/var/tmp` default.

    The changes updates from the upstream stable release branch are applied:

    * nptl: Optimize trylock for high cache contention workloads (BZ #33704) (Sunil K Pandey)
    * sprof: fix -Wformat warnings on 32-bit hosts (Collin Funk)
    * sprof: check pread size and offset for overflow (DJ Delorie)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-2786 advisory.

    - CVE-2025-15281: wordexp WRDE_REUSE uninitialized memory read (RHEL-144079)
    - CVE-2026-0915: Stack memory disclosure in getnetbyaddr (RHEL-141851)
    - CVE-2026-0861: Check for alignment overflow in memalign functions       (RHEL-141738)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:2786 advisory.

    * glibc: Integer overflow in memalign leads to heap corruption (CVE-2026-0861)
      * glibc: glibc: Information disclosure via zero-valued network query (CVE-2026-0915)
      * glibc: wordexp with WRDE_REUSE and WRDE_APPEND may return uninitialized memory (CVE-2025-15281)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the glibc packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    Calling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND in the GNU C Library version 2.0 to     version 2.42 may cause the interface to return uninitialized memory in the we_wordv member, which on     subsequent calls to wordfree may abort the process.(CVE-2025-15281)

    Calling getnetbyaddr or getnetbyaddr_r with a configured nsswitch.conf that specifies the library's DNS     backend for networks and queries for a zero-valued network in the GNU C Library version 2.0 to version     2.42 can leak stack contents to the configured DNS resolver.(CVE-2026-0915)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization glibc security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the glibc packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign,     aligned_alloc) in the GNU C Library version 2.30 to 2.42 may result in an integer overflow, which could     consequently result in a heap corruption.

    Note that the attacker must have control over both, the size as well as the alignment arguments of the     memalign function to be able to exploit this.  The size parameter must be close enough to PTRDIFF_MAX so     as to overflow size_t along with the large alignment argument.  This limits the malicious inputs for the     alignment for memalign to the range [162+ 1, 163] and exactly 163 for posix_memalign and     aligned_alloc.

    Typically the alignment argument passed to such functions is a known constrained quantity (e.g. page size,     block size, struct sizes) and is not attacker controlled, because of which this may not be easily     exploitable in practice.  An application bug could potentially result in the input alignment being too     large, e.g. due to a different buffer overflow or integer overflow in the application or its dependent     libraries, but that is again an uncommon usage pattern given typical sources of alignments.(CVE-2026-0861)

    Calling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND in the GNU C Library version 2.0 to     version 2.42 may cause the interface to return uninitialized memory in the we_wordv member, which on     subsequent calls to wordfree may abort the process.(CVE-2025-15281)

    The regcomp function in the GNU C library version from 2.4 to 2.41 is subject to a double free if some     previous allocation fails. It can be accomplished either by a malloc failure or by using an interposed     malloc  that injects random malloc failures. The double free can allow buffer manipulation depending of     how the regex is constructed. This issue affects all architectures and ABIs supported by the GNU C     library.(CVE-2025-8058)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization glibc security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:2786 advisory.

    The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard     math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system.
    Without these libraries, the Linux system cannot function correctly.

    Security Fix(es):

    * glibc: Integer overflow in memalign leads to heap corruption (CVE-2026-0861)

    * glibc: glibc: Information disclosure via zero-valued network query (CVE-2026-0915)

    * glibc: wordexp with WRDE_REUSE and WRDE_APPEND may return uninitialized memory (CVE-2025-15281)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-198:01 advisory.

    * glibc: Integer overflow in memalign leads to heap corruption (CVE-2026-0861)
      * glibc: glibc: Information disclosure via zero-valued network query (CVE-2026-0915)
      * glibc: wordexp with WRDE_REUSE and WRDE_APPEND may return uninitialized memory (CVE-2025-15281)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20133-1 advisory.

