The version of the Tenable Identity Exposure running on the remote host is prior to 3.77.17. It is, therefore, affected by multiple vulnerabilities according to advisory TNS-2026-11:

  - A flaw in Node.js's Permissions model allows attackers to bypass --allow-fs-read and --allow-fs-write     restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script     granted access only to the current directory can escape the allowed path and read sensitive files. This     breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential     system compromise. (CVE-2025-55130)

  - Improper validation of specified type of input in SQL Server allows an authorized attacker to elevate     privileges over a network. (CVE-2026-26115)

  - Improper access control in Curl allows an authorized attacker to elevate privileges over a network.
    (CVE-2026-21262)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 1933737d-1d46-11f1-81da-8447094a420f advisory.

    The curl project reports:

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8084-1 advisory.

    Zhicheng Chen discovered that curl could incorrectly reuse the wrong connection for Negotiate-     authenticated HTTP or HTTPS requests. This could result in the use of credentials from a different     connection, contrary to expectations. (CVE-2026-1965)

    It was discovered that curl incorrectly leaked OAuth2 bearer tokens when following a redirect. This could     result in tokens being sent to the wrong host, contrary to expectations. (CVE-2026-3783)

    Muhamad Arga Reksapati discovered that curl incorrectly reused existing HTTP proxy connections even if the     request used different credentials. This could result in the use of incorrect credentials, contrary to     expectations. (CVE-2026-3784)

    Daniel Wade discovered that curl incorrectly handled certain memory operations when doing a second SMB     request to the same host. An attacker could use this issue to cause curl to crash, resulting in a denial     of service, or possibly execute arbitrary code. This issue only affected Ubuntu 25.10. (CVE-2026-3805)

    Yihang Zhou discovered that curl incorrectly reused .netrc file credentials when following redirects. This     could result in the use of credentials for a different host, contrary to expectations. This issue only     affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2025-0167)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the curl package has been released.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-66db242036 advisory.

    - Fix bad reuse of HTTP Negotiate connection (CVE-2026-1965)
    - Fix token leak with redirect and netrc (CVE-2026-3783)
    - Fix wrong proxy connection reuse with credentials (CVE-2026-3784)
    - Fix use after free in SMB connection reuse (CVE-2026-3805)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-f13d888b0f advisory.

    - Fix bad reuse of HTTP Negotiate connection (CVE-2026-1965)
    - Fix token leak with redirect and netrc (CVE-2026-3783)
    - Fix wrong proxy connection reuse with credentials (CVE-2026-3784)
    - Fix use after free in SMB connection reuse (CVE-2026-3805)

    ----

    -  Fix `Could not find digest algorithm UNDEF (NID 0)`

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    libcurl can in some circumstances reuse the wrong connection when asked to do_x000D_     an Negotiate-authenticated HTTP or HTTPS request._x000D_
    _x000D_     libcurl features a pool of recent connections so that subsequent requests can_x000D_     reuse an existing connection to avoid overhead._x000D_
    _x000D_     When reusing a connection a range of criterion must first be met. Due to a_x000D_     logical error in the code, a request that was issued by an application could_x000D_     wrongfully reuse an existing connection to the same server that was_x000D_     authenticated using different credentials. One underlying reason being that_x000D_     Negotiate sometimes authenticates *connections* and not *requests*, contrary_x000D_     to how HTTP is designed to work._x000D_
    _x000D_     An application that allows Negotiate authentication to a server (that responds_x000D_     wanting Negotiate) with `user1:password1` and then does another operation to_x000D_     the same server also using Negotiate but with `user2:password2` (while the_x000D_     previous connection is still alive) - the second request wrongly reused the_x000D_     same connection and since it then sees that the Negotiate negotiation is_x000D_     already made, it just sends the request over that connection thinking it uses_x000D_     the user2 credentials when it is in fact still using the connection_x000D_     authenticated for user1..._x000D_
    _x000D_     The set of authentication methods to use is set with  `CURLOPT_HTTPAUTH`._x000D_
    _x000D_     Applications can disable libcurl's reuse of connections and thus mitigate this_x000D_     problem, by using one of the following libcurl options to alter how_x000D_     connections are or are not reused: `CURLOPT_FRESH_CONNECT`,_x000D_     `CURLOPT_MAXCONNECTS` and `CURLMOPT_MAX_HOST_CONNECTIONS` (if using the_x000D_     curl_multi API).(CVE-2026-1965)

    curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a_x000D_     server, even if the new request uses different credentials for the HTTP proxy._x000D_     The proper behavior is to create or use a separate connection.(CVE-2026-3784)

    When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer_x000D_     performs a redirect to a second URL, curl could leak that token to the second_x000D_     hostname under some circumstances._x000D_
    _x000D_     If the hostname that the first request is redirected to has information in the_x000D_     used .netrc file, with either of the `machine` or `default` keywords, curl_x000D_     would pass on the bearer token set for the first host also to the second one.(CVE-2026-3783)

Tenable has extracted the preceding description block directly from the EulerOS curl security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_55439 advisory.

    * curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication     (CVE-2026-1965)

    * curl: curl: Information disclosure via OAuth2 bearer token leakage during HTTP(S) redirect     (CVE-2026-3783)

    * curl: curl: Man-in-the-middle attack via SSH host key bypass (CVE-2026-9547)

    * curl: curl: Insecure connection establishment due to TLS configuration mismatch (CVE-2026-8286)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1773939685 advisory.

  - libcurl can in some circumstances reuse the wrong connection when asked to do an Negotiate-authenticated     HTTP or HTTPS request. libcurl features a pool of recent connections so that subsequent requests can reuse     an existing connection to avoid overhead. When reusing a connection a range of criterion must first be     met. Due to a logical error in the code, a request that was issued by an application could wrongfully     reuse an existing connection to the same server that was authenticated using different credentials. One     underlying reason being that Negotiate sometimes authenticates *connections* and not *requests*, contrary     to how HTTP is designed to work. An application that allows Negotiate authentication to a server (that     responds wanting Negotiate) with `user1:password1` and then does another operation to the same server also     using Negotiate but with `user2:password2` (while the previous connection is still alive) - the second     request wrongly reused the same connection and since it then sees that the Negotiate negotiation is     already made, it sends the request over that connection thinking it uses the user2 credentials when it is     in fact still using the connection authenticated for user1... The set of authentication methods to use is     set with `CURLOPT_HTTPAUTH`. Applications can disable libcurl's reuse of connections and thus mitigate     this problem, by using one of the following libcurl options to alter how connections are or are not     reused: `CURLOPT_FRESH_CONNECT`, `CURLOPT_MAXCONNECTS` and `CURLMOPT_MAX_HOST_CONNECTIONS` (if using the     curl_multi API). (CVE-2026-1965)

  - When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a redirect to a     second URL, curl could leak that token to the second hostname under some circumstances. If the hostname     that the first request is redirected to has information in the used .netrc file, with either of the     `machine` or `default` keywords, curl would pass on the bearer token set for the first host also to the     second one. (CVE-2026-3783)

  - curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a server, even if the new     request uses different credentials for the HTTP proxy. The proper behavior is to create or use a separate     connection. (CVE-2026-3784)

  - When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing     into already freed memory. (CVE-2026-3805)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-55439 advisory.

    - fix HTTP Negotiate connection reuse auth bypass (CVE-2026-1965)
    - fix OAuth2 bearer token leak via redirect and netrc (CVE-2026-3783)
    - fix SSH host key mismatch on type difference (CVE-2026-9547)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-55450 advisory.

    - fix proxy environment variable change detection (CVE-2026-8927)
    - fix HTTP Negotiate connection reuse auth bypass (CVE-2026-1965)
    - fix OAuth2 bearer token leak via redirect and netrc (CVE-2026-3783)
    - fix proxy connection reuse with wrong credentials (CVE-2026-3784)
    - fix SSH host key mismatch on type difference (CVE-2026-9547)
    - fix schemeless URL handling with --proto-default (CVE-2026-12064)
    - fix TLS/STARTTLS connection reuse vulnerability (CVE-2026-8286)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    When doing TLS related transfers with reused easy or multi handles and altering the     `CURLSSLOPT_NO_PARTIALCHAIN` option, libcurl could accidentally reuse a CA store cached in memory for     which the partial chain option was reversed. Contrary to the user's wishes and expectations. This could     make libcurl find and accept a trust chain that it otherwise would not.(CVE-2025-14819)

    When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl,changing TLS options in one thread     would inadvertently change them globally and therefore possibly also affect other concurrently setup     transfers.Disabling certificate verification for a specific transfer could unintentionally disable the     feature for other threads as well.(CVE-2025-14017)

    When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could     still mistakenly accept connecting to hosts *not present* in the specified file if they were added as     recognized in the libssh *global* known_hosts file.(CVE-2025-15079)

    When doing SSH-based transfers using either SCP or SFTP, and asked to do public key authentication, curl     would wrongly still ask and authenticate using a locally running SSH agent.(CVE-2025-15224)

    When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol     redirect to a second URL that uses an IMAP, LDAP,POP3 or SMTP scheme, curl might wrongly pass on the     bearer token to the new     target host.(CVE-2025-14524)

    curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a server, even if the new     request uses different credentials for the HTTP proxy.The proper behavior is to create or use a separate     connection.(CVE-2026-3784)

