The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:37410 advisory.

    * golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate     (CVE-2026-39835)
      * golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling     of key restrictions (CVE-2026-39832)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a96d4ee174 advisory.

    release 1.21.2

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-1842aaea5d advisory.

    release 1.11.3

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:37072 advisory.

    The podman tool manages pods, container images, and containers. It is part of the libpod library, which is     for applications that use container pods. Container pods is a concept in Kubernetes.

    Security Fix(es):

    * golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate     (CVE-2026-39835)

    * golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with     excessive parameters (CVE-2026-39829)

    * golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited     SSH responses (CVE-2026-39830)

    * golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling     of key restrictions (CVE-2026-39832)

    * golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via     unchecked SignatureKey (CVE-2026-42508)

    * golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass     (CVE-2026-27136)

    * golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting     (CVE-2026-25681)

    * podman: Podman: Information disclosure via malicious container image environment variables     (CVE-2026-57231)

    Bug Fix(es) and Enhancement(s):

    * podman does not clean up all files and leaves orphaned files consuming disk space [rhel-10.2.z]     (JIRA:RHEL-173842)

    * [FJ10.2 Bug]: [REG]The podman-remote save command fails for rootless users. [rhel-10.2.z]     (JIRA:RHEL-192440)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:37072 advisory.

    * golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate     (CVE-2026-39835)

    * golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with     excessive parameters (CVE-2026-39829)

    * golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited     SSH responses (CVE-2026-39830)

    * golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling     of key restrictions (CVE-2026-39832)

    * golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via     unchecked SignatureKey (CVE-2026-42508)

    * golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass     (CVE-2026-27136)

    * golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting     (CVE-2026-25681)

    * podman: Podman: Information disclosure via malicious container image environment variables     (CVE-2026-57231)

    Bug Fix(es) and Enhancement(s):

    * podman does not clean up all files and leaves orphaned files consuming disk space [rhel-10.2.z]     (JIRA:Rocky Linux-173842)

    * [FJ10.2 Bug]: [REG]The podman-remote save command fails for rootless users. [rhel-10.2.z] (JIRA:Rocky     Linux-192440)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-3a8abe43fb advisory.

    Update to 3.11.0

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of containerd installed on the remote host is prior to 2.1.7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2026-127 advisory.

    An authenticated SSH client that repeatedly opened channels which were rejected by the server caused     unbounded memory growth, eventually crashing the server process and affecting all connected users.
    Rejected channels are now properly removed from the connection's internal state and released for garbage     collection. (CVE-2026-39827)

    When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those     permissions were silently discarded, potentially dropping certificate restrictions such as force-command     after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a     connection error. (CVE-2026-39828)

    The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key     with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during     signature verification. This could be triggered by unauthenticated clients during public key     authentication. RSA moduli are now limited to 8192 bits, and DSA parameters are validated per FIPS 186-2.
    (CVE-2026-39829)

    A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking     the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a     resource leak per connection. Unsolicited global responses are now discarded. (CVE-2026-39830)

    The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-     ed25519@openssh.com) did not check the User Presence flag. Signatures generated without physical touch     were accepted, allowing unattended use of a hardware security key. To restore the previous behavior,     return a no-touch-required extension in Permissions.Extensions from PublicKeyCallback. (CVE-2026-39831)

    When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com     were not serialized in the request. Destination restrictions were silently stripped when forwarding keys,     allowing unrestricted use of the key on the remote host. The client now serializes all constraint     extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported     constraint extensions instead of silently ignoring them. (CVE-2026-39832)

    The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint     but never enforced it. The key would sign without any confirmation prompt, with no indication to the     caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported     constraints are requested. (CVE-2026-39833)

    When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the     internal payload size calculation caused the write loop to spin indefinitely, sending empty packets     without making progress. The size comparison now uses int64 to prevent truncation. (CVE-2026-39834)

    SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or     IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an     error instead of panicking when these callbacks are nil. (CVE-2026-39835)

    Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both     the 'key' and 'key.SignatureKey' are checked for @revoked. (CVE-2026-42508)

    Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any     other type of callback is passed other than public key, then the source-address validation would be     skipped. (CVE-2026-46595)

    An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder     for well-crafted inputs. (CVE-2026-46597)

    For certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire bytes, leading to     a panic when used. (CVE-2026-46598)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20956-1 advisory.

