The version of AHV installed on the remote host is prior to 11.0.1.3. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-11.0.1.3 advisory.

  - A flaw was found in GLib (Gnome Lib). This vulnerability allows a remote attacker to cause heap     corruption, leading to a denial of service or potential code execution via a buffer-underflow in the     GVariant parser when processing maliciously crafted input strings. (CVE-2025-14087)

  - In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a     privilege drop before running the mailer, is not a fatal error and can lead to privilege escalation.
    (CVE-2026-35535)

  - LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable     Network Graphics) raster image files. In versions 1.2.1 through 1.6.55, `png_set_tRNS` and `png_set_PLTE`     each alias a heap-allocated buffer between `png_struct` and `png_info`, sharing a single allocation across     two structs with independent lifetimes. The `trans_alpha` aliasing has been present since at least libpng     1.0, and the `palette` aliasing since at least 1.2.1. Both affect all prior release lines `png_set_tRNS`     sets `png_ptr->trans_alpha = info_ptr->trans_alpha` (256-byte buffer) and `png_set_PLTE` sets     `info_ptr->palette = png_ptr->palette` (768-byte buffer). In both cases, calling `png_free_data` (with     `PNG_FREE_TRNS` or `PNG_FREE_PLTE`) frees the buffer through `info_ptr` while the corresponding `png_ptr`     pointer remains dangling. Subsequent row-transform functions dereference and, in some code paths, write to     the freed memory. A second call to `png_set_tRNS` or `png_set_PLTE` has the same effect, because both     functions call `png_free_data` internally before reallocating the `info_ptr` buffer. Version 1.6.56 fixes     the issue. (CVE-2026-33416)

  - A flaw was found in rsync. It could allow a server to enumerate the contents of an arbitrary file from the     client's machine. This issue occurs when files are being copied from a client to a server. During this     process, the rsync server will send checksums of local data to the client to compare with in order to     determine what data needs to be sent to the server. By sending specially constructed checksum values for     arbitrary files, an attacker may be able to reconstruct the data of those files byte-by-byte based on the     responses from the client. (CVE-2024-12086)

  - A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a     heap based buffer, via a negative array index. The malicious rsync client requires at least read access to     the remote rsync module in order to trigger the issue. (CVE-2025-10158)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:17481 advisory.

    * rsync: Rsync: Use-after-free vulnerability in extended attribute handling (CVE-2026-41035)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0379 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2026-41035:
    In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call,     leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, many     (but not all) common configurations are vulnerable. Non-Linux platforms are more widely vulnerable.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8349-1 advisory.

    Calum Hutton discovered that rsync contained a heap-based out-of-bounds read when handling file transfers.
    A remote attacker with read access to an rsync server could possibly use this issue to cause a denial of     service. (CVE-2025-10158)

    Batuhan Sancak, Damien Neil, and Michael Stapelberg discovered that rsync daemons configured without     chroot protection were exposed to a race condition on parent path components. A local attacker with write     access to a module could possibly use this issue to overwrite files, obtain sensitive information, or     escalate privileges. (CVE-2026-29518)

    It was discovered that rsync did not properly validate a length value while sorting extended attributes.
    An attacker could possibly use this issue to cause a denial of service. (CVE-2026-41035)

    It was discovered that rsync performed reverse-DNS lookups after chrooting in some daemon configurations.
    A remote attacker could possibly use this issue to bypass hostname-based access controls and access     network services. (CVE-2026-43617)

    Omar Elsayed discovered that rsync did not properly check for integer overflows while decoding compressed     tokens. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-43618)

    Andrew Tridgell discovered that rsync did not fully fix a symlink race condition in path-based system     calls for daemons configured without chroot protection. A local attacker could possibly use this issue to     overwrite files, obtain sensitive information, or escalate privileges. (CVE-2026-43619)

    Pratham Gupta discovered that rsync did not properly validate an index while processing file lists. A     remote attacker could possibly use this issue to cause rsync to crash, resulting in a denial of service.
    (CVE-2026-43620)

    Michal Ruprich discovered that rsync contained an off-by-one error while handling HTTP proxy responses. An     attacker able to intercept network communications or a malicious proxy server could possibly use this     issue to cause a denial of service. (CVE-2026-45232)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-19152 advisory.

    - Resolves: RHEL-174929 - TOCTOU symlink race condition (CVE-2026-29518)
    - Resolves: RHEL-174949 - Memory disclosure via int overflow (CVE-2026-43618)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 7.3.1.12. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-7.3.1.12 advisory.