    When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a redirect to a     second URL, curl could leak that token to the second hostname under some circumstances.If the hostname     that the first request is redirected to has information in the used .netrc file, with either of the     `machine` or `default` keywords, curl would pass on the bearer token set for the first host also to the     second one.(CVE-2026-3783)

    libcurl can in some circumstances reuse the wrong connection when asked to do an Negotiate-authenticated     HTTP or HTTPS request.libcurl features a pool of recent connections so that subsequent requests can reuse     an existing connection to avoid overhead.When reusing a connection a range of criterion must first be met.
    Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an     existing connection to the same server that was authenticated using different credentials. One underlying     reason being that Negotiate sometimes authenticates *connections* and not *requests*, contrary to how HTTP     is designed to work.An application that allows Negotiate authentication to a server (that responds wanting     Negotiate) with `user1:password1` and then does another operation to the same server also using Negotiate     but with `user2:password2` (while the previous connection is still alive) - the second request wrongly     reused the same connection and since it then sees that the Negotiate negotiation is     already made, it just sends the request over that connection thinking it uses the user2 credentials when     it is in fact still using the connection authenticated for user1... The set of authentication methods to     use is set with  `CURLOPT_HTTPAUTH`.Applications can disable libcurl's reuse of connections and thus     mitigate this problem, by using one of the following libcurl options to alter how connections are or are     not reused: `CURLOPT_FRESH_CONNECT`,`CURLOPT_MAXCONNECTS` and `CURLMOPT_MAX_HOST_CONNECTIONS` (if using     the curl_multi API).(CVE-2026-1965)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization curl security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is running a version of macOS / Mac OS X that is 26.x prior to 26.6. It is, therefore, affected by multiple vulnerabilities:

  - A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Sequoia     15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. Connecting to a malicious afpfs server may lead to kernel     memory corruption. (CVE-2026-43815)

  - Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol. This issue     affects Apache HTTP Server: 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the     issue. (CVE-2026-23918)

  - A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS     Sequoia 15.8, macOS Tahoe 26.6, macOS Tahoe 26.7. An app may bypass Gatekeeper checks. (CVE-2026-28899)

  - The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.8.8, macOS     Tahoe 26.6. A malicious app may be able to corrupt memory of a system process. (CVE-2026-28911)

  - A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sequoia 15.7.8, macOS     Sonoma 14.8.7, macOS Tahoe 26.6. A user may be able to elevate privileges. (CVE-2026-28912)

Note that Nessus has not tested for these issues but has instead relied only on the operating system's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
307436	Tenable Identity Exposure < 3.77.17 Multiple Vulnerabilities (TNS-2026-11)	Nessus	Misc.	2026/4/18	2026/4/20	high
301882	FreeBSD : curl -- Multiple vulnerabilties (1933737d-1d46-11f1-81da-8447094a420f)	Nessus	FreeBSD Local Security Checks	2026/3/11	2026/5/8	medium
302211	Ubuntu 22.04 LTS / 24.04 LTS / 25.10 : curl vulnerabilities (USN-8084-1)	Nessus	Ubuntu Local Security Checks	2026/3/13	2026/5/8	medium
303001	Photon OS 4.0: Curl PHSA-2026-4.0-0977	Nessus	PhotonOS Local Security Checks	2026/3/19	2026/11/2	medium
307656	Fedora 43 : curl (2026-66db242036)	Nessus	Fedora Local Security Checks	2026/4/20	2026/5/8	medium
310432	Fedora 44 : curl (2026-f13d888b0f)	Nessus	Fedora Local Security Checks	2026/4/27	2026/5/8	medium
320296	EulerOS 2.0 SP13 : curl (EulerOS-SA-2026-2283)	Nessus	Huawei Local Security Checks	2026/6/10	2026/6/10	medium
354192	Rocky Linux 9 [CIQ] Security Update: curl / curl-debuginfo / curl-debugsource / curl-minimal / etc Multiple Vulnerabilities (crlsa-2026_55439)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	high
361814	AlmaLinux 9.6 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1773939685)	Nessus	Alma Linux Local Security Checks	2026/10/1	2026/10/1	medium
338020	Oracle Linux 9 : curl (ELSA-2026-55439)	Nessus	Oracle Linux Local Security Checks	2026/8/19	2026/8/19	high
338021	Oracle Linux 10 : curl (ELSA-2026-55450)	Nessus	Oracle Linux Local Security Checks	2026/8/19	2026/8/19	high
377387	EulerOS Virtualization 2.15.1 : curl (EulerOS-SA-2026-4547)	Nessus	Huawei Local Security Checks	2026/11/7	2026/11/7	medium
330144	macOS 26.x < 26.6 Multiple Vulnerabilities (128067)	Nessus	MacOS X Local Security Checks	2026/7/27	2026/9/21	high

检测

插件搜索

high

medium

medium

medium

medium

medium

medium

high

medium

high

high

medium

high