    Security fixes:

    - CVE-2025-0395: Fixed buffer overflow in the assert() function (bsc#1236282).
    - CVE-2026-0861: Fixed inadequate size check in the memalign suite may result in an integer overflow     (bsc#1256766).
    - CVE-2026-0915: Fixed uninitialized stack buffer used as DNS query name when net==0 in
    _nss_dns_getnetbyaddr_r (bsc#1256822).
    - CVE-2025-15281: Fixed uninitialized memory may cause the process abort (bsc#1257005).

    Other fixes:

    - NPTL: Optimize trylock for high cache contention workloads (bsc#1256436)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:4772 advisory.

    * glibc: glibc: Information disclosure via zero-valued network query (CVE-2026-0915)
      * glibc: wordexp with WRDE_REUSE and WRDE_APPEND may return uninitialized memory (CVE-2025-15281)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-4772 advisory.

    - CVE-2025-15281: wordexp WRDE_REUSE uninitialized memory read (RHEL-142787)
    - CVE-2026-0915: Stack memory disclosure in getnetbyaddr (RHEL-141849)
    - CVE-2025-8058: Double free in regcomp (RHEL-105326)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the glibc package has been released.

The version of AOS installed on the remote host is prior to 7.3.1.7. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-7.3.1.7 advisory.

  - LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable     Network Graphics) raster image files. Prior to 1.6.55, an out-of-bounds read vulnerability exists in the     png_set_quantize() API function. When the function is called with no histogram and the number of colors in     the palette is more than twice the maximum supported by the user's display, certain palettes will cause     the function to enter into an infinite loop that reads past the end of an internal heap-allocated buffer.
    The images that trigger this vulnerability are valid per the PNG specification. This vulnerability is     fixed in 1.6.55. (CVE-2026-25646)

  - Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat. When using an OCSP     responder, Tomcat Native (and Tomcat's FFM port of the Tomcat Native code) did not complete verification     or freshness checks on the OCSP response which could allow certificate revocation to be bypassed. This     issue affects Apache Tomcat Native: from 1.3.0 through 1.3.4, from 2.0.0 through 2.0.11; Apache Tomcat:
    from 11.0.0-M1 through 11.0.17, from 10.1.0-M7 through 10.1.51, from 9.0.83 through 9.0.114. The following     versions were EOL at the time the CVE was created but are known to be affected: from 1.1.23 through     1.1.34, from 1.2.0 through 1.2.39. Older EOL versions are not affected. Apache Tomcat Native users are     recommended to upgrade to versions 1.3.5 or later or 2.0.12 or later, which fix the issue. Apache Tomcat     users are recommended to upgrade to versions 11.0.18 or later, 10.1.52 or later or 9.0.115 or later which     fix the issue. (CVE-2026-24734)

  - Issue summary: Calling PKCS12_get_friendlyname() function on a maliciously crafted PKCS#12 file with a     BMPString (UTF-16BE) friendly name containing non-ASCII BMP code point can trigger a one byte write before     the allocated buffer. Impact summary: The out-of-bounds write can cause a memory corruption which can have     various consequences including a Denial of Service. The OPENSSL_uni2utf8() function performs a two-pass     conversion of a PKCS#12 BMPString (UTF-16BE) to UTF-8. In the second pass, when emitting UTF-8 bytes, the     helper function bmp_to_utf8() incorrectly forwards the remaining UTF-16 source byte count as the     destination buffer capacity to UTF8_putc(). For BMP code points above U+07FF, UTF-8 requires three bytes,     but the forwarded capacity can be just two bytes. UTF8_putc() then returns -1, and this negative value is     added to the output length without validation, causing the length to become negative. The subsequent     trailing NUL byte is then written at a negative offset, causing write outside of heap allocated buffer.
    The vulnerability is reachable via the public PKCS12_get_friendlyname() API when parsing attacker-     controlled PKCS#12 files. While PKCS12_parse() uses a different code path that avoids this issue,     PKCS12_get_friendlyname() directly invokes the vulnerable function. Exploitation requires an attacker to     provide a malicious PKCS#12 file to be parsed by the application and the attacker can just trigger a one     zero byte write before the allocated buffer. For that reason the issue was assessed as Low severity     according to our Security Policy. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this     issue, as the PKCS#12 implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4,     3.3, 3.0 and 1.1.1 are vulnerable to this issue. OpenSSL 1.0.2 is not affected by this issue.
    (CVE-2025-69419)

