The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21281-1 advisory.

    This update for cosign fixes the following issues

    - CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: multiple issues when parsing     HTML files (bsc#1267044).
    - CVE-2026-33815: memory-safety vulnerability (bsc#1261811).
    - CVE-2026-39827,CVE-2026-39828,CVE-2026-39829,CVE-2026-39830,CVE-2026-39831,CVE-2026-39832,CVE-2026-     39833,CVE-2026-39834,CVE-2026-39835,CVE-2026-42508,CVE-2026-46595,CVE-2026-46597,CVE-2026-46598: Fixed     multiple issues in golang.org/x/crypto/ssh. (bsc#1266049).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of amazon-ssm-agent installed on the remote host is prior to 3.3.4624.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3809 advisory.

    An authenticated SSH client that repeatedly opened channels which were rejected by the server caused     unbounded memory growth, eventually crashing the server process and affecting all connected users.
    Rejected channels are now properly removed from the connection's internal state and released for garbage     collection. (CVE-2026-39827)

    The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key     with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during     signature verification. This could be triggered by unauthenticated clients during public key     authentication. RSA moduli are now limited to 8192 bits, and DSA parameters are validated per FIPS 186-2.
    (CVE-2026-39829)

    A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking     the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a     resource leak per connection. Unsolicited global responses are now discarded. (CVE-2026-39830)

    The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-     ed25519@openssh.com) did not check the User Presence flag. Signatures generated without physical touch     were accepted, allowing unattended use of a hardware security key. To restore the previous behavior,     return a no-touch-required extension in Permissions.Extensions from PublicKeyCallback. (CVE-2026-39831)

    When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the     internal payload size calculation caused the write loop to spin indefinitely, sending empty packets     without making progress. The size comparison now uses int64 to prevent truncation. (CVE-2026-39834)

    SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or     IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an     error instead of panicking when these callbacks are nil. (CVE-2026-39835)

    go-git is an extensible git implementation library written in pure Go. Prior to versions 5.18.0 and     6.0.0-alpha.2, go-git may leak HTTP authentication credentials when following redirects during smart-HTTP     clone and fetch operations. This issue has been patched in versions 5.18.0 and 6.0.0-alpha.2.
    (CVE-2026-41506)

    Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both     the 'key' and 'key.SignatureKey' are checked for @revoked. (CVE-2026-42508)

    An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder     for well-crafted inputs. (CVE-2026-46597)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-f33ade2ba6 advisory.

    This update aligns the package to the latest Upstream release, which is also the first stable version of     complyctl.

    It introduced the core redesign from OSCAL to Gemara. The project has gone through three pre-release     milestones (alpha, beta, RC) with contributions from 11 people across 200+ commits. This release marks the     point where the CLI surface, configuration format, provider gRPC API, and output formats are considered     stable under semantic versioning.
    More information in https://github.com/complytime/complyctl/releases/tag/v1.0.0

    The providers, formerly plugins, were also moved to their own repository and are no longer delivered in     the same package of complyctl. A new package called complytime-providers is being introduced to Fedora     repositories via https://bugzilla.redhat.com/show_bug.cgi?id=2526823



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-8590121cf7 advisory.

    release v2.0.0

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2581-1 advisory.

    - CVE-2026-39827: Update golang.org/x/crypto dependency (bsc#1266171).
    - CVE-2026-39828: Update golang.org/x/crypto dependency (bsc#1266171).
    - CVE-2026-39829: Update golang.org/x/crypto dependency (bsc#1266171).
    - CVE-2026-39830: Update golang.org/x/crypto dependency (bsc#1266171).
    - CVE-2026-39831: Update golang.org/x/crypto dependency (bsc#1266171).
    - CVE-2026-39832: Update golang.org/x/crypto dependency (bsc#1266171).
    - CVE-2026-39833: Update golang.org/x/crypto dependency (bsc#1266171).
    - CVE-2026-39834: Update golang.org/x/crypto dependency (bsc#1266171).
    - CVE-2026-39835: Update golang.org/x/crypto dependency (bsc#1266171).
    - CVE-2026-42508: Update golang.org/x/crypto dependency (bsc#1266171).
    - CVE-2026-46595: Update golang.org/x/crypto dependency (bsc#1266171).
    - CVE-2026-46597: Update golang.org/x/crypto dependency (bsc#1266171).
    - CVE-2026-46598: Update golang.org/x/crypto dependency (bsc#1266171).
    - CVE-2024-45337: Update golang.org/x/crypto/ssh dependency (bsc#1234563).
    - CVE-2026-39821: Update golang.org/x/net dependency (bsc#1266603).
    - CVE-2023-45288: Update golang.org/x/net/http2 dependency (bsc#1236533).
    - CVE-2025-22869: Update golang.org/x/crypto dependency (bsc#1239334).
    - CVE-2025-22869: Update golang.org/x/crypto dependency (bsc#1253889).
    - CVE-2026-33814: Update golang.org/x/net/http2 dependency (bsc#1265762).
    - CVE-2026-33186: Update google.golang.org/grpc dependency (bsc#1260264).
    - CVE-2026-34986: Fix crafted JWE input with a missing encrypted key can lead to a denial of service     (bsc#1262926).

