The remote host is running a version of macOS / Mac OS X that is 26.x prior to 26.6. It is, therefore, affected by multiple vulnerabilities:

  - A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.6,     iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, visionOS 26.6, watchOS 26.6. Processing maliciously crafted     web content may lead to an unexpected Safari crash. (CVE-2026-64783)

  - A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 26.6     and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6,     watchOS 26.6. An app may be able to cause unexpected system termination. (CVE-2026-64775)

  - Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol. This issue     affects Apache HTTP Server: 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the     issue. (CVE-2026-23918)

  - The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.8.8, macOS     Tahoe 26.6. A malicious app may be able to corrupt memory of a system process. (CVE-2026-28911)

  - A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sequoia 15.7.8, macOS     Tahoe 26.6. A user may be able to elevate privileges. (CVE-2026-28912)

Note that Nessus has not tested for these issues but has instead relied only on the operating system's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-55450 advisory.

    - fix proxy environment variable change detection (CVE-2026-8927)
    - fix HTTP Negotiate connection reuse auth bypass (CVE-2026-1965)
    - fix OAuth2 bearer token leak via redirect and netrc (CVE-2026-3783)
    - fix proxy connection reuse with wrong credentials (CVE-2026-3784)
    - fix SSH host key mismatch on type difference (CVE-2026-9547)
    - fix schemeless URL handling with --proto-default (CVE-2026-12064)
    - fix TLS/STARTTLS connection reuse vulnerability (CVE-2026-8286)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of the Tenable Identity Exposure running on the remote host is prior to 3.77.17. It is, therefore, affected by multiple vulnerabilities according to advisory TNS-2026-11:

  - A flaw in Node.js's Permissions model allows attackers to bypass --allow-fs-read and --allow-fs-write     restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script     granted access only to the current directory can escape the allowed path and read sensitive files. This     breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential     system compromise. (CVE-2025-55130)

  - Improper validation of specified type of input in SQL Server allows an authorized attacker to elevate     privileges over a network. (CVE-2026-26115)

  - Improper access control in Curl allows an authorized attacker to elevate privileges over a network.
    (CVE-2026-21262)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
330144	macOS 26.x < 26.6 Multiple Vulnerabilities (128067)	Nessus	MacOS X Local Security Checks	2026/7/27	2026/8/28	critical
338021	Oracle Linux 10 : curl (ELSA-2026-55450)	Nessus	Oracle Linux Local Security Checks	2026/8/19	2026/8/19	high
307436	Tenable Identity Exposure < 3.77.17 Multiple Vulnerabilities (TNS-2026-11)	Nessus	Misc.	2026/4/18	2026/4/20	high

检测

插件搜索

critical

high

high