It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1889 advisory.

    Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.
    (CVE-2026-25680)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1888 advisory.

    Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.
    (CVE-2026-25680)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1886 advisory.

    Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.
    (CVE-2026-25680)

    Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can     be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
    (CVE-2026-25681)

    Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can     be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
    (CVE-2026-27136)

    The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-     only label. For example, ToUnicode(xn--example-.com) incorrectly returns the name example.com rather     than an error. This behavior can lead to privilege escalation in programs using the idna package. For     example, a program which performs privilege checks on the ASCII hostname may reject example.com but     permit xn--example-.com. If that program subsequently converts the ASCII hostname to Unicode, it will     inadvertently permits access to the Unicode name example.com. (CVE-2026-39821)

    Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can     be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
    (CVE-2026-42502)

    Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive     CPU. (CVE-2026-42504)

    Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can     be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
    (CVE-2026-42506)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1885 advisory.

    Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.
    (CVE-2026-25680)

    Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can     be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
    (CVE-2026-25681)

    Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can     be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
    (CVE-2026-27136)

    (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject     Alternative Name (SAN) entries. This caused strings.Split(host, .) to execute repeatedly on the same     input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of     SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before     building the certificate chain, this overhead occurred even for untrusted certificates. (CVE-2026-27145)

    The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-     only label. For example, ToUnicode(xn--example-.com) incorrectly returns the name example.com rather     than an error. This behavior can lead to privilege escalation in programs using the idna package. For     example, a program which performs privilege checks on the ASCII hostname may reject example.com but     permit xn--example-.com. If that program subsequently converts the ASCII hostname to Unicode, it will     inadvertently permits access to the Unicode name example.com. (CVE-2026-39821)

    Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can     be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
    (CVE-2026-42502)

    Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive     CPU. (CVE-2026-42504)

    Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can     be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
    (CVE-2026-42506)

    When returning errors, functions in the net/textproto package would include its input as part of the     error. This might allow an attacker to inject misleading content to errors that are printed or logged.
    (CVE-2026-42507)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21281-1 advisory.

    This update for cosign fixes the following issues

    - CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: multiple issues when parsing     HTML files (bsc#1267044).
    - CVE-2026-33815: memory-safety vulnerability (bsc#1261811).
    - CVE-2026-39827,CVE-2026-39828,CVE-2026-39829,CVE-2026-39830,CVE-2026-39831,CVE-2026-39832,CVE-2026-     39833,CVE-2026-39834,CVE-2026-39835,CVE-2026-42508,CVE-2026-46595,CVE-2026-46597,CVE-2026-46598: Fixed     multiple issues in golang.org/x/crypto/ssh. (bsc#1266049).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-6e4f15e36b advisory.

    Automatic update for gum-2.0.0-1.fc45.

    ##### **Changelog**

    ```
    * Fri Aug 21 2026 Carl George <carlwgeorge@fedoraproject.org> - 2.0.0-1
    - Update to version 2.0.0 (rhbz#2495240)
    - Override bundled golang.org/x/net to v0.55.0 (CVE-2026-25680       CVE-2026-25681 CVE-2026-42506)

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-f33ade2ba6 advisory.

    This update aligns the package to the latest Upstream release, which is also the first stable version of     complyctl.

    It introduced the core redesign from OSCAL to Gemara. The project has gone through three pre-release     milestones (alpha, beta, RC) with contributions from 11 people across 200+ commits. This release marks the     point where the CLI surface, configuration format, provider gRPC API, and output formats are considered     stable under semantic versioning.
    More information in https://github.com/complytime/complyctl/releases/tag/v1.0.0

    The providers, formerly plugins, were also moved to their own repository and are no longer delivered in     the same package of complyctl. A new package called complytime-providers is being introduced to Fedora     repositories via https://bugzilla.redhat.com/show_bug.cgi?id=2526823



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
322063	Amazon Linux 2023 : git-lfs (ALAS2023-2026-1889)	Nessus	Amazon Linux Local Security Checks	2026/6/22	2026/6/22	medium
322079	Amazon Linux 2023 : cni-plugins (ALAS2023-2026-1888)	Nessus	Amazon Linux Local Security Checks	2026/6/22	2026/6/22	medium
322091	Amazon Linux 2023 : runfinch-finch (ALAS2023-2026-1886)	Nessus	Amazon Linux Local Security Checks	2026/6/22	2026/7/2	high
322109	Amazon Linux 2023 : credentials-fetcher (ALAS2023-2026-1885)	Nessus	Amazon Linux Local Security Checks	2026/6/22	2026/7/2	high
326678	openSUSE 16: cosign / cosign-bash-completion / cosign-fish-completion / etc (openSUSE-SU-2026:21281-1)	Nessus	SuSE Local Security Checks	2026/7/14	2026/7/14	critical
338836	Fedora 45 : gum (2026-6e4f15e36b)	Nessus	Fedora Local Security Checks	2026/8/22	2026/8/22	medium
343965	Fedora 44 : complyctl (2026-f33ade2ba6)	Nessus	Fedora Local Security Checks	2026/9/9	2026/9/9	critical

检测

插件搜索

medium

medium

high

high

critical

medium

critical