    Bug fixes:

    - Update to version 20260402.00 (bsc#1257010).
    - Update to version 20250506.01 (bsc#1243254, bsc#1243505).
    - Install google_metadata_script_runner_adapt script (bsc#1245759).
    - Add -buildmode=pie to go build command line (bsc#1239944).
    - Re-enable binary stripping and debuginfo (bsc#1210938).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21069-1 advisory.

    This update for google-guest-agent fixes the following issues

    - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2     :path pseudo-       header (bsc#1260264).
    - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for     validation       bypass and privilege escalation (bsc#1266603).
    - CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh     (bsc#1266171).
    - CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266171).
    - CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh     (bsc#1266171).
    - CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in     golang.org/x/crypto/ssh       (bsc#1266171).
    - CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in     golang.org/x/crypto/ssh       (bsc#1266171).
    - CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent       (bsc#1266171).
    - CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266171).
    - CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266171).
    - CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh     (bsc#1266171).
    - CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in     golang.org/x/crypto/ssh/knownhosts       (bsc#1266171).
    - CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in     golang.org/x/crypto/ssh       (bsc#1266171).
    - CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh     (bsc#1266171).
    - CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent     (bsc#1266171).

    Changes for google-guest-agent:

    - Update to version 20260529.00
     * Dependency updates (#616)
    - from version 20260522.00
     * Fix improper umask calculation on socket creation (#614)
    - from version 20260520.01
     * Update OWNERS (#609)
     * Bump google.golang.org/grpc from 1.75.0 to 1.79.3 (#602) (bsc#1260264, CVE-2026-33186)
    - Update to version 20250506.01 (bsc#1243254, bsc#1243505)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21210-1 advisory.

    This update for google-osconfig-agent fixes the following issues

    - CVE-2023-45288: golang.org/x/net/http2: close connections when receiving too many headers.
    - CVE-2025-47911: golang.org/x/net/html: various algorithms with quadratic complexity when parsing HTML     documents       (bsc#1251453).
    - CVE-2025-58190: golang.org/x/net/html: excessive memory consumption by `html.ParseFragment` when     processing specially       crafted input (bsc#1251704).
    - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2     :path pseudo-       header (bsc#1260264).
    - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad     SETTINGS_MAX_FRAME_SIZE       (bsc#1265762).
    - CVE-2026-34986: github.com/go-jose/go-jose/v4: crafted JWE input with a missing encrypted key can lead     to a denial of       service (bsc#1262926).
    - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for     validation       bypass and privilege escalation (bsc#1266603).
    - CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh     (bsc#1266171).
    - CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266171).
    - CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh     (bsc#1266171).
    - CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in     golang.org/x/crypto/ssh       (bsc#1266171).
    - CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in     golang.org/x/crypto/ssh       (bsc#1266171).
    - CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent       (bsc#1266171).
    - CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266171).
    - CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266171).
    - CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh     (bsc#1266171).
    - CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in     golang.org/x/crypto/ssh/knownhosts       (bsc#1266171).
    - CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in     golang.org/x/crypto/ssh       (bsc#1266171).
    - CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh     (bsc#1266171).
    - CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent     (bsc#1266171).
    - CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following     redirects during       smart-HTTP clone and fetch operations (bsc#1264923).

