The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:18070 advisory.

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43343)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:3905-1 advisory.

    - CVE-2025-43343: Fixed an issue where processing maliciously crafted web content may lead to an     unexpected process crash (bsc#1251975)
      - CVE-2025-43272: Fixed an issue where processing maliciously crafted web content may lead to an     unexpected Safari crash (bsc#1250439)
      - CVE-2025-43342: Fixed an issue where processing maliciously crafted web content may lead to an     unexpected process crash (bsc#1250440)
      - CVE-2025-43356: Fixed an issue where websites may be able to access sensor information without user     consent (bsc#1250441)
      - CVE-2025-43368: Fixed an issue where processing maliciously crafted web content may lead to an     unexpected Safari crash (bsc#1250442)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:19914 advisory.

    WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

    Security Fix(es):

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43343)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of webkitgtk4 installed on the remote host is prior to 2.48.7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-3073 advisory.

    The issue was addressed with improved memory handling. This issue is fixed in Safari 26, visionOS 26,     watchOS 26, macOS Tahoe 26, iOS 26 and iPadOS 26. Processing maliciously crafted web content may lead to     an unexpected Safari crash. (CVE-2025-43272)

    A correctness issue was addressed with improved checks. This issue is fixed in tvOS 26, Safari 26, iOS     18.7 and iPadOS 18.7, visionOS 26, watchOS 26, macOS Tahoe 26, iOS 26 and iPadOS 26. Processing     maliciously crafted web content may lead to an unexpected process crash. (CVE-2025-43342)

    The issue was addressed with improved memory handling. This issue is fixed in tvOS 26, Safari 26, visionOS     26, watchOS 26, macOS Tahoe 26, iOS 26 and iPadOS 26. Processing maliciously crafted web content may lead     to an unexpected process crash. (CVE-2025-43343)

    The issue was addressed with improved handling of caches. This issue is fixed in tvOS 26, Safari 26, iOS     18.7 and iPadOS 18.7, visionOS 26, watchOS 26, macOS Tahoe 26, iOS 26 and iPadOS 26. A website may be able     to access sensor information without user consent. (CVE-2025-43356)

    A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26,     macOS Tahoe 26, iOS 26 and iPadOS 26. Processing maliciously crafted web content may lead to an unexpected     Safari crash. (CVE-2025-43368)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-4ffeeb504f advisory.

    Update to WebKitGTK 2.50.1:

     * Improve text rendering performance.
     * Fix audio playback broken on instagram.
     * Fix rendering of layers with fractional transforms.
     * Fix several crashes and rendering issues.
     * Fix CVE-2025-43343

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20065-1 advisory.

    Update to version 2.50.4.

    Security issues fixed:

