The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1782386492 advisory.

  - Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive element whose content     exceeds 2 gigabytes in length may cause a heap buffer over-read on 64-bit Unix and Unix-like platforms.
    Impact summary: The heap buffer over-read may crash the application (Denial of Service) or to load into     the decoded ASN.1 object contents of memory beyond the end of the input buffer. More typically such ASN.1     elements would instead be truncated. An integer truncation in OpenSSL's ASN.1 decoder causes the content     length of an ASN.1 primitive element to be mishandled when it exceeds 2 gigabytes. In the worst case the     truncated length is treated as a request to scan the binary content for a terminating zero byte, possibly     causing OpenSSL to read either less than or beyond the end of the allocated buffer. Applications that pass     attacker-supplied data to d2i_X509(), d2i_PKCS7(), or any other d2i_* decoding function are affected.
    OpenSSL's own command-line tools are not vulnerable, as data read through the BIO layer is checked before     it reaches the affected code. The issue only affects 64-bit Unix and Unix-like platforms; 32-bit platforms     and 64-bit Windows are not affected. The FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by     this issue, as the affected code is outside the OpenSSL FIPS module boundary. (CVE-2026-34180)

  - Issue Summary: Cryptographic Message Services (CMS) processing fails to perform sufficient input     validation on the cipher and tag length fields of AuthEnvelopedData containers, leading to various     potential compromises. Impact Summary: Attackers making use of these vulnerabilities may achieve key-     equivalent functionality for a given CMS recipient and/or bypass integrity validation for a given message.
    In one use case, an attacker may send a CMS message containing AuthEnvelopedData with the cipher specified     as a non-AEAD cipher. OpenSSL erroneously allows this selection, and attempts to decrypt and validate the     message. An on-path attacker who captures one legitimate AES-GCM AuthEnvelopedData addressed to the victim     can re-emit it with the recipientInfos set left byte-for-byte intact, so the victim's private key still     unwraps the genuine CEK (the content-encryption key), but with the inner OID rewritten to AES-256-OFB     (Output Feedback Mode, an unauthenticated keystream mode) and with an attacker-chosen IV and ciphertext.
    The victim initializes AES-256-OFB under the real CEK, never consults the MAC field, and CMS_decrypt()     returns success. If the application under attack responds to the attacker with any indicator showing     success or failure of the decryption effort, it is possible for the attacker to use this as an oracle to     obtain key equivalent functionality for the CEK used for the chosen recipient of the message. In another     use case, an attacker can reduce the tag length of the chosen AEAD cipher for a given AuthEnvelopedData     container to be a single byte long, allowing an attacker to brute force CMS decryption, producing an     integrity bypass for applications that trust CMS_decrypt() to reject modified content. The FIPS modules     are not affected by this issue. (CVE-2026-34182)

  - Issue summary: Remote peer may exhaust heap memory of the QUIC server or client by flooding it with     packets containing PATH_CHALLENGE frames. Impact summary: A malicious remote peer can cause an unbounded     memory allocation which can lead to an abnormal termination of the application acting as a QUIC client or     server and a Denial of Service. A remote peer may exhaust heap memory by flooding the local QUIC stack     with PATH_CHALLENGE frames. The local QUIC stack allocates a PATH_RESPONSE frame for every PATH_CHALLENGE     it receives. The allocated PATH_RESPONSE frame gets freed only when the remote peer acknowledges reception     of the PATH_RESPONSE frame which will not be done by a malicious peer. The FIPS modules in 4.0, 3.6, 3.5,     3.4, and 3.0 are not affected by this issue. The QUIC stack is outside of OpenSSL FIPS module boundary.
    (CVE-2026-34183)

  - Issue summary: A specially crafted password-encrypted CMS message can trigger a NULL pointer dereference     during CMS decryption. Impact summary: This NULL pointer dereference leads to an application crash and a     Denial of Service. The CMS PasswordRecipientInfo.keyDerivationAlgorithm field is defined as OPTIONAL in     the ASN.1 specification and may therefore be absent in specially crafted inputs. During the password-based     CMS decryption the OpenSSL CMS implementation dereferences this field without first checking whether it     was present. An attacker who supplies such a CMS message to an application performing password-based CMS     decryption can trigger an application crash, leading to a Denial of Service. Applications that process     password-encrypted CMS messages may be affected. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not     affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary. (CVE-2026-42766)

  - Issue summary: An attacker-controlled CMP (Certificate Management Protocol) server could trigger a NULL     pointer dereference in a CMP client application. Impact summary: A NULL pointer dereference causes a crash     of the application and a Denial of Service. An attacker controlling a CMP server (or acting as a man-in-     the-middle) could craft a CMP response containing a CRMF (Certificate Request Message Format)     CertRepMessage with an EncryptedValue structure where the symmAlg field has an algorithm OID but no     parameters field. When the OpenSSL CMP client processes this response, the NULL dereference occurs,     causing a crash of the CMP client. Applications that process untrusted CMP/CRMF messages may be affected.
    The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is     outside the OpenSSL FIPS module boundary. (CVE-2026-42767)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:25237 advisory.

    OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS)     protocols, as well as a full-strength general-purpose cryptography library.

    Security Fix(es):

    * openssl: OpenSSL: Heap buffer overflow due to signed integer overflow in Unicode output sizing     (CVE-2026-7383)

    * openssl: OpenSSL: Denial of Service due to heap out-of-bounds read in CMS password-based decryption     (CVE-2026-9076)

    * openssl: OpenSSL: Heap buffer over-read in ASN.1 decoding can lead to denial of service or information     disclosure. (CVE-2026-34180)

    * openssl: PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys (CVE-2026-34181)

    * openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages (CVE-2026-34182)

    * openssl: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler (CVE-2026-34183)

    * openssl: NULL pointer dereference in QUIC server initial packet handling (CVE-2026-42764)

    * openssl: Possible NULL Dereference in Password-Based CMS Decryption (CVE-2026-42766)

    * openssl: NULL Pointer Dereference in CRMF EncryptedValue Decryption (CVE-2026-42767)

    * openssl: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt() (CVE-2026-42768)

    * openssl: Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate (CVE-2026-42769)

    * openssl: FFC-DH Peer Validation Uses Attacker-Supplied q (CVE-2026-42770)

    * openssl: AES-OCB IV Ignored on EVP_Cipher() Path (CVE-2026-45445)

    * openssl: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes (CVE-2026-45446)

    * openssl: Heap Use-After-Free in OpenSSL PKCS7_verify() (CVE-2026-45447)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:25239 advisory.

    * openssl: OpenSSL: Heap buffer overflow due to signed integer overflow in Unicode output sizing     (CVE-2026-7383)

    * openssl: OpenSSL: Denial of Service due to heap out-of-bounds read in CMS password-based decryption     (CVE-2026-9076)

    * openssl: OpenSSL: Heap buffer over-read in ASN.1 decoding can lead to denial of service or information     disclosure. (CVE-2026-34180)

    * openssl: PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys (CVE-2026-34181)

    * openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages (CVE-2026-34182)

    * openssl: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler (CVE-2026-34183)

    * openssl: NULL pointer dereference in QUIC server initial packet handling (CVE-2026-42764)

    * openssl: Possible NULL Dereference in Password-Based CMS Decryption (CVE-2026-42766)

    * openssl: NULL Pointer Dereference in CRMF EncryptedValue Decryption (CVE-2026-42767)

    * openssl: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt() (CVE-2026-42768)

    * openssl: Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate (CVE-2026-42769)

    * openssl: FFC-DH Peer Validation Uses Attacker-Supplied q (CVE-2026-42770)

    * openssl: AES-OCB IV Ignored on EVP_Cipher() Path (CVE-2026-45445)

    * openssl: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes (CVE-2026-45446)

    * openssl: Heap Use-After-Free in OpenSSL PKCS7_verify() (CVE-2026-45447)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:25237 advisory.

    * openssl: OpenSSL: Heap buffer overflow due to signed integer overflow in Unicode output sizing     (CVE-2026-7383)

    * openssl: OpenSSL: Denial of Service due to heap out-of-bounds read in CMS password-based decryption     (CVE-2026-9076)

    * openssl: OpenSSL: Heap buffer over-read in ASN.1 decoding can lead to denial of service or information     disclosure. (CVE-2026-34180)

    * openssl: PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys (CVE-2026-34181)

    * openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages (CVE-2026-34182)

    * openssl: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler (CVE-2026-34183)

    * openssl: NULL pointer dereference in QUIC server initial packet handling (CVE-2026-42764)

    * openssl: Possible NULL Dereference in Password-Based CMS Decryption (CVE-2026-42766)

    * openssl: NULL Pointer Dereference in CRMF EncryptedValue Decryption (CVE-2026-42767)

    * openssl: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt() (CVE-2026-42768)

    * openssl: Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate (CVE-2026-42769)

    * openssl: FFC-DH Peer Validation Uses Attacker-Supplied q (CVE-2026-42770)

    * openssl: AES-OCB IV Ignored on EVP_Cipher() Path (CVE-2026-45445)

    * openssl: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes (CVE-2026-45446)

    * openssl: Heap Use-After-Free in OpenSSL PKCS7_verify() (CVE-2026-45447)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-50379 advisory.

    [3.5.5-4.0.1_fips]
    - Replace upstream references in fips man pages [Orabug: 35824276]
    - Update additional upstream references
    - Add FIPS package change: add fips suffix to Release and       set Epoch to 10 [Orabug: 35824276]
    - Update FIPS module name [Orabug: 35824276]
    - Enable openssl-fips-provider dependency [Orabug: 36504822]
    - Temporary disable openssl-fips-provider dependency [Orabug: 36504822]
    - Replace upstream references [Orabug: 34340177]

    [3.5.5-4.0.1]
    - Replace upstream references [Orabug: 34340177]