    Changes for google-osconfig-agent:

    - Update to version 20260615.01
     * Upgrade golang.org/x/crypto & golang.org/x/net (#1006)
    - from version 20260615.00
     * Add unit tests for ospatch_apt_upgrade.go (#938)
    - Update to version 20260611.00
     * Add unit tests for policies/policies.go PART 5 (#998)
    - from version 20260610.00
     * Add unit tests for policies/policies.go PART 4 (#997)
    - from version 20260609.02
     * squash commits (#936)
    - from version 20260609.01
     * Add unit tests for policies/policies.go PART 3 (#996)
    - from version 20260609.00
     * Add unit tests for policies/policies.go PART 2 (#991)
    - from version 20260602.01
     * Align format of dates and timestamp collected across Windows packages (#973)
    - from version 20260602.00
     * Add unit tests for config/config,go (#979)
    - from version 20260528.00
     * Bump github.com/containerd/containerd (#990)
    - from version 20260521.00
     * Cover agentconfig functionality by unit tests (#925)
    - from version 20260520.04
     * Add unit tests for policies/googet.go (#961)
     * Bump github.com/go-git/go-git/v5 (#987)
    - from version 20260520.02
     * Add unit tests for policies/yum.go (#952)
     * Add unit tests for policies/apt.go PART 3 (#951)
    - from version 20260520.00
     * Add unit tests for policies/zypper.go (#953)
    - from version 20260519.00
     * Add unit tests for policies/policies.go PART 1 (#949)
    - from version 20260513.01
     * Bump github.com/go-git/go-git/v5 (#981), this also updates      golang.org/x/net to v0.53.0 (bsc#1265762, CVE-2026-33814)
    - from version 20260513.00
     * upgrade a few packages (#980)
    - from version 20260512.02
     * Add/improve unit tests for agentendpoint/exec_task.go (#933)
    - from version 20260512.01
     * Cover google_update.go by unit tests (#941)
    - from version 20260512.00
     * Change zone for arm64 builds because of stockout (#978)
    - Update to version 20260511.00
     * switch to t2a-standard-2 on ARM package build (#977)
    - from version 20260505.03
     * Cover zypper_patch by unit tests (#958)
    - from version 20260505.02
     * Remove unused functions DisableAutoUpdates (#970)
    - from version 20260505.01
     * Bump go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc (#966)
    - from version 20260505.00
     * Upgrade a few dependencies across the repo (#968)      + github.com/go-git/go-git/v5 5.16.2->5.18.0 (bsc#1264923, CVE-2026-41506)      + github.com/go-jose/go-jose/v4 4.1.3->4.1.4 (bsc#1262926, CVE-2026-34986)      + github.com/go-viper/mapstructure/v2 2.3.0->2.4.0      + go.opentelemetry.io/otel 1.40.0->1.41.0      + go.opentelemetry.io/otel/sdk 1.39.0->1.43.0
    - from version 20260504.01
     * bump github.com/docker/cli to 29.2.0 (#962)
    - from version 20260504.00
     * Bump github.com/opencontainers/selinux (#960)
    - Update to version 20260428.00
     * Add/improve unit tests for agentendpoint/agentendpoint.go (#930)
    - from version 20260427.03
     * Cover config/file.go by unit tests (#935)
    - from version 20260422.01
     * Cover patch_linux.go by unit tests (#932)
    - from version 20260422.00
     * upgrade grpc package in main package and e2e tests (#959)      (bsc#1260264, CVE-2026-33186)
    - from version 20260417.04
     * Bump OSV-Scalibr version to v0.4.3 (#956)
    - from version 20260417.03
     * Add unit tests for updates_linux.go (#937)
    - from version 20260417.02
     * Add zone to CreateDisk step (#955)
    - from version 20260417.01
     * Change disk type for deb11 (#954)
    - from version 20260417.00
     * Add unit tests for policies/apt.go PART 1 (#950)
    - from version 20260410.02
     * Add unit tests for packages/pty_linux.go (#943)
    - from version 20260410.01
     * fix disk type for arm workflows (#948)
    - from version 20260410.00
     * Change machine type for arm based workflows (#946)
    - Update to version 20260330.00
     * bump timeouts for all workflows (#940)
    - from version 20260326.00
     * Cover exec_resource.go by unit tests (#934)
    - from version 20260318.00
     * Integrate OSConfig agent with ReportVmInventory (#923)
    - from version 20260313.02
     * remove cacheonly flag from yum upgrade (#924)
    - from version 20260313.01
     * conditions python version override (#927)
    - from version 20260313.00
     * Fix presubmits by explicitly set python version for rpm based systems (#926)
    - from version 20260311.00
     * Bump osconfig version (#922)
    - from version 20260309.02
     * Extend OSV scalibr extractor (#921)
    - from version 20260309.01
     * upgrade golang.org/x/crypto and it's transitive deps (#918)
    - from version 20260309.00
     * Add purl to pkg info (#920)
    - from version 20260306.00
     * Add 'Type' field to PkgInfo (#919)
    - from version 20260303.01
     * Upgrade go.opentelemetry.io/otel/sdk (#913)
    - from version 20260303.00
     * Bump github.com/vbatts/tar-split from 0.11.5 to 0.12.2 (#908)
    - from version 20260302.00
     * Bump github.com/spdx/tools-golang from 0.5.3 to 0.5.7 (#906)
    - from version 20260126.00
     * Bump go.opentelemetry.io/otel/sdk from 1.38.0 to 1.39.0 (#905)
     * Bump github.com/sirupsen/logrus (#894)
    - Update to version 20260119.00
     * Bump cloud.google.com/go/storage from 1.56.0 to 1.58.0 (#899)
    - Update to version 20251230.00
     * chore: Migrate gsutil usage to gcloud storage (#904)
    - from version 20251223.00