    - CVE-2025-13502: processing of maliciously crafted payloads by the GLib remote inspector server may lead     to a       UIProcess crash due to an out-of-bounds read and an integer underflow (bsc#1254208).
    - CVE-2025-13947: use of the file drag-and-drop mechanism may lead to remote information disclosure due to     a lack of       verification of the origins of drag operations (bsc#1254473).
    - CVE-2025-14174: processing maliciously crafted web content may lead to memory corruption due to improper     validation       (bsc#1255497).
    - CVE-2025-43272: processing maliciously crafted web content may lead to an unexpected process crash due     to improper       memory handling (bsc#1250439).
    - CVE-2025-43342: processing maliciously crafted web content may lead to an unexpected process crash due     to a       correctness issue and missing checks (bsc#1250440).
    - CVE-2025-43343: processing maliciously crafted web content may lead to an unexpected process crash due     to improper       memory handling (bsc#1251975).
    - CVE-2025-43356: a website may be able to access sensor information without user consent due to improper     cache handling       (bsc#1250441).
    - CVE-2025-43368: processing maliciously crafted web content may lead to an unexpected process crash due     to a       use-after-free issue (bsc#1250442).
    - CVE-2025-43392: websites may exfiltrate image data cross-origin due to issues with cache handling     (bsc#1254165).
    - CVE-2025-43419: processing maliciously crafted web content may lead to memory corruption due to improper     memory       handling (bsc#1254166).
    - CVE-2025-43421: processing maliciously crafted web content may lead to an unexpected process crash due     to enabled       array allocation sinking (bsc#1254167).
    - CVE-2025-43425: processing maliciously crafted web content may lead to an unexpected process crash due     to improper       memory handling (bsc#1254168).
    - CVE-2025-43427: processing maliciously crafted web content may lead to an unexpected process crash due     to issues with       state management (bsc#1254169).
    - CVE-2025-43429: processing maliciously crafted web content may lead to an unexpected process crash due     to a buffer       overflow issue (bsc#1254174).
    - CVE-2025-43430: processing maliciously crafted web content may lead to an unexpected process crash due     to issues with       state management (bsc#1254172).
    - CVE-2025-43431: processing maliciously crafted web content may lead to memory corruption due to improper     memory       handling (bsc#1254170).
    - CVE-2025-43432: processing maliciously crafted web content may lead to an unexpected process crash due     to a       use-after-free issue (bsc#1254171).
    - CVE-2025-43434: processing maliciously crafted web content may lead to an unexpected process crash due     to a       use-after-free issue (bsc#1254179).
    - CVE-2025-43440: processing maliciously crafted web content may lead to an unexpected process crash due     to missing       checks (bsc#1254177).
    - CVE-2025-43443: processing maliciously crafted web content may lead to an unexpected process crash due     to missing       checks (bsc#1254176).
    - CVE-2025-43458: processing maliciously crafted web content may lead to an unexpected process crash due     to issues with       state management (bsc#1254498).
    - CVE-2025-43501: processing maliciously crafted web content may lead to an unexpected process crash due     to a buffer       overflow issue (bsc#1255194).
    - CVE-2025-43529: processing maliciously crafted web content may lead to arbitrary code execution due to a       use-after-free issue (bsc#1255198).
    - CVE-2025-43531: processing maliciously crafted web content may lead to an unexpected process crash due     to a race       condition (bsc#1255183).
    - CVE-2025-43535: processing maliciously crafted web content may lead to an unexpected process crash due     to improper       memory handling (bsc#1255195).
    - CVE-2025-43536: processing maliciously crafted web content may lead to an unexpected process crash due     to a       use-after-free issue (bsc#1255200).
    - CVE-2025-43541: processing maliciously crafted web content may lead to an unexpected process crash due     to type       confusion (bsc#1255191).
    - CVE-2025-66287: processing maliciously crafted web content may lead to an unexpected process crash due     to improper       memory handling (bsc#1254509).

    Other issues fixed and changes:

    - Version 2.50.4:
      * Correctly handle the program name passed to the sleep disabler.
      * Ensure GStreamer is initialized before using the Quirks.
      * Fix several crashes and rendering issues.

    - Version 2.50.3:
      * Fix seeking and looping of media elements that set the loop property.
      * Fix several crashes and rendering issues.

    - Version 2.50.2:
      * Prevent unsafe URI schemes from participating in media playback.
      * Make jsc_value_array_buffer_get_data() function introspectable.
      * Fix logging in to Google accounts that have a WebAuthn second factor configured.
      * Fix loading webkit://gpu when there are no threads configured for GPU rendering.
      * Fix rendering gradiants that use the CSS hue interpolation method.
      * Fix pasting image data from the clipboard.
      * Fix font-family selection when the font name contains spaces.
      * Fix the build with standard C libraries that lack execinfo.h, like Musl or uClibc.
      * Fix capturing canvas snapshots in the Web Inspector.
      * Fix several crashes and rendering issues.

    - Version 2.50.1:
      * Improve text rendering performance.
      * Fix audio playback broken on instagram.
      * Fix rendering of layers with fractional transforms.
      * Fix the build with ENABLE(VIDEO) disabled.
      * Fix the build in s390x.
      * Fix several crashes and rendering issues.

    - Version 2.50.0:
      * Improved rendering performance by recording each layer once and replaying every dirty region in     different worker         threads.
      * Enable damage propagation to the UI process by default.
      * CSS property font-variant-emoji is now enabled by default.
      * Font synthesis properties (bold/italic) are now properly handled.
      * Ensure web view is focused on tap gesture.
      * Added new API to get the theme color of a WebKitWebView.

    - Version 2.49.90:
      * Add support for font collection / fragment identifiers.
      * Fix web process deadlock on exit.
      * Fix stuttering when playing WebP animations
      * Fix CSS animations with cubic-bezier timing function.
      * Do not start the MemoryPressureMonitor if its disabled
      * Fix several crashes and rendering issues.
      * Updated translations.