    This update for trivy fixes the following issues

    - CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: golang.org/x/net/html:
    multiple issues       when parsing HTML files (bsc#1267047).
    - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad     SETTINGS_MAX_FRAME_SIZE       (bsc#1265648).
    - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for     validation       bypass and privilege escalation (bsc#1266495).
    - CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh     (bsc#1266075).
    - CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266075).
    - CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh     (bsc#1266075).
    - CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in     golang.org/x/crypto/ssh       (bsc#1266075).
    - CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in     golang.org/x/crypto/ssh       (bsc#1266075).
    - CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent       (bsc#1266075).
    - CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266075).
    - CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266075).
    - CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh     (bsc#1266075).
    - CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in     golang.org/x/crypto/ssh/knownhosts       (bsc#1266075).
    - CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in     golang.org/x/crypto/ssh       (bsc#1266075).
    - CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh     (bsc#1266075).
    - CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent     (bsc#1266075).
    - CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to     DoS via infinite       loops, panics or resource consumption (bsc#1267268).

    Changes for trivy:

    - Update to version 0.71.0 (bsc#1267268, CVE-2026-44740):
     * release: v0.71.0 [main] (#10638)
     * ci: use only the first line of commit message in release-please workflow (#10766)
     * feat: add WithDriver and WithProvider options to ospkg detector (#10740)
     * chore(deps): bump github.com/google/go-containerregistry to v0.21.6 (#10741)
     * refactor(secret): normalize configPath once in Init (#10702)
     * feat(secret): add Maven rules to detect passwords and passphrases in settings.xml and settings-     security.xml        files (#10704)
     * chore(deps): bump the common group across 1 directory with 25 updates (#10758)
     * chore: migrate from gomodguard to gomodguard_v2 (#10739)
     * chore(deps): bump the docker group across 1 directory with 2 updates (#10709)
     * chore(deps): bump github.com/aws/aws-sdk-go-v2/service/ec2 from 1.302.0 to 1.303.0 in the aws group     (#10752)
     * ci: scope GitHub App tokens to minimum required permissions (#10755)
     * chore(deps): upgrade go-redis from v8 to v9 (#10736)
     * fix(misconf): fix rendering of nested values in terraform plan lists (#10746)
     * fix(misconf): skip resources with no after changes (#10352)
     * fix(misconf): reject nil plays during playbook parsing (#10273)
     * fix(nodejs): silently skip subdirectory package.json files with invalid names (#10609)
     * fix(misconf): skip null cty values in AsMapValue to prevent panic (#10723)
     * refactor(misconf): replace custom Helm archive parsing with Helm SDK loaders (#10718)
     * chore(deps): bump github.com/containerd/containerd/v2 to v2.3.1 (#10738)
     * chore(deps): bump github.com/go-git/go-git/v5 from 5.19.0 to 5.19.1 (#10686)
     * fix(report): don't produce trailing comma in gitlab.tpl links array (#10728)
     * fix(cloudformation): propagate AWS::EC2::Instance MetadataOptions (#10731)
     * chore(deps): upgrade github.com/cenkalti/backoff dependency to v5 (#10705)
     * chore: bump golangci-lint to v2.12 (#10726)