    [3.5.5.openela.0.1]
    - Add OpenELA specific changes

    [1:3.5.5-4]
    - Fix CVE-2026-7383, CVE-2026-9076, CVE-2026-34180, CVE-2026-34181,     CVE-2026-34183, CVE-2026-42764, CVE-2026-42766, CVE-2026-42767, CVE-2026-42768,     CVE-2026-42769, CVE-2026-42770, CVE-2026-45445, CVE-2026-45446, CVE-2026-45447,     CVE-2026-34182.
    Resolves:             RHEL-179274     Resolves:             RHEL-179287     Resolves:             RHEL-179539     Resolves:             RHEL-179544     Resolves:             RHEL-179547     Resolves:             RHEL-179552     Resolves:             RHEL-179556     Resolves:             RHEL-179633     Resolves:             RHEL-179661     Resolves:             RHEL-179678     Resolves:             RHEL-179684     Resolves:             RHEL-179688     Resolves:             RHEL-179691     Resolves:             RHEL-179696     Resolves:             RHEL-179699

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the openssl package has been released.

The version of Tenable Identity Exposure running on the remote host is prior to 3.93.5. It is, therefore, affected by multiple vulnerabilities according to advisory TNS-2026-16:

  - Tenable Identity Exposure contains multiple unauthenticated API endpoints under /w/api/* that expose     sensitive application configuration data including cleartext LDAP credentials, SAML configuration, user     accounts, and directory settings to unauthenticated remote attackers. Affected responses are served with     Cache-Control: public headers and without Vary: Cookie, allowing reverse proxies and CDNs to cache and     serve sensitive data to unauthenticated users even after authentication is applied. (CVE-2026-13007)

  - Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows     an authorized attacker to bypass a security feature over a network. (CVE-2025-55315)

  - Converting an excessively large OCTET STRING value to a hexadecimal string leads to a heap buffer     overflow on 32 bit platforms. A heap buffer overflow may lead to a crash or possibly an attacker     controlled code execution or other undefined behavior. (CVE-2026-31789)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 7.6. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-7.6 advisory.

  - NLnet Labs Unbound 1.19.1 up to and including version 1.25.0 has a vulnerability in the DNSSEC validator     that enables denial of service and possible remote code execution as a result of deep copying a data     structure and erroneously overwriting a destination pointer. An adversary can exploit the vulnerability by     controlling a malicious signed zone and querying a vulnerable Unbound. When DS sub-queries need to suspend     validation due to NSEC3 computational budget exhaustion (introduced in Unbound 1.19.1), Unbound deep-     copies response messages to preserve them across memory region teardown. A struct-assignment bug     overwrites the destination's pointer with the source's pointer. After the sub-query region is freed, the     resumed validator dereferences this dangling pointer, triggering a crash or potentially enabling arbitrary     code execution. Unbound 1.25.1 contains a patch with a fix to preserve the correct pointer when deep     copying the data structure. (CVE-2026-33278)

  - A vulnerability has been found in GNU Binutils 2.45. The affected element is the function elf_swap_shdr in     the library bfd/elfcode.h of the component Linker. The manipulation leads to heap-based buffer overflow.
    The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The     identifier of the patch is 9ca499644a21ceb3f946d1c179c38a83be084490. To fix this issue, it is recommended     to deploy a patch. The code maintainer replied with [f]ixed for 2.46. (CVE-2025-11083)

  - A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in     the g_escape_uri_string() function. If the string to escape contains a very large number of unacceptable     characters (which would need escaping), the calculation of the length of the escaped string could     overflow, leading to a potential write off the end of the newly allocated string. (CVE-2025-13601)

  - A flaw was found in grub2. The calculation of the translation buffer when reading a language .mo file in     grub_gettext_getstr_from_position() may overflow, leading to a Out-of-bound write. This issue can be     leveraged by an attacker to overwrite grub2's sensitive heap data, eventually leading to the circumvention     of secure boot protections. (CVE-2024-45777)

  - In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a     privilege drop before running the mailer, is not a fatal error and can lead to privilege escalation.
    (CVE-2026-35535)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
361327	Rocky Linux 9.6 [TuxCare] Security Update: openssl / openssl-devel / openssl-libs / openssl-perl Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1782386492)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	critical
320629	RHEL 10 : openssl (RHSA-2026:25237)	Nessus	Red Hat Local Security Checks	2026/6/11	2026/6/12	critical
320936	RockyLinux 9 : openssl (RLSA-2026:25239)	Nessus	Rocky Linux Local Security Checks	2026/6/12	2026/6/19	critical
320952	RockyLinux 10 : openssl (RLSA-2026:25237)	Nessus	Rocky Linux Local Security Checks	2026/6/12	2026/6/19	critical
325811	Oracle Linux 9 : openssl (ELSA-2026-50379)	Nessus	Oracle Linux Local Security Checks	2026/7/9	2026/7/9	critical
333648	Photon OS 5.0: Openssl PHSA-2026-5.0-91-0874	Nessus	PhotonOS Local Security Checks	2026/8/10	2026/11/2	critical
322483	Tenable Identity Exposure < 3.93.5 Multiple Vulnerabilities (TNS-2026-16)	Nessus	Misc.	2026/6/24	2026/6/25	high
328839	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-7.6)	Nessus	Misc.	2026/7/21	2026/9/17	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

high

critical