    - Version 2.48.6:
      * Fix emojis incorrectly rendered in their text variant.
      * Add support for font collection / fragment identifiers.
      * Fix web process deadlock on exit.
      * Fix stuttering when playing WebP animations.
      * Fix CSS animations with cubic-bezier timing function.
      * Do not start the MemoryPressureMonitor if it's disabled.
      * Fix several crashes and rendering issues.

    - Fix a11y regression where AT-SPI roles were mapped incorrectly.
    - Disable skia on ppc64le.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of Apple TV on the remote device is prior to 26. It is therefore affected by multiple vulnerabilities as described in the 125114

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Debian Linux - webkit2gtk - The issue was addressed with improved memory handling. This issue is fixed in     Safari 26, iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. Processing maliciously     crafted web content may lead to an unexpected process crash.  wpewebkit - The issue was addressed with     improved memory handling. This issue is fixed in Safari 26, iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26,     visionOS 26, watchOS 26. Processing maliciously crafted web content may lead to an unexpected process     crash.  Red Hat Enterprise Linux - webkitgtk: Processing maliciously crafted web content may lead to an     unexpected process crash  Ubuntu Linux - The issue was addressed with improved memory handling. This issue     is fixed in Safari 26, iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. Processing     maliciously crafted web content may lead to an unexpected process crash. (CVE-2025-43343)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Debian 12 / 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6042 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6042-1                   security@debian.org     https://www.debian.org/security/                           Alberto Garcia     October 28, 2025                      https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : webkit2gtk     CVE ID         : CVE-2025-43272 CVE-2025-43342 CVE-2025-43343 CVE-2025-43356                      CVE-2025-43368

    The following vulnerabilities have been discovered in the WebKitGTK     web engine:

    CVE-2025-43272

        Big Bear discovered that processing maliciously crafted web         content may lead to an unexpected process crash.

    CVE-2025-43342

        An anonymous researcher discovered that processing maliciously         crafted web content may lead to an unexpected process crash.

    CVE-2025-43343

        An anonymous researcher discovered that processing maliciously         crafted web content may lead to an unexpected process crash.

    CVE-2025-43356

        Jaydev Ahire discovered that a website may be able to access         sensor information without user consent.

    CVE-2025-43368

        Pawel Wylecial discovered that processing maliciously crafted web         content may lead to an unexpected process crash.

    This WebKitGTK update causes a compatibility problem with older     versions of Evolution when handling e-mail attachments. For this     reason, fixed versions of Evolution have also been released along with     this WebKitGTK update.

    For the oldstable distribution (bookworm), these problems have been fixed     in version 2.50.1-1~deb12u1.

    For the stable distribution (trixie), these problems have been fixed in     version 2.50.1-1~deb13u1.

    We recommend that you upgrade your webkit2gtk packages.

    For the detailed security status of webkit2gtk please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/webkit2gtk

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:19919 advisory.

    WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

    Security Fix(es):

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43343)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.04 / 25.10 host has packages installed that are affected by a vulnerability as referenced in the USN-7895-1 advisory.

    Several security issues were discovered in the WebKitGTK Web and JavaScript engines. If a user were     tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to     web browser security, including cross-site scripting attacks, denial of service attacks, and arbitrary     code execution.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2025-10977:17 advisory.

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43343)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0981 advisory.

    Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:

    CVE-2025-43343:
    The issue was addressed with improved memory handling. This issue is fixed in tvOS 26, Safari 26, visionOS     26, watchOS 26, macOS Tahoe 26, iOS 26 and iPadOS 26. Processing maliciously crafted web content may lead     to an unexpected process crash.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:20102-1 advisory.

    Update to version 2.50.4.