  - A flaw was found in GLib (Gnome Lib). This vulnerability allows a remote attacker to cause heap     corruption, leading to a denial of service or potential code execution via a buffer-underflow in the     GVariant parser when processing maliciously crafted input strings. (CVE-2025-14087)

  - In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls     gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An     unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.
    (CVE-2026-40355)

  - In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read     if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in     /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to     terminate in parse_message. (CVE-2026-40356)

  - In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call,     leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, many     (but not all) common configurations are vulnerable. Non-Linux platforms are more widely vulnerable.
    (CVE-2026-41035)

  - A flaw was found in glib. This vulnerability allows a heap buffer overflow and denial-of-service (DoS) via     an integer overflow in GLib's GIO (GLib Input/Output) escape_byte_string() function when processing     malicious file or remote filesystem attribute values. (CVE-2025-14512)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the rsync packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's     hostname-based access control list enforcement when configured with chroot. Attackers can bypass hostname-     based deny rules by controlling the PTR record for their source IP address, allowing connections from     hostnames that administrators intended to deny when reverse DNS resolution fails and defaults to     UNKNOWN.(CVE-2026-43617)

    Rsync version 3.4.2 and prior contain symlink race condition vulnerabilities in path-based system calls     including chmod, lchown, utimes, rename, unlink, mkdir, symlink, mknod, link, rmdir, and lstat that allow     local attackers to redirect operations to files outside the exported rsync module. Attackers with local     filesystem access can exploit the timing window between path resolution and syscall execution by swapping     symlinks to apply sender-supplied permissions, ownership, timestamps, or filenames to arbitrary files     outside the intended module boundary on rsync daemons configured with 'use chroot = no'.(CVE-2026-43619)

    Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon file     handling that allows attackers to redirect file writes outside intended directories by replacing parent     directory components with symbolic links. Attackers with write access to a module path can exploit this     race condition to create or overwrite arbitrary files, potentially modifying sensitive system files and     achieving privilege escalation when the daemon runs with elevated privileges. This vulnerability can only     be triggered if the chroot setting is false.(CVE-2026-29518)

    In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call,     leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, many     (but not all) common configurations are vulnerable. Non-Linux platforms are more widely     vulnerable.(CVE-2026-41035)

    Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder     where a 32-bit signed counter is not checked for overflow, allowing a malicious sender to trigger an     overflow that causes the receiver process to read and return data from outside the intended buffer bounds.
    Attackers can exploit this vulnerability to disclose process memory contents including environment     variables, passwords, heap and stack data, and library memory pointers, significantly reducing ASLR     effectiveness and facilitating further exploitation.(CVE-2026-43618)

    Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the     establish_proxy_connection() function in socket.c that allows network attackers to corrupt stack memory by     sending a malformed HTTP proxy response. Attackers can exploit this by positioning themselves between the     client and proxy or controlling the proxy server to send a response line of 1023 or more bytes without a     newline terminator, causing a null byte to be written to an out-of-bounds stack address when the     RSYNC_PROXY environment variable is set.(CVE-2026-45232)

    Rsync version 3.4.2 and prior contain a receiver-side out-of-bounds array read vulnerability in     recv_files() in receiver.c that allows a malicious rsync server to crash the rsync client process.
    Attackers can exploit the vulnerability by setting CF_INC_RECURSE in compatibility flags and sending a     specially crafted file list where the first sorted entry is not the leading dot directory, followed by a     transfer record with ndx=0 and an iflag word without ITEM_TRANSFER, causing the receiver to read 8 bytes     before the allocated pointer array and dereference an invalid pointer at an unmapped address, resulting in     a deterministic SIGSEGV crash of the rsync client.(CVE-2026-43620)

Tenable has extracted the preceding description block directly from the EulerOS rsync security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AHV installed on the remote host is prior to 10.3.1.10. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-10.3.1.10 advisory.

  - A flaw was found in GLib (Gnome Lib). This vulnerability allows a remote attacker to cause heap     corruption, leading to a denial of service or potential code execution via a buffer-underflow in the     GVariant parser when processing maliciously crafted input strings. (CVE-2025-14087)

  - In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls     gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An     unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.
    (CVE-2026-40355)

  - In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read     if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in     /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to     terminate in parse_message. (CVE-2026-40356)

  - In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call,     leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, many     (but not all) common configurations are vulnerable. Non-Linux platforms are more widely vulnerable.
    (CVE-2026-41035)

  - An issue was discovered in libsndfile 1.2.2 IMA ADPCM codec. The AIFF code path (line 241) was fixed with     (sf_count_t) cast, but the WAV code path (line 235) and close path (line 167) were not. When     samplesperblock (int) * blocks (int) exceeds INT_MAX, the 32-bit multiplication overflows before being     assigned to sf.frames (sf_count_t/int64). With samplesperblock=50000 and blocks=50000, the product     2500000000 overflows to -1794967296. This causes incorrect frame count leading to heap buffer overflow or     denial of service. Both values come from the WAV file header and are attacker-controlled. This issue was     discovered after an incomplete fix for CVE-2022-33065. (CVE-2026-37555)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3634-1 advisory.