  - Vim is an open source, command line text editor. Prior to version 9.1.2132, a heap buffer overflow     vulnerability exists in Vim's tag file resolution logic when processing the 'helpfile' option. The     vulnerability is located in the get_tagfname() function in src/tag.c. When processing help file tags, Vim     copies the user-controlled 'helpfile' option value into a fixed-size heap buffer of MAXPATHL + 1 bytes     (typically 4097 bytes) using an unsafe STRCPY() operation without any bounds checking. This issue has been     patched in version 9.1.2132. (CVE-2026-25749)

  - A Use-After-Free vulnerability has been discovered in GRUB's gettext module. This flaw stems from a     programming error where the gettext command remains registered in memory after its module is unloaded. An     attacker can exploit this condition by invoking the orphaned command, causing the application to access a     memory location that is no longer valid. An attacker could exploit this vulnerability to cause grub to     crash, leading to a Denial of Service. Possible data integrity or confidentiality compromise is not     discarded. (CVE-2025-61662)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 7.5.1.2. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-7.5.1.2 advisory.

  - LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable     Network Graphics) raster image files. Prior to 1.6.55, an out-of-bounds read vulnerability exists in the     png_set_quantize() API function. When the function is called with no histogram and the number of colors in     the palette is more than twice the maximum supported by the user's display, certain palettes will cause     the function to enter into an infinite loop that reads past the end of an internal heap-allocated buffer.
    The images that trigger this vulnerability are valid per the PNG specification. This vulnerability is     fixed in 1.6.55. (CVE-2026-25646)

  - Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat. When using an OCSP     responder, Tomcat Native (and Tomcat's FFM port of the Tomcat Native code) did not complete verification     or freshness checks on the OCSP response which could allow certificate revocation to be bypassed. This     issue affects Apache Tomcat Native: from 1.3.0 through 1.3.4, from 2.0.0 through 2.0.11; Apache Tomcat:
    from 11.0.0-M1 through 11.0.17, from 10.1.0-M7 through 10.1.51, from 9.0.83 through 9.0.114. The following     versions were EOL at the time the CVE was created but are known to be affected: from 1.1.23 through     1.1.34, from 1.2.0 through 1.2.39. Older EOL versions are not affected. Apache Tomcat Native users are     recommended to upgrade to versions 1.3.5 or later or 2.0.12 or later, which fix the issue. Apache Tomcat     users are recommended to upgrade to versions 11.0.18 or later, 10.1.52 or later or 9.0.115 or later which     fix the issue. (CVE-2026-24734)

  - Issue summary: Calling PKCS12_get_friendlyname() function on a maliciously crafted PKCS#12 file with a     BMPString (UTF-16BE) friendly name containing non-ASCII BMP code point can trigger a one byte write before     the allocated buffer. Impact summary: The out-of-bounds write can cause a memory corruption which can have     various consequences including a Denial of Service. The OPENSSL_uni2utf8() function performs a two-pass     conversion of a PKCS#12 BMPString (UTF-16BE) to UTF-8. In the second pass, when emitting UTF-8 bytes, the     helper function bmp_to_utf8() incorrectly forwards the remaining UTF-16 source byte count as the     destination buffer capacity to UTF8_putc(). For BMP code points above U+07FF, UTF-8 requires three bytes,     but the forwarded capacity can be just two bytes. UTF8_putc() then returns -1, and this negative value is     added to the output length without validation, causing the length to become negative. The subsequent     trailing NUL byte is then written at a negative offset, causing write outside of heap allocated buffer.
    The vulnerability is reachable via the public PKCS12_get_friendlyname() API when parsing attacker-     controlled PKCS#12 files. While PKCS12_parse() uses a different code path that avoids this issue,     PKCS12_get_friendlyname() directly invokes the vulnerable function. Exploitation requires an attacker to     provide a malicious PKCS#12 file to be parsed by the application and the attacker can just trigger a one     zero byte write before the allocated buffer. For that reason the issue was assessed as Low severity     according to our Security Policy. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this     issue, as the PKCS#12 implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4,     3.3, 3.0 and 1.1.1 are vulnerable to this issue. OpenSSL 1.0.2 is not affected by this issue.
    (CVE-2025-69419)