    Security issues fixed:

    - CVE-2025-13502: processing of maliciously crafted payloads by the GLib remote inspector server may lead     to a       UIProcess crash due to an out-of-bounds read and an integer underflow (bsc#1254208).
    - CVE-2025-13947: use of the file drag-and-drop mechanism may lead to remote information disclosure due to     a lack of       verification of the origins of drag operations (bsc#1254473).
    - CVE-2025-14174: processing maliciously crafted web content may lead to memory corruption due to improper     validation       (bsc#1255497).
    - CVE-2025-43272: processing maliciously crafted web content may lead to an unexpected process crash due     to improper       memory handling (bsc#1250439).
    - CVE-2025-43342: processing maliciously crafted web content may lead to an unexpected process crash due     to a       correctness issue and missing checks (bsc#1250440).
    - CVE-2025-43343: processing maliciously crafted web content may lead to an unexpected process crash due     to improper       memory handling (bsc#1251975).
    - CVE-2025-43356: a website may be able to access sensor information without user consent due to improper     cache handling       (bsc#1250441).
    - CVE-2025-43368: processing maliciously crafted web content may lead to an unexpected process crash due     to a       use-after-free issue (bsc#1250442).
    - CVE-2025-43392: websites may exfiltrate image data cross-origin due to issues with cache handling     (bsc#1254165).
    - CVE-2025-43419: processing maliciously crafted web content may lead to memory corruption due to improper     memory       handling (bsc#1254166).
    - CVE-2025-43421: processing maliciously crafted web content may lead to an unexpected process crash due     to enabled       array allocation sinking (bsc#1254167).
    - CVE-2025-43425: processing maliciously crafted web content may lead to an unexpected process crash due     to improper       memory handling (bsc#1254168).
    - CVE-2025-43427: processing maliciously crafted web content may lead to an unexpected process crash due     to issues with       state management (bsc#1254169).
    - CVE-2025-43429: processing maliciously crafted web content may lead to an unexpected process crash due     to a buffer       overflow issue (bsc#1254174).
    - CVE-2025-43430: processing maliciously crafted web content may lead to an unexpected process crash due     to issues with       state management (bsc#1254172).
    - CVE-2025-43431: processing maliciously crafted web content may lead to memory corruption due to improper     memory       handling (bsc#1254170).
    - CVE-2025-43432: processing maliciously crafted web content may lead to an unexpected process crash due     to a       use-after-free issue (bsc#1254171).
    - CVE-2025-43434: processing maliciously crafted web content may lead to an unexpected process crash due     to a       use-after-free issue (bsc#1254179).
    - CVE-2025-43440: processing maliciously crafted web content may lead to an unexpected process crash due     to missing       checks (bsc#1254177).
    - CVE-2025-43443: processing maliciously crafted web content may lead to an unexpected process crash due     to missing       checks (bsc#1254176).
    - CVE-2025-43458: processing maliciously crafted web content may lead to an unexpected process crash due     to issues with       state management (bsc#1254498).
    - CVE-2025-43501: processing maliciously crafted web content may lead to an unexpected process crash due     to a buffer       overflow issue (bsc#1255194).
    - CVE-2025-43529: processing maliciously crafted web content may lead to arbitrary code execution due to a       use-after-free issue (bsc#1255198).
    - CVE-2025-43531: processing maliciously crafted web content may lead to an unexpected process crash due     to a race       condition (bsc#1255183).
    - CVE-2025-43535: processing maliciously crafted web content may lead to an unexpected process crash due     to improper       memory handling (bsc#1255195).
    - CVE-2025-43536: processing maliciously crafted web content may lead to an unexpected process crash due     to a       use-after-free issue (bsc#1255200).
    - CVE-2025-43541: processing maliciously crafted web content may lead to an unexpected process crash due     to type       confusion (bsc#1255191).
    - CVE-2025-66287: processing maliciously crafted web content may lead to an unexpected process crash due     to improper       memory handling (bsc#1254509).

    Other issues fixed and changes:

    - Version 2.50.4:
      * Correctly handle the program name passed to the sleep disabler.
      * Ensure GStreamer is initialized before using the Quirks.
      * Fix several crashes and rendering issues.

    - Version 2.50.3:
      * Fix seeking and looping of media elements that set the loop property.
      * Fix several crashes and rendering issues.

    - Version 2.50.2:
      * Prevent unsafe URI schemes from participating in media playback.
      * Make jsc_value_array_buffer_get_data() function introspectable.
      * Fix logging in to Google accounts that have a WebAuthn second factor configured.
      * Fix loading webkit://gpu when there are no threads configured for GPU rendering.
      * Fix rendering gradiants that use the CSS hue interpolation method.
      * Fix pasting image data from the clipboard.
      * Fix font-family selection when the font name contains spaces.
      * Fix the build with standard C libraries that lack execinfo.h, like Musl or uClibc.
      * Fix capturing canvas snapshots in the Web Inspector.
      * Fix several crashes and rendering issues.