     * fix e2e tests for report inventory (#903)
    - from version 20251222.01
     * Revert Bump cloud.google.com/go/longrunning from 0.6.3 to 0.7.0 (#882) (#902)
    - from version 20251222.00
     * Bump golang to the new version (#900)
    - from version 20251218.00
     * add new CODEOWNERS (#901)
    - from version 20251217.00
     * Bump cloud.google.com/go/longrunning from 0.6.3 to 0.7.0 (#882)
    - Bump the golang compiler version to 1.24.5
    - Update to version 20251202.00
     * Revert Bump github.com/spdx/tools-golang from 0.5.3 to 0.5.5 (#887) (#893)
    - Update to version 20251201.00
     * Revert Bump github.com/containerd/containerd (#890) (#892)
    - Update to version 20251126.00
     * Bump github.com/containerd/containerd (#890)
     * Bump github.com/spdx/tools-golang from 0.5.3 to 0.5.5 (#887)
    - Update to version 20251028.00
     * Bump go.opentelemetry.io/otel/sdk/metric from 1.35.0 to 1.38.0 (#886)
     * Bump github.com/tidwall/pretty from 1.2.0 to 1.2.1 (#880)
    - from version 20251023.02
     * Create multiple_os.yaml (#883)
    - from version 20251023.00
     * Bump github.com/docker/go-connections from 0.4.0 to 0.6.0 (#877)
     * Add test runner for e2e tests (#876)
    - Update to version 20250925.00
     * Bump cloud.google.com/go/auth/oauth2adapt from 0.2.7 to 0.2.8 (#870)
     * Bump google.golang.org/protobuf from 1.36.6 to 1.36.9 (#874)
     * Bump go.opentelemetry.io/otel from 1.35.0 to 1.38.0 (#872)
     * Bump github.com/golang/glog from 1.2.4 to 1.2.5 (#830)
    - Update to version 20250902.01
     * Bump github.com/googleapis/enterprise-certificate-proxy (#829)
    - from version 20250902.00
     * update github.com/go-jose/go-jose/v4 (#869)
     * Upgrade scalibr and other deps (#866)
    - from version 20250901.00
     * Fix possibility of path traversal for zip and tar archival (#868)
    - from version 20250825.00
     * set CODEOWNERS file as required by org (#863)
    - from version 20250819.00
     * Fix/rhel10 build centos image (#860)
    - from version 20250814.00
     * Fix/rhel10 build image (#859)
    - from version 20250813.00
     * Fix: Add RHEL 10 support to RPM startup script (#858)
    - from version 20250811.00
     * Remove old/sles-15-sp4-sap as image is deprecated (#857)
    - Update to version 20250806.00
     * Fixed JSON identifier for the universe domain (#855)
    - from version 20250729.00
     * Bump github.com/google/s2a-go from 0.1.8 to 0.1.9 (#828)
    - from version 20250725.02
     * Update utils.go (#854)
     * Upgrade golang.org/x/oauth2 package to the latest. (#853)
     * Bump golang.org/x/time from 0.9.0 to 0.12.0 (#839)
    - from version 20250725.01
     * Bump golang.org/x/oauth2 (#848)
     * Port fix for debian 11 to goo package manager. (#852)
    - from version 20250725.00
     * Update Golang version in common.sh and skip backports      repo for debian 11 (#850)
    - from version 20250723.01
     * Add workflows to build package for el10 (#849)
    - from version 20250721.00
     * Make OS Config agent TPC aware (#846)
    - from version 20250718.00
     * Create workflows for new Debian 13. (#847)
    - Update to version 20250703.00
     * Fix sles images (#844)
    - from version 20250702.00
     * Remove rhel-sap 8-4 add rhel-sap 8-10 (#843)
    - from version 20250701.00
     * Bump the go_modules group across 1 directory with 2 updates (#840)
    - Update to version 20250606.00
     * Change base docker images Google's official base images. (#838)
    - Update to version 20250523.01
     * Add a simple no-op OS policy for user testing (#837)
    - from version 20250523.00
     * Introduce scalibr inventory extractor for dpkg/rpm/cos      os/filesystem extractors (linux) (#834)
     * Trace GetInstalledPackages memory levels (#835)
    - from version 20250520.00
    - Update to version 20250513.00
     * Fix rpm extractor, handle (none) value correctly. (#833)
    - from version 20250512.01
     * Bump github.com/envoyproxy/go-control-plane from 0.13.1 to 0.13.4 (#816)
    - from version 20250512.00
     * Bump golang.org/x/net from 0.39.0 to 0.40.0 (#819)
    - from version 20250508.01
     * cosmetic refactoring to osinfo package (#826)
    - from version 20250508.00
     * Refactor /inventory with dependency injection (#825)
     * Add debian, ubuntu (InstalledDebPackages) snapshots (#821)
     * cover packages_linux.go file with tests (#824)
     * Add debian (10,11,12) GetPackageUpdates output snapshots (#822)
    - from version 20250507.00
     * Add InstalledRPMPackages snapshot tests (#823)
    - from version 20250506.02
     * Yum tests: simplify initialization of exit errors (#820)
    - from version 20250506.01
     * Improve test coverage for gem package manager (#818)
    - from version 20250506.00
     * after go/x/crypto update 0.32.0 -> 0.37.0 (#817)
    - from version 20250505.01
     * Improve packages package coverage (#814)
     * Bump golang.org/x/net from 0.34.0 to 0.39.0 (#807)
    - from version 20250505.00
     * Bump golang.org/x/crypto from 0.32.0 to 0.37.0 (#806)
    - from version 20250430.00
     * Snapshot YumUpdates (GetPackageUpdates) output (#813)
    - from version 20250428.00
     * Snapshot ZypperPatches, ZypperUpdates (GetPackageUpdates) output      for sles 12, 15 testdata (#812)
    - from version 20250423.00
     * Introduce MatchSnapshot large test results matcher function, snapshot      apt-deb GetPackageUpdates (#811)
    - from version 20250416.02