  - In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to     operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated     data. There is no benefit in operating in-place in algif_aead since the source and destination come from     different mappings. Get rid of all the complexity added for in-place operation and just copy the AD     directly. (CVE-2026-31431)

  - Vim is an open source, command line text editor. Prior to version 9.1.2132, a heap buffer overflow     vulnerability exists in Vim's tag file resolution logic when processing the 'helpfile' option. The     vulnerability is located in the get_tagfname() function in src/tag.c. When processing help file tags, Vim     copies the user-controlled 'helpfile' option value into a fixed-size heap buffer of MAXPATHL + 1 bytes     (typically 4097 bytes) using an unsafe STRCPY() operation without any bounds checking. This issue has been     patched in version 9.1.2132. (CVE-2026-25749)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
294814	Linux Distros Unpatched Vulnerability : CVE-2025-15281	Nessus	Misc.	2026/1/21	2026/7/21	high
296672	Fedora 42 : glibc (2026-a2f3af8a86)	Nessus	Fedora Local Security Checks	2026/1/27	2026/2/6	high
299379	Oracle Linux 9 : glibc (ELSA-2026-2786)	Nessus	Oracle Linux Local Security Checks	2026/2/18	2026/2/18	high
299507	AlmaLinux 9 : glibc (ALSA-2026:2786)	Nessus	Alma Linux Local Security Checks	2026/2/19	2026/2/19	high
319378	EulerOS Virtualization 2.10.0 : glibc (EulerOS-SA-2026-2047)	Nessus	Huawei Local Security Checks	2026/6/6	2026/6/6	high
302706	EulerOS Virtualization 2.12.0 : glibc (EulerOS-SA-2026-1483)	Nessus	Huawei Local Security Checks	2026/3/17	2026/3/17	medium
302732	EulerOS Virtualization 2.12.1 : glibc (EulerOS-SA-2026-1426)	Nessus	Huawei Local Security Checks	2026/3/17	2026/3/17	medium
299299	RHEL 9 : glibc (RHSA-2026:2786)	Nessus	Red Hat Local Security Checks	2026/2/17	2026/2/17	high
299595	MiracleLinux 9 : glibc-2.34-231.el9_7.10 (AXSA:2026-198:01)	Nessus	Miracle Linux Local Security Checks	2026/2/19	2026/2/19	high
297781	openSUSE 16 Security Update : glibc (openSUSE-SU-2026:20133-1)	Nessus	SuSE Local Security Checks	2026/2/4	2026/2/4	high
303044	AlmaLinux 8 : glibc (ALSA-2026:4772)	Nessus	Alma Linux Local Security Checks	2026/3/19	2026/3/19	high
303105	Oracle Linux 8 : glibc (ELSA-2026-4772)	Nessus	Oracle Linux Local Security Checks	2026/3/19	2026/3/19	high
319330	EulerOS Virtualization 2.10.1 : glibc (EulerOS-SA-2026-2020)	Nessus	Huawei Local Security Checks	2026/6/6	2026/6/6	high
304843	Photon OS 4.0: Glibc PHSA-2026-4.0-0984	Nessus	PhotonOS Local Security Checks	2026/4/4	2026/4/4	medium
308349	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-7.3.1.7)	Nessus	Misc.	2026/4/21	2026/4/21	high
310779	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-7.5.1.2)	Nessus	Misc.	2026/4/29	2026/5/11	high

检测

插件搜索

high

high

high

high

high

medium

medium

high

high

high

high

high

high

medium

high

high