The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2025-10960:16 advisory.

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2025-43272)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43342)
      * webkitgtk: A website may be able to access sensor information without user consent (CVE-2025-43356)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2025-43368)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-17802 advisory.

    [2.50.0-1]
    - Update to 2.50.0

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-18097 advisory.

    [2.50.1-1]
    - Update to 2.50.1

    [2.50.0-1]
    - Update to 2.50.0

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:3701-1 advisory.

    - CVE-2025-43343: improved memory handling in web content processing to prevent process crash     (bsc#1251975)
     - CVE-2025-43272: improved memory handling to prevent unexpected process crash (bsc#1250439)
     - CVE-2025-43342: correctness issue was addressed with improved checks to prevent unexcepted process     crash (bsc#1250440)
     - CVE-2025-43356: improved handling of caches to prevent sensor access without consent (bsc#1250441)
     - CVE-2025-43368: improved memory management to prevent a use-after-free (bsc#1250442)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:18097 advisory.

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2025-43272)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43342)
      * webkitgtk: A website may be able to access sensor information without user consent (CVE-2025-43356)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2025-43368)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43343)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:19165 advisory.

    WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

    Security Fix(es):

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2025-43272)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43342)

    * webkitgtk: A website may be able to access sensor information without user consent (CVE-2025-43356)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2025-43368)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Azul Zulu installed on the remote host is 6 prior to 6.77.0.12 / 7 prior to 7.83.0.12 / 8 prior to 8.91.0.12 / 11 prior to 11.85.12 / 17 prior to 17.63.12 / 21 prior to 21.47.14 / 25 prior to 25.31.14. It is, therefore, affected by multiple vulnerabilities as referenced in the 2026-01-20 advisory.

  - A flaw was found in how GLib's GString manages memory when adding data to strings. If a string is already     very large, combining it with more input can cause a hidden overflow in the size calculation. This makes     the system think it has enough memory when it doesn't. As a result, data may be written past the end of     the allocated memory, leading to crashes or memory corruption. (CVE-2025-6052)

  - A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations     can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of     service when processing crafted input. (CVE-2025-6021)

  - A flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts     internal memory management. When XSLT functions, such as the key() process, result in tree fragments, this     corruption prevents the proper cleanup of ID attributes. As a result, the system may access freed memory,     causing crashes or enabling attackers to trigger heap corruption. (CVE-2025-7425)

  - A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26,     iOS 26 and iPadOS 26. Processing maliciously crafted web content may lead to an unexpected Safari crash.
    (CVE-2025-43368)

  - In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_trak function may read past the end of a     heap buffer while parsing an MP4 file, possibly leading to information disclosure. (CVE-2025-47219)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Java installed on the remote host is affected by multiple vulnerabilities as referenced in the January 2026 CPU advisory.
  - Vulnerability in Oracle Java SE (component: JavaFX (libxslt)). Supported versions that are affected are     Oracle Java SE: 8u471-b50. Difficult to exploit vulnerability allows unauthenticated attacker with network     access via multiple protocols to compromise Oracle Java SE. Successful attacks require human interaction     from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of     Oracle Java SE. (CVE-2025-7425)

  - Vulnerability in Oracle Java SE (component: JavaFX (WebKitGTK)). Supported versions that are affected are     Oracle Java SE: 8u471-b50. Difficult to exploit vulnerability allows unauthenticated attacker with network     access via multiple protocols to compromise Oracle Java SE. Successful attacks require human interaction     from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of     Oracle Java SE. (CVE-2025-43368)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u471,     8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle     GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a     hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition. (CVE-2026-21945)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
282788	MiracleLinux 8 : webkit2gtk3-2.50.0-1.el8_10.ML.1 (AXSA:2025-10960:16)	Nessus	Miracle Linux Local Security Checks	2026/1/13	2026/1/13	critical
270333	Oracle Linux 8 : webkit2gtk3 (ELSA-2025-17802)	Nessus	Oracle Linux Local Security Checks	2025/10/14	2025/10/14	critical
270809	Oracle Linux 9 : webkit2gtk3 (ELSA-2025-18097)	Nessus	Oracle Linux Local Security Checks	2025/10/20	2025/10/20	critical
271170	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : webkit2gtk3 (SUSE-SU-2025:3701-1)	Nessus	SuSE Local Security Checks	2025/10/22	2025/10/22	critical
271265	AlmaLinux 9 : webkit2gtk3 (ALSA-2025:18097)	Nessus	Alma Linux Local Security Checks	2025/10/23	2025/10/23	critical
271929	RHEL 8 : webkit2gtk3 (RHSA-2025:19165)	Nessus	Red Hat Local Security Checks	2025/10/28	2025/10/28	critical
294803	Azul Zulu Java Multiple Vulnerabilities (2026-01-20)	Nessus	Misc.	2026/1/21	2026/2/4	high
294870	Oracle Java SE Multiple Vulnerabilities (January 2026 CPU)	Nessus	Misc.	2026/1/21	2026/2/4	medium

检测

插件搜索

critical

critical

critical

critical

critical

critical

high

medium