The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use (TOCTOU)     race condition in the `cap_set_file()` function. This allows an attacker with write access to a parent     directory to redirect file capability updates to an attacker-controlled file. By doing so, capabilities     can be injected into or stripped from unintended executables, leading to privilege escalation.
    (CVE-2026-4878)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of AOS installed on the remote host is prior to 7.5.1.8. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-7.5.1.8 advisory.

  - A flaw was found in GLib (Gnome Lib). This vulnerability allows a remote attacker to cause heap     corruption, leading to a denial of service or potential code execution via a buffer-underflow in the     GVariant parser when processing maliciously crafted input strings. (CVE-2025-14087)

  - In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls     gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An     unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.
    (CVE-2026-40355)

  - In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read     if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in     /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to     terminate in parse_message. (CVE-2026-40356)

  - In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call,     leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, many     (but not all) common configurations are vulnerable. Non-Linux platforms are more widely vulnerable.
    (CVE-2026-41035)

  - A flaw was found in glib. This vulnerability allows a heap buffer overflow and denial-of-service (DoS) via     an integer overflow in GLib's GIO (GLib Input/Output) escape_byte_string() function when processing     malicious file or remote filesystem attribute values. (CVE-2025-14512)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AHV installed on the remote host is prior to 11.0.1.3 / AHV-11.0.1.3. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-11.0.1.3 advisory.

  - A flaw was found in GLib (Gnome Lib). This vulnerability allows a remote attacker to cause heap     corruption, leading to a denial of service or potential code execution via a buffer-underflow in the     GVariant parser when processing maliciously crafted input strings. (CVE-2025-14087)

  - In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a     privilege drop before running the mailer, is not a fatal error and can lead to privilege escalation.
    (CVE-2026-35535)

  - LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable     Network Graphics) raster image files. In versions 1.2.1 through 1.6.55, `png_set_tRNS` and `png_set_PLTE`     each alias a heap-allocated buffer between `png_struct` and `png_info`, sharing a single allocation across     two structs with independent lifetimes. The `trans_alpha` aliasing has been present since at least libpng     1.0, and the `palette` aliasing since at least 1.2.1. Both affect all prior release lines `png_set_tRNS`     sets `png_ptr->trans_alpha = info_ptr->trans_alpha` (256-byte buffer) and `png_set_PLTE` sets     `info_ptr->palette = png_ptr->palette` (768-byte buffer). In both cases, calling `png_free_data` (with     `PNG_FREE_TRNS` or `PNG_FREE_PLTE`) frees the buffer through `info_ptr` while the corresponding `png_ptr`     pointer remains dangling. Subsequent row-transform functions dereference and, in some code paths, write to     the freed memory. A second call to `png_set_tRNS` or `png_set_PLTE` has the same effect, because both     functions call `png_free_data` internally before reallocating the `info_ptr` buffer. Version 1.6.56 fixes     the issue. (CVE-2026-33416)

  - A flaw was found in rsync. It could allow a server to enumerate the contents of an arbitrary file from the     client's machine. This issue occurs when files are being copied from a client to a server. During this     process, the rsync server will send checksums of local data to the client to compare with in order to     determine what data needs to be sent to the server. By sending specially constructed checksum values for     arbitrary files, an attacker may be able to reconstruct the data of those files byte-by-byte based on the     responses from the client. (CVE-2024-12086)

  - A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a     heap based buffer, via a negative array index. The malicious rsync client requires at least read access to     the remote rsync module in order to trigger the issue. (CVE-2025-10158)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
305106	Linux Distros Unpatched Vulnerability : CVE-2026-4878	Nessus	Misc.	2026/4/6	2026/7/16	high
321809	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-7.5.1.8)	Nessus	Misc.	2026/6/21	2026/6/21	critical
324126	Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-11.0.1.3)	Nessus	Misc.	2026/7/1	2026/7/15	critical

检测

插件搜索

high

critical

critical