The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:58819 advisory.

    * brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function     (CVE-2026-14257)

    * ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification     (CVE-2026-54272)

    * brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)

    * ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and     trust-boundary bypass (CVE-2026-69192)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:54371 advisory.

    * sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)

    * sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5     (CVE-2026-11824)

    * brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function     (CVE-2026-14257)

    * ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification     (CVE-2026-54272)

    * brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)

    * ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and     trust-boundary bypass (CVE-2026-69192)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:55603 advisory.

    * sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)
      * sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5     (CVE-2026-11824)
      * brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function     (CVE-2026-14257)
      * ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address     misclassification (CVE-2026-54272)
      * brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)
      * ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF)     and trust-boundary bypass (CVE-2026-69192)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_58819 advisory.

    * brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function     (CVE-2026-14257)

    * ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification     (CVE-2026-54272)

    * brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)

    * ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and     trust-boundary bypass (CVE-2026-69192)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand()     function limits the number of results with a max option (default 100,000) but does not bound the length of     each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit     while making each result progressively longer, so total memory scales with both count and string length     until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input     ('{a,b}'.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced     strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can     be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds     accumulated output and intermediate arrays. (CVE-2026-14257)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1639:01 advisory.

    * sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)
      * sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5     (CVE-2026-11824)
      * brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function     (CVE-2026-14257)
      * brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)
      * ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF)     and trust-boundary bypass (CVE-2026-69192)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:55603 advisory.

    * sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)

    * sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5     (CVE-2026-11824)

    * brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function     (CVE-2026-14257)

    * ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification     (CVE-2026-54272)

    * brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)

    * ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and     trust-boundary bypass (CVE-2026-69192)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:55541 advisory.

    * brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function     (CVE-2026-14257)

    * brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)

    * ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and     trust-boundary bypass (CVE-2026-69192)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:54530 advisory.

    * sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)

    * sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5     (CVE-2026-11824)

    * brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function     (CVE-2026-14257)

    * brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)

    * ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and     trust-boundary bypass (CVE-2026-69192)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:57590 advisory.

    Red Hat build of Podman Desktop is a graphical tool for managing containers using Podman. It allows users     to run, manage, and configure containers and container images using a desktop GUI.

    Security Fix(es):

    * github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted     JSON Web Encryption (JWE) object (CVE-2026-34986)

    * ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input     (CVE-2026-42338)

    * protobufjs: protobufjs: Denial of Service via crafted JSON descriptors (CVE-2026-45740)

    * ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray` (CVE-2026-45736)

    * devalue: devalue: Excessive memory consumption via deserialization of sparse arrays (CVE-2026-42570)

    * tmp: path Traversal via unsanitized prefix/postfix enables directory escape (CVE-2026-44705)

    * form-data: form-data: Form field override via CRLF injection (CVE-2026-12143)

    * webpack-dev-server: webpack-dev-server: Information disclosure and denial of service via improper proxy     configuration (CVE-2026-9595)

    * ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments (CVE-2026-48779)

    * extract-zip: github.com/maxogden/extract-zip: extract-zip: Arbitrary file write and information     disclosure via symlink validation bypass (CVE-2026-56876)

    * fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization     (CVE-2026-13676)

    * brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149)

    * tar: Node-tar: Denial of Service via malformed tar archive header (CVE-2026-59874)

    * tar: node-tar: Denial of Service via crafted gzip bomb (CVE-2026-59873)

    * js-yaml: js-yaml: Denial of Service via crafted YAML documents (CVE-2026-59869)

    * protobufjs: protobufjs: Denial of Service via crafted .proto schema (CVE-2026-59877)

    * grpc-js: @grpc/grpc-js: Server crash via malformed HTTP/2 stream initiation (CVE-2026-48068)

    * linkify-it: linkify-it: Denial of Service via algorithmic complexity vulnerability (CVE-2026-48801)

    * dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution (CVE-2026-49978)

    * brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function     (CVE-2026-14257)

    * postcss: PostCSS: Information disclosure and denial of service via crafted CSS input (CVE-2026-45623)

    * postcss: PostCSS: Information disclosure via crafted sourceMappingURL (CVE-2026-69153)

    * brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation     (CVE-2026-69152)

    * ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and     trust-boundary bypass (CVE-2026-69192)

    Bug Fix(es) and Enhancement(s):

    * Release RH Podman Desktop 1.1.2 to RHEL 10.2 Extensions (JIRA:RHEL-238929)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-54371 advisory.