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4212-1 advisory.

    Security issues fixed:

    - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2     :path pseudo-       header (bsc#1260283).
    - CVE-2026-33540: information disclosure via improper validation of authentication realm URL     (bsc#1261793).
    - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad     SETTINGS_MAX_FRAME_SIZE       (bsc#1265788).
    - CVE-2026-34986: github.com/go-jose/go-jose/v4: crafted JWE input with a missing encrypted key can lead     to a denial of       service (bsc#1262951).
    - CVE-2026-35172: information disclosure via stale references after content deletion (bsc#1262096).
    - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for     validation       bypass and privilege escalation (bsc#1266629).
    - CVE-2026-39827,CVE-2026-39828,CVE-2026-39829,CVE-2026-39830,CVE-2026-39831,       CVE-2026-39832,CVE-2026-39833,CVE-2026-39834,CVE-2026-39835,CVE-2026-42508,       CVE-2026-46595,CVE-2026-46597,CVE-2026-46598: golang.org/x/crypto/ssh: multiple issues (bsc#1268884).
    - CVE-2026-41888: tag deletion bypasses the storage.delete.enabled configuration (bsc#1265429).
    - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input     (bsc#1272132).

    Changes for distribution:

    Update to 3.1.1:

     * Bounds-check the file basename in PurgeUploads Walk callback
     * Add S3 Express One Zone support to the S3 storage driver
     * Fix tag list endpoint in proxy mode
     * Clamp oversized `n` query parameter in proxy mode instead of      returning 400
     * See the full changelog below for the full list of changes.
     * internal/client/auth/challenge: cleanups and minor refactor
     * build(deps): bump      go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp      from 0.18.0 to 0.19.0 in the go_modules group across 1      directory
     * build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otl      ptrace/otlptracehttp from 1.42.0 to 1.43.0 in the go_modules      group across 1 directory
     * build(deps): bump github/codeql-action from 4.34.1 to 4.35.1
     * chore(build): Bump go version to latest
     * refactor: use slices.Backward to simplify the code
     * fix(proxy): fix tag list endpoint in proxy mode
     * Update docker-compose structure in deploying.md
     * build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1
     * build(deps): bump actions/upload-pages-artifact from 4.0.0 to      5.0.0
     * build(deps): bump docker/login-action from 4.0.0 to 4.1.0
     * build(deps): bump docker/bake-action from 7.0.0 to 7.1.0
     * fix(proxy): clamp oversized n query param instead of
     * feat(s3): add express zone one support to S3 driver
     * fix(storage): bounds-check the file basename in PurgeUploads      Walk callback
     * chore(release): prepare for v3.1.1 release
     * Adds support for tag pagination
     * Fixes default credentials in Azure storage provider
     * Drops support for go1.23 and go1.24 and updates to go1.25
     * docs: Update to refer to new image tag v3
     * Fix default_credentials in azure storage provider
     * chore: make function comment match function name
     * build(deps): bump golang.org/x/net from 0.37.0 to 0.38.0 in      the go_modules group across 1 directory
     * fix: implement JWK thumbprint for Ed25519 public keys
     * fix: Annotate code block from validation.indexes      configuration docs
     * feat: extract redis config to separate struct
     * Fix: resolve issue #4478 by using a temporary file for non-      append writes
     * build(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2
     * docs: Add note about `OTEL_TRACES_EXPORTER`
     * fix: set OTEL traces to disabled by default
     * Fix markdown syntax for OTEL traces link in docs
     * Switch UUIDs to UUIDv7
     * refactor: replace map iteration with maps.Copy/Clone
     * s3-aws: fix build for 386
     * docs: Add OpenTelemetry links to quickstart docs
     * Fix S3 driver loglevel param
     * Fixed data race in TestSchedule test
     * Fixes #4683 - uses X/Y instead of Gx/Gy for thumbprint of      ecdsa keys
     * build(deps): bump actions/checkout from 4 to 5
     * Fix broken link to Docker Hub fair use policy
     * fix(registry/handlers/app): redis CAs
     * build(deps): bump actions/labeler from 5 to 6
     * build(deps): bump actions/setup-go from 5 to 6
     * build(deps): bump actions/upload-pages-artifact from 3 to 4
     * build(deps): bump ossf/scorecard-action from 2.4.2 to 2.4.3
     * build(deps): bump github/codeql-action from 3.26.5 to 4.30.7
     * build(deps): bump github/codeql-action from 4.30.7 to 4.30.8
     * chore: labeler: add area/client mapping for      internal/client/**
     * client: add Accept headers to Exists() HEAD
     * feat(registry): Make graceful shutdown test robust
     * fix(registry): Correct log formatting for upstream challenge
     * build(deps): bump github/codeql-action from 4.30.8 to 4.30.9
     * build(deps): bump github/codeql-action from 4.30.9 to 4.31.3