    - CVE-2026-53783: rrsync restricted-directory escape (validation-vs-exec race + unsafe option allowlist)     (bsc#1269041).
    - CVE-2026-53784: Daemon module-root chdir escape under 'use chroot = no' (bsc#1269042).
    - CVE-2026-53785: --relative implied-parent creation escapes the destination tree (bsc#1269043).
    - CVE-2026-53786: Daemon --filter merge file bypasses the module filter list (bsc#1269044).
    - CVE-2026-53788: Daemon name-converter accepts newline-bearing names into its line protocol     (bsc#1269046).
    - CVE-2026-53789: Malicious sender expands --delete scope by reclassifying an implied parent     (bsc#1269047).
    - CVE-2026-53790: Command / argument injection via unquoted peer- or host-controlled values (bsc#1269048).
    - CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the daemon's source address     (bsc#1269049).
    - CVE-2026-53792: Receiver-supplied zero checksum block length drives sender matching negative     (bsc#1269050).
    - CVE-2026-53793: Chroot '/./' inner-module escape via a parent-component symlink (bsc#1269051).
    - CVE-2026-53794: Remote peer disables the per-allocation sanity cap via --max-alloc=0 (bsc#1269052).
    - CVE-2026-53795: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link     confinement       (bsc#1269053).
    - CVE-2026-53796: Non-daemon receiver destination-chdir symlink race (TOCTOU) (bsc#1269054).
    - CVE-2026-53797: Sender source-tree parent-component symlink race -> out-of-tree disclosure     (bsc#1269055).
    - CVE-2026-53798: Daemon name-converter empty response maps an unknown name to uid/gid 0 (bsc#1269045).
    - CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race -> arbitrary ACL set (local     privilege       escalation) (bsc#1269056).
    - CVE-2026-53800: Sender --remove-source-files unlink follows a parent-component symlink race -> arbitrary     file deletion       outside the source tree (bsc#1269057).
    - CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the transfer root / module -> out-of-     tree disclosure       (bsc#1269058).
    - CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files     (bsc#1269039).
    - CVE-2026-53803: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths       (bsc#1269040).
    - CVE-2026-70452: `hosts deny` fails OPEN when a configured hostname cannot be resolved, admitting the     host it was meant       to block (bsc#1273441).
    - CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain     (bsc#1273440).
    - CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS connection (bsc#1273439).
    - CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an rsync daemon (bsc#1273438).
    - CVE-2026-70456: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on     maxargs       (bsc#1273437).
    - CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg() error formatting (bsc#1273436).
    - CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H (bsc#1273435).
    - CVE-2026-70459: Per-connection daemon child crash from a crafted first incremental file list with a non-     directory       transfer root (bsc#1273434).
    - CVE-2026-70460: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving     via an in-       module symlink (bsc#1273433).
    - CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in add_implied_include() (bsc#1273432).
    - CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (bsc#1273431).
    - CVE-2026-70463: 'auth users' ignores documented comma-only parsing, silently skipping a deny/read-only     rule       (bsc#1273430).
    - CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module     (bsc#1273429).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
324126	Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-11.0.1.3)	Nessus	Misc.	2026/7/1	2026/8/13	critical
315073	AlmaLinux 8 : rsync (ALSA-2026:17481)	Nessus	Alma Linux Local Security Checks	2026/5/16	2026/5/26	high
316672	TencentOS Server 3: rsync (TSSA-2026:0379)	Nessus	Tencent Local Security Checks	2026/5/26	2026/5/26	high
318271	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS : rsync vulnerabilities (USN-8349-1)	Nessus	Ubuntu Local Security Checks	2026/6/3	2026/6/3	high
328733	Oracle Linux 10 : rsync (ELSA-2026-19152)	Nessus	Oracle Linux Local Security Checks	2026/7/21	2026/7/21	high
322817	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-7.3.1.12)	Nessus	Misc.	2026/6/25	2026/6/25	critical
332806	EulerOS 2.0 SP15 : rsync (EulerOS-SA-2026-2948)	Nessus	Huawei Local Security Checks	2026/8/6	2026/8/6	high
323986	Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-10.3.1.10)	Nessus	Misc.	2026/6/30	2026/8/13	critical
337988	SUSE SLES15 Security Update : rsync (SUSE-SU-2026:3634-1)	Nessus	SuSE Local Security Checks	2026/8/19	2026/8/19	critical

检测

插件搜索

critical

high

high

high

high

critical

high

critical

critical