The version of webkitgtk4 installed on the remote host is prior to 2.54.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3987 advisory.

    In filterMask of SkEmbossMaskFilter.cpp, there is a possible out of bounds write due to an integer     overflow. This could lead to remote code execution with no additional execution privileges needed. User     interaction is not needed for exploitation. (CVE-2024-43091)

    In initializeSwizzler of SkBmpStandardCodec.cpp, there is a possible out of bounds write due to a heap     buffer overflow. This could lead to remote escalation of privilege with no additional execution privileges     needed. User interaction is not needed for exploitation. (CVE-2025-26416)

    Out-of-bounds write vulnerability in the skia module.Impact: Successful exploitation of this vulnerability     may affect service confidentiality. (CVE-2025-54627)

    A Content Security Policy bypass was addressed with improved enforcement in AudioWorklet contexts. This     issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5.
    Processing maliciously crafted web content may bypass Content Security Policy. (CVE-2026-43670)

    A permissions issue was addressed by removing the vulnerable code. This issue is fixed in Safari 27, iOS     27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing maliciously crafted     web content may disclose sensitive user information. (CVE-2026-64753)

    The issue was addressed with improved checks. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS     18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Visiting a maliciously crafted website may leak     sensitive data. (CVE-2026-64778)

    The issue was addressed with improved input validation. This issue is fixed in Safari 26.6.1, iOS 18.7.10     and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web     content may lead to an unexpected Safari crash. (CVE-2026-64781)

    A memory corruption vulnerability was addressed with improved locking. This issue is fixed in Safari     26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing     maliciously crafted web content may lead to an unexpected Safari crash. (CVE-2026-64782)

    This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iOS     18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, visionOS 27. Processing     maliciously crafted web content may lead to an unexpected Safari crash. (CVE-2026-65332)

    This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iOS     26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an     unexpected Safari crash. (CVE-2026-65351)

    A logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and     iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing maliciously crafted web     content may lead to an unexpected process termination. (CVE-2026-84635)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is running a version of macOS / Mac OS X that is 26.x prior to 26.6.2. It is, therefore, affected by multiple vulnerabilities:

  - An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in Safari     26.6.1, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, watchOS 27. Processing     maliciously crafted web content may lead to memory corruption. (CVE-2026-65391)

  - The issue was addressed with improved memory handling. This issue is fixed in iOS 26.6.1 and iPadOS     26.6.1, macOS Sequoia 15.8, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, watchOS 27. An app may be able to     cause unexpected system termination or corrupt kernel memory. (CVE-2026-28935, CVE-2026-65330)

  - A memory corruption issue was addressed with improved memory handling. This issue is fixed in Safari     26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, tvOS 27,     visionOS 27, watchOS 27. Processing maliciously crafted web content may lead to memory corruption.
    (CVE-2026-43794)

  - The issue was addressed with improved memory handling. This issue is fixed in Safari 26.6.1, iOS 18.7.10     and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, visionOS 27. Processing maliciously     crafted web content may lead to an unexpected Safari crash. (CVE-2026-43795, CVE-2026-65338)

  - A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari     26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, tvOS 27,     visionOS 27, watchOS 27. Processing maliciously crafted web content may lead to an unexpected process     crash. (CVE-2026-64715)

Note that Nessus has not tested for these issues but has instead relied only on the operating system's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-74084 advisory.

    [2.54.0-1]
    - Update to 2.54.0

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
358443	RockyLinux 8 : webkit2gtk3 (RLSA-2026:74084)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/2	critical
362401	AlmaLinux 8 : webkit2gtk3 (ALSA-2026:74084)	Nessus	Alma Linux Local Security Checks	2026/10/1	2026/11/6	critical
363124	MiracleLinux 8 : webkit2gtk3-2.54.0-1.el8_10.ML.1 (AXSA:2026-1970:09)	Nessus	Miracle Linux Local Security Checks	2026/10/6	2026/10/9	critical
371084	SUSE SLED15: WebKitGTK-4.0-lang / WebKitGTK-4.1-lang / WebKitGTK-6.0-lang / etc (SUSE-SU-2026:4858-1)	Nessus	SuSE Local Security Checks	2026/10/23	2026/10/23	critical
373939	RHEL 8 : webkit2gtk3 (RHSA-2026:92339)	Nessus	Red Hat Local Security Checks	2026/10/30	2026/10/30	critical
365286	Amazon Linux 2 : webkitgtk4 (ALAS-2026-3987)	Nessus	Amazon Linux Local Security Checks	2026/10/12	2026/10/12	critical
335968	macOS 26.x < 26.6.2 Multiple Vulnerabilities (148281)	Nessus	MacOS X Local Security Checks	2026/8/17	2026/9/21	high
362636	Rocky Linux 8 [CIQ] Security Update: webkit2gtk3 / webkit2gtk3-debuginfo / webkit2gtk3-debugsource / etc Multiple Vulnerabilities (crlsa-2026_74084)	Nessus	Rocky Linux Local Security Checks	2026/10/2	2026/10/2	critical
362691	Oracle Linux 8 : webkit2gtk3 (ELSA-2026-74084)	Nessus	Oracle Linux Local Security Checks	2026/10/2	2026/10/2	critical
372127	RHEL 9 : webkit2gtk3 (RHSA-2026:89821)	Nessus	Red Hat Local Security Checks	2026/10/26	2026/10/26	critical
376939	RHEL 8 : webkit2gtk3 (RHSA-2026:95403)	Nessus	Red Hat Local Security Checks	2026/11/6	2026/11/12	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

high

critical

critical

critical

critical