     * refactor: remove redundant variable declarations in for loops
     * 'should' -> 'must' regarding redis eviction policy
     * build(deps): bump actions/checkout from 5 to 6
     * Incorrect warning hint
     * Add return error when list object
     * build(deps): bump actions/checkout from 5.0.1 to 6.0.0
     * build(deps): bump peter-evans/dockerhub-description from 4 to      5
     * fix: Logging regression for manifest HEAD requests
     * Add boolean parsing util
     * Expose `useFIPSEndpoint` for S3
     * Add Cloudfleet Container Registry to adopters
     * fix(ci): Fix broken Azure e2e storage tests
     * BUG: Fix notification filtering to work with actions when      mediatypes is empty
     * build(deps): bump actions/checkout from 6.0.0 to 6.0.1
     * build(deps): bump actions/upload-artifact from 4.6.2 to 6.0.0
     * build(deps): bump github/codeql-action from 4.31.3 to 4.31.10
     * build(deps): bump github/codeql-action from 4.31.10 to 4.32.2
     * build(deps): bump actions/checkout from 6.0.1 to 6.0.2
     * update golangci-lint to v2.9 and fix linting issues
     * update to go1.25.7, alpine 3.23, xx v1.9.0
     * vendor: github.com/sirupsen/logrus v1.9.4
     * vendor: update golang.org/x/* dependencies
     * vendor: github.com/docker/docker-credential-helpers v0.9.5
     * vendor: github.com/opencontainers/image-spec v1.1.1
     * vendor: github.com/klauspost/compress v1.18.4
     * fix: prefer otel variables over hard coded service name
     * vendor: github.com/spf13/cobra v1.10.2
     * vendor: github.com/bshuster-repo/logrus-logstash-hook v1.1.0
     * fix: sync parent dir to ensure data is reliably stored
     * modernize code
     * vendor: github.com/docker/go-events 605354379745
     * vendor: github.com/go-jose/go-jose/v4 v4.1.3
     * build(deps): bump github/codeql-action from 4.32.2 to 4.32.5
     * build(deps): bump docker/login-action from 3 to 4
     * build(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0
     * build(deps): bump docker/setup-buildx-action from 3 to 4
     * build(deps): bump docker/bake-action from 6 to 7
     * build(deps): bump docker/metadata-action from 5 to 6
     * fix: nil-check scheduler in `proxyingRegistry.Close()`
     * fix: set MD5 on GCS writer before first `Write` call in      `putContent`
     * docs: pull through cache will pull from remote multiple times
     * Update s3.md regionendpoint option
     * chore(deps): Bump Go to latest 1.25 in CI workflows and      go.mod
     * fix: correct Ed25519 JWK thumbprint `kty` from `'OTP'` to      `'OKP'`
     * Update vacuum.go
     * Opt: refector tag list pagination support (stage 1)
     * Correctly match environment variables to YAML-inlined structs      in configuration
     * Enable Redis TLS without client certificates
     * build(deps): bump actions/deploy-pages from 4 to 5
     * build(deps): bump github/codeql-action from 4.32.5 to 4.34.1
     * fix(registry/proxy): use detached context when flushing write      buffer
     * ci: pin actions and apply zizmor auto-fixes
     * build(deps): bump actions/setup-go from 6.3.0 to 6.4.0
     * build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to      4.1.4 in the go_modules group across 1 directory
     * chore(app): warn when partial TLS config is used in Redis
     * feat(registry): enhance authentication checks in htpasswd      implementation
     * Opt: refactor tag list pagination support
     * build(deps): bump codecov/codecov-action from 5.5.4 to 6.0.0
     * build(deps): bump actions/configure-pages from 5.0.0 to 6.0.0
     * fix(vendor): fix broke vendor validation
     * chore(ci): Prep for v3.1 release
    - Update to version 3.1.0:
     * fix(vendor): fix broke vendpor validation
     * fix redis repo-scoped blob descriptor revocation
     * proxy: bind bearer realms to upstream trust boundary
    - restore directory ownership after last change
    - Move config files in systemd tmpfiles dir for immutable mode      (jsc#PED-14747)
     * Add distribution-registry.tmpfiles
     * This is the first v3 stable release since `v2.8.3` which is a      culmination of years of hard work of the container community      and registry maintainers!
     * If you are upgrading from `v2.x` and have never used any of      the release candidates, please familiarise yourselves with      the `v2.x` deprecations properly.
     * oss and swift storage drivers are no longer supported
     * `docker/libtrust` has been replaced with `go-jose/go-jose` in      https://github.com/distribution/distribution/pull/4096
     * `client` is no longer supported as a standalone package in      https://github.com/distribution/distribution/pull/4126
     * the default configuration path has changed to      `/etc/distribution/config.yml`
     * `ManifestBuilder` interface in 3886
     * `manifest.Versioned` has been deprecated in favor of      `oci.Versioned` in 3887
     * `reference` package has been moved to      github.com/distribution/reference in      https://github.com/distribution/distribution/pull/4063