    - Version 2.50.1:
      * Improve text rendering performance.
      * Fix audio playback broken on instagram.
      * Fix rendering of layers with fractional transforms.
      * Fix the build with ENABLE(VIDEO) disabled.
      * Fix the build in s390x.
      * Fix several crashes and rendering issues.

    - Version 2.50.0:
      * Improved rendering performance by recording each layer once and replaying every dirty region in     different worker         threads.
      * Enable damage propagation to the UI process by default.
      * CSS property font-variant-emoji is now enabled by default.
      * Font synthesis properties (bold/italic) are now properly handled.
      * Ensure web view is focused on tap gesture.
      * Added new API to get the theme color of a WebKitWebView.

    - Version 2.49.90:
      * Add support for font collection / fragment identifiers.
      * Fix web process deadlock on exit.
      * Fix stuttering when playing WebP animations
      * Fix CSS animations with cubic-bezier timing function.
      * Do not start the MemoryPressureMonitor if its disabled
      * Fix several crashes and rendering issues.
      * Updated translations.

    - Version 2.48.6:
      * Fix emojis incorrectly rendered in their text variant.
      * Add support for font collection / fragment identifiers.
      * Fix web process deadlock on exit.
      * Fix stuttering when playing WebP animations.
      * Fix CSS animations with cubic-bezier timing function.
      * Do not start the MemoryPressureMonitor if it's disabled.
      * Fix several crashes and rendering issues.

    - Fix a11y regression where AT-SPI roles were mapped incorrectly.
    - Disable skia on ppc64le.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:19916 advisory.

    WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

    Security Fix(es):

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43343)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apple iOS running on the mobile device is prior to 26. It is, therefore, affected by multiple vulnerabilities.

The remote host is running a version of macOS / Mac OS X that is 26.x prior to 26.0. It is, therefore, affected by multiple vulnerabilities:

  - There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could     exceed the number of columns available. This could lead to a memory corruption issue. We recommend     upgrading to version 3.50.2 or above. (CVE-2025-6965)

  - A buffer-overread issue was discovered in StringIO 3.0.1, as distributed in Ruby 3.0.x through 3.0.6 and     3.1.x through 3.1.4. The ungetbyte and ungetc methods on a StringIO can read past the end of a string, and     a subsequent call to StringIO.gets may return the memory value. 3.0.3 is the main fixed version; however,     for Ruby 3.0 users, a fixed version is stringio 3.0.1.1, and for Ruby 3.1 users, a fixed version is     stringio 3.0.1.2. (CVE-2024-27280)

  - The issue was addressed with improved input sanitization. This issue is fixed in macOS Sequoia 15.5. An     app may be able to gain elevated privileges. (CVE-2025-31259)

  - Perl threads have a working directory race condition where file operations may target unintended paths. If     a directory handle is open at thread creation, the process-wide current working directory is temporarily     changed in order to clone that handle for the new thread, which is visible from any third (or more) thread     already running. This may lead to unintended operations such as loading code or accessing files from     unexpected locations, which a local attacker may be able to exploit. The bug was introduced in commit     11a11ecf4bea72b17d250cfb43c897be1341861e and released in Perl version 5.13.6 (CVE-2025-40909)