    - deps: update npm/brace-expansion to 5.9.0       Fix: CVE-2026-69192 & CVE-2026-54272 CVE-2026-69152       Resolves: RHEL-223388 RHEL-223907 RHEL-223792
    - Backport patch update sqlite to 3.53.4       Fixes: CVE-2026-11824, CVE-2026-11822       Resolves: RHEL-218252 RHEL-218257
    - Backport patches for various CVEs       Fixes: CVE-2026-59873 CVE-2026-59874 CVE-2026-13149       Resolves: RHEL-194176 RHEL-194179 RHEL-208658
    - Rebase npm/brace-expansion to 5.0.9       Fixes: CVE-2026-69152       Resolves: RHEL-223789

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1566:01 advisory.

    * sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)
      * sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5     (CVE-2026-11824)
      * brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function     (CVE-2026-14257)
      * ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address     misclassification (CVE-2026-54272)
      * brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)
      * ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF)     and trust-boundary bypass (CVE-2026-69192)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1641:01 advisory.

    * sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)
      * sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5     (CVE-2026-11824)
      * brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function     (CVE-2026-14257)
      * ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address     misclassification (CVE-2026-54272)
      * brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)
      * ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF)     and trust-boundary bypass (CVE-2026-69192)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:54371 advisory.

    * sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)
      * sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5     (CVE-2026-11824)
      * brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function     (CVE-2026-14257)
      * ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address     misclassification (CVE-2026-54272)
      * brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)
      * ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF)     and trust-boundary bypass (CVE-2026-69192)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:55601 advisory.

    * sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)
      * sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5     (CVE-2026-11824)
      * brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function     (CVE-2026-14257)
      * brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)
      * ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF)     and trust-boundary bypass (CVE-2026-69192)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_54371 advisory.

    * sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)

    * sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5     (CVE-2026-11824)

    * brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function     (CVE-2026-14257)

    * ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification     (CVE-2026-54272)

    * brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)

    * ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and     trust-boundary bypass (CVE-2026-69192)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
339426	RockyLinux 10 : nodejs24 (RLSA-2026:58819)	Nessus	Rocky Linux Local Security Checks	2026/8/25	2026/8/26	high
339535	RockyLinux 8 : nodejs:24 (RLSA-2026:54371)	Nessus	Rocky Linux Local Security Checks	2026/8/25	2026/8/25	high
342184	AlmaLinux 9 : nodejs:24 (ALSA-2026:55603)	Nessus	Alma Linux Local Security Checks	2026/9/1	2026/9/1	high
356552	Rocky Linux 10.2 [CIQ] Security Update: nodejs24 / nodejs24-debuginfo / nodejs24-debugsource / etc Multiple Vulnerabilities (crlsa-2026_58819)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/2	high
329732	Linux Distros Unpatched Vulnerability : CVE-2026-14257	Nessus	Misc.	2026/7/25	2026/10/29	high
339111	MiracleLinux 9 : nodejs:22 (AXSA:2026-1639:01)	Nessus	Miracle Linux Local Security Checks	2026/8/24	2026/11/3	high
339465	RockyLinux 9 : nodejs:24 (RLSA-2026:55603)	Nessus	Rocky Linux Local Security Checks	2026/8/25	2026/8/25	high
337636	RockyLinux 10 : nodejs22 (RLSA-2026:55541)	Nessus	Rocky Linux Local Security Checks	2026/8/18	2026/8/19	high
339534	RockyLinux 8 : nodejs:22 (RLSA-2026:54530)	Nessus	Rocky Linux Local Security Checks	2026/8/25	2026/10/30	high
338414	RHEL 10 : rh-podman-desktop (RHSA-2026:57590)	Nessus	Red Hat Local Security Checks	2026/8/20	2026/8/20	critical
335747	Oracle Linux 8 : nodejs:24 (ELSA-2026-54371)	Nessus	Oracle Linux Local Security Checks	2026/8/15	2026/8/15	high
337728	MiracleLinux 8 : nodejs:24 (AXSA:2026-1566:01)	Nessus	Miracle Linux Local Security Checks	2026/8/18	2026/8/19	high
339112	MiracleLinux 9 : nodejs:24 (AXSA:2026-1641:01)	Nessus	Miracle Linux Local Security Checks	2026/8/24	2026/8/25	high
345625	AlmaLinux 8 : nodejs:24 (ALSA-2026:54371)	Nessus	Alma Linux Local Security Checks	2026/9/14	2026/9/14	high
345683	AlmaLinux 9 : nodejs:22 (ALSA-2026:55601)	Nessus	Alma Linux Local Security Checks	2026/9/14	2026/10/26	high
359401	Rocky Linux 8 [CIQ] Security Update: nodejs / nodejs-debuginfo / nodejs-debugsource / nodejs-devel / etc Multiple Vulnerabilities (crlsa-2026_54371)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

critical

high

high

high

high

high

high