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of amazon-cloudwatch-agent installed on the remote host is prior to 1.300069.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3844 advisory.

    (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject     Alternative Name (SAN) entries. This caused strings.Split(host, .) to execute repeatedly on the same     input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of     SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before     building the certificate chain, this overhead occurred even for untrusted certificates. (CVE-2026-27145)

    On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root     when the final path component of the a path is a symbolic link and the path ends in /. For example,     'root.Open(symlink/)' will open symlink even when symlink is a symbolic link pointing outside of the     root. (CVE-2026-39822)

    An authenticated SSH client that repeatedly opened channels which were rejected by the server caused     unbounded memory growth, eventually crashing the server process and affecting all connected users.
    Rejected channels are now properly removed from the connection's internal state and released for garbage     collection. (CVE-2026-39827)

    When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those     permissions were silently discarded, potentially dropping certificate restrictions such as force-command     after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a     connection error. (CVE-2026-39828)

    When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com     were not serialized in the request. Destination restrictions were silently stripped when forwarding keys,     allowing unrestricted use of the key on the remote host. The client now serializes all constraint     extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported     constraint extensions instead of silently ignoring them. (CVE-2026-39832)

    When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the     internal payload size calculation caused the write loop to spin indefinitely, sending empty packets     without making progress. The size comparison now uses int64 to prevent truncation. (CVE-2026-39834)

    SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or     IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an     error instead of panicking when these callbacks are nil. (CVE-2026-39835)

    Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive     CPU. (CVE-2026-42504)

    Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a     disclosure of pre-shared key identities in the unencrypted client hello. (CVE-2026-42505)

    When returning errors, functions in the net/textproto package would include its input as part of the     error. This might allow an attacker to inject misleading content to errors that are printed or logged.
    (CVE-2026-42507)

    An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder     for well-crafted inputs. (CVE-2026-46597)

    For certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire bytes, leading to     a panic when used. (CVE-2026-46598)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2025 advisory.