  - A configuration issue was addressed with additional restrictions. (CVE-2025-24088, CVE-2025-24197,     CVE-2025-31255, CVE-2025-31268, CVE-2025-31269, CVE-2025-31270, CVE-2025-31271, CVE-2025-43190,     CVE-2025-43204, CVE-2025-43207, CVE-2025-43208, CVE-2025-43262, CVE-2025-43272, CVE-2025-43279,     CVE-2025-43283, CVE-2025-43285, CVE-2025-43286, CVE-2025-43287, CVE-2025-43291, CVE-2025-43292,     CVE-2025-43293, CVE-2025-43294, CVE-2025-43297, CVE-2025-43298, CVE-2025-43301, CVE-2025-43302,     CVE-2025-43304, CVE-2025-43305, CVE-2025-43307, CVE-2025-43308, CVE-2025-43310, CVE-2025-43311,     CVE-2025-43312, CVE-2025-43314, CVE-2025-43315, CVE-2025-43316, CVE-2025-43317, CVE-2025-43318,     CVE-2025-43319, CVE-2025-43321, CVE-2025-43325, CVE-2025-43326, CVE-2025-43327, CVE-2025-43328,     CVE-2025-43329, CVE-2025-43330, CVE-2025-43331, CVE-2025-43332, CVE-2025-43333, CVE-2025-43337,     CVE-2025-43340, CVE-2025-43341, CVE-2025-43342, CVE-2025-43343, CVE-2025-43344, CVE-2025-43346,     CVE-2025-43347, CVE-2025-43353, CVE-2025-43354, CVE-2025-43356, CVE-2025-43357, CVE-2025-43359,     CVE-2025-43366, CVE-2025-43367, CVE-2025-43368, CVE-2025-43369)

Note that Nessus has not tested for these issues but has instead relied only on the operating system's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
272197	AlmaLinux 8 : webkit2gtk3 (ALSA-2025:18070)	Nessus	Alma Linux Local Security Checks	2025/11/3	2025/11/3	critical
274424	SUSE SLES12: libjavascriptcoregtk-4_0-18 / libwebkit2gtk-4_0-37 / etc (SUSE-SU-2025:3905-1)	Nessus	SuSE Local Security Checks	2025/11/7	2026/6/25	critical
274456	RHEL 9 : webkit2gtk3 (RHSA-2025:19914)	Nessus	Red Hat Local Security Checks	2025/11/7	2025/11/7	critical
274685	Amazon Linux 2 : webkitgtk4, --advisory ALAS2-2025-3073 (ALAS-2025-3073)	Nessus	Amazon Linux Local Security Checks	2025/11/11	2025/11/11	critical
275252	Fedora 42 : webkitgtk (2025-4ffeeb504f)	Nessus	Fedora Local Security Checks	2025/11/12	2025/11/12	critical
294939	openSUSE 16 Security Update : webkit2gtk3 (openSUSE-SU-2026:20065-1)	Nessus	SuSE Local Security Checks	2026/1/22	2026/3/10	critical
265335	Apple TV < 26 Multiple Vulnerabilities (125114)	Nessus	Misc.	2025/9/17	2025/9/17	high
271535	Linux Distros Unpatched Vulnerability : CVE-2025-43343	Nessus	Misc.	2025/10/27	2026/9/16	medium
271852	Debian dsa-6042 : gir1.2-javascriptcoregtk-4.0 - security update	Nessus	Debian Local Security Checks	2025/10/28	2025/10/28	critical
274455	RHEL 8 : webkit2gtk3 (RHSA-2025:19919)	Nessus	Red Hat Local Security Checks	2025/11/7	2025/11/7	critical
277315	Ubuntu 22.04 LTS / 24.04 LTS / 25.04 / 25.10 : WebKitGTK vulnerabilities (USN-7895-1)	Nessus	Ubuntu Local Security Checks	2025/12/3	2025/12/3	critical
283423	MiracleLinux 8 : webkit2gtk3-2.50.1-1.el8_10.ML.1 (AXSA:2025-10977:17)	Nessus	Miracle Linux Local Security Checks	2026/1/13	2026/1/13	critical
284630	TencentOS Server 2: webkitgtk4 (TSSA-2025:0981)	Nessus	Tencent Local Security Checks	2026/1/14	2026/1/14	critical
296427	SUSE SLES16 Security Update : webkit2gtk3 (SUSE-SU-2026:20102-1)	Nessus	SuSE Local Security Checks	2026/1/24	2026/3/10	critical
274444	RHEL 8 : webkit2gtk3 (RHSA-2025:19916)	Nessus	Red Hat Local Security Checks	2025/11/7	2025/11/7	critical
264814	Apple iOS < 26 Multiple Vulnerabilities (125108)	Nessus	Mobile Devices	2025/9/15	2026/11/9	high
265371	macOS 26.x < 26.0 Multiple Vulnerabilities (125110)	Nessus	MacOS X Local Security Checks	2025/9/18	2026/1/21	high

检测

插件搜索

critical

critical

critical

critical

critical

critical

high

medium

critical

critical

critical

critical

critical

critical

critical

high

high