    (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject     Alternative Name (SAN) entries. This caused strings.Split(host, .) to execute repeatedly on the same     input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of     SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before     building the certificate chain, this overhead occurred even for untrusted certificates. (CVE-2026-27145)

    On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root     when the final path component of the a path is a symbolic link and the path ends in /. For example,     'root.Open(symlink/)' will open symlink even when symlink is a symbolic link pointing outside of the     root. (CVE-2026-39822)

    An authenticated SSH client that repeatedly opened channels which were rejected by the server caused     unbounded memory growth, eventually crashing the server process and affecting all connected users.
    Rejected channels are now properly removed from the connection's internal state and released for garbage     collection. (CVE-2026-39827)

    When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those     permissions were silently discarded, potentially dropping certificate restrictions such as force-command     after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a     connection error. (CVE-2026-39828)

    When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com     were not serialized in the request. Destination restrictions were silently stripped when forwarding keys,     allowing unrestricted use of the key on the remote host. The client now serializes all constraint     extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported     constraint extensions instead of silently ignoring them. (CVE-2026-39832)

    When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the     internal payload size calculation caused the write loop to spin indefinitely, sending empty packets     without making progress. The size comparison now uses int64 to prevent truncation. (CVE-2026-39834)

    SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or     IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an     error instead of panicking when these callbacks are nil. (CVE-2026-39835)

    Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive     CPU. (CVE-2026-42504)

    Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a     disclosure of pre-shared key identities in the unencrypted client hello. (CVE-2026-42505)

    When returning errors, functions in the net/textproto package would include its input as part of the     error. This might allow an attacker to inject misleading content to errors that are printed or logged.
    (CVE-2026-42507)

    An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder     for well-crafted inputs. (CVE-2026-46597)

    For certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire bytes, leading to     a panic when used. (CVE-2026-46598)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
326678	openSUSE 16: cosign / cosign-bash-completion / cosign-fish-completion / etc (openSUSE-SU-2026:21281-1)	Nessus	SuSE Local Security Checks	2026/7/14	2026/7/14	critical
328842	Amazon Linux 2 : amazon-ssm-agent, --advisory ALAS2-2026-3809 (ALAS-2026-3809)	Nessus	Amazon Linux Local Security Checks	2026/7/21	2026/7/21	high
343965	Fedora 44 : complyctl (2026-f33ade2ba6)	Nessus	Fedora Local Security Checks	2026/9/9	2026/9/9	critical
349774	Fedora 45 : prometheus-podman-exporter (2026-8590121cf7)	Nessus	Fedora Local Security Checks	2026/9/24	2026/9/24	high
323027	SUSE SLES12 Security Update : google-guest-agent (SUSE-SU-2026:2581-1)	Nessus	SuSE Local Security Checks	2026/6/26	2026/6/26	high
324053	openSUSE 16 Security Update : google-guest-agent (openSUSE-SU-2026:21069-1)	Nessus	SuSE Local Security Checks	2026/7/1	2026/7/1	critical
325024	openSUSE 16 Security Update : google-osconfig-agent (openSUSE-SU-2026:21210-1)	Nessus	SuSE Local Security Checks	2026/7/3	2026/7/9	high
346801	SUSE SLES15 Security Update : distribution (SUSE-SU-2026:4212-1)	Nessus	SuSE Local Security Checks	2026/9/17	2026/9/17	medium
331987	Amazon Linux 2 : amazon-cloudwatch-agent, --advisory ALAS2-2026-3844 (ALAS-2026-3844)	Nessus	Amazon Linux Local Security Checks	2026/8/4	2026/8/4	critical
332060	Amazon Linux 2023 : amazon-cloudwatch-agent (ALAS2023-2026-2025)	Nessus	Amazon Linux Local Security Checks	2026/8/4	2026/8/4	critical

检测

插件搜索

critical

high

critical

high

high

critical

high

medium

critical

critical