     * feat(spdx): add SHA-512 hash algorithm support to SPDX serializer (#10719)
     * feat(sbom): support for CycloneDX 1.7 (#10715)
     * chore(deps): bump github.com/aws/aws-sdk-go-v2/service/ec2 from 1.300.0 to 1.302.0 in the aws group     (#10708)
     * chore: migrate from helm.sh/helm/v3 to helm.sh/helm/v4 (#10678)
     * fix(image): correctly reconstruct RUN instructions built without BuildKit (#10714)
     * feat(java): support <mirrors> from settings.xml (#10692)
     * fix(java): surface 429 from a remote Maven repository as a fatal error when scanning pom.xml files     (#10693)
     * chore: bump go to 1.26.3 (#10683)
     * fix(nodejs): handle legacy license formats in npm lockfile parser (#10684)
     * fix(secret): correctly skip secret-scanner config file from scanning (#10666)
     * feat(ubuntu): detect Ubuntu 26.04 LTS (#10592)
     * refactor(nodejs): deduplicate license traversal across package managers (#10681)
     * fix: overwrite OS packages PURLs after overwrite OS (#10298)
     * feat(secret): add Azure secret detection rules (#10562)
     * fix(misconf): prevent path traversal in Terraform filesystem functions (#10664)
     * feat(secret): add a way to customize skipped folders, files and exts (#10550)
     * ci: migrate PAT tokens to GitHub App (#10628)
     * chore(deps): bump the aws group across 1 directory with 6 updates (#10598)
     * chore(deps): bump the docker group across 1 directory with 3 updates (#10596)
     * chore(deps): bump the github-actions group across 2 directories with 9 updates (#10608)
     * chore(deps): bump github.com/in-toto/in-toto-golang from 0.10.0 to 0.11.0 (#10641)
     * chore(deps): bump github.com/go-git/go-git/v5 from 5.18.0 to 5.19.0 (#10648)
     * ci: migrate PAT tokens to GITHUB_TOKEN for reusable-release workflow (#10655)
     * feat(seal): add vendor support for language file detection. (#10297)
     * fix(misconf): make identifiers in ignore rules case-insensitive (#10375)
     * fix: pull instead of clone when test repo already exists (#10636)
     * docs: document how to disable check.trivy.dev connections (#10623)
     * docs(misconf): fix typo in misconfiguration config (#10619)
     * ci: remove secrets from run block (#10590)
     * docs: fix typos (#10605)
     * refactor(deps): replace archived go-homedir with os.UserHomeDir (#10484)
     * chore(deps): Bump `go-ini` and fix the import path. (#10489)
     * chore(deps): bump the github-actions group across 2 directories with 9 updates (#10495)
     * chore(deps): bump github.com/aquasecurity/testdocker (#10543)
     * docs: convert README demonstration videos to mp4 (#10419)
     * chore(deps): upgrade vm scan dependency for bug fix (#10575)
     * docs(nodejs): clarify package.json behavior in image scanning (#10572)
     * chore(deps): replace xeipuuv/gojsonschema and invopop/jsonschema with google/jsonschema-go (#10528)
     * chore(deps): bump github.com/go-git/go-git/v5 from 5.17.2 to 5.18.0 (#10554)
     * chore(deps): bump alpine to 3.23.4 (#10552)
     * ci(helm): bump Trivy version to 0.70.0 for Trivy Helm Chart 0.22.0 (#10547)
    - update x/net to v0.55.0 (      bsc#1266495, CVE-2026-39821      bsc#1267047, CVE-2026-25680,      CVE-2026-42502,      CVE-2026-27136,      CVE-2026-25681,      CVE-2026-42506)
    - update x/crypto to 0.52.0 (bsc#1266075, CVE-2026-39827,      CVE-2026-39834,CVE-2026-39828,CVE-2026-39829,CVE-2026-39831,      CVE-2026-42508,CVE-2026-39833,CVE-2026-39830,CVE-2026-39832,      CVE-2026-46597,CVE-2026-46598,CVE-2026-46595,CVE-2026-39835)      bsc#1265648, CVE-2026-33814,

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of containerd installed on the remote host is prior to 2.1.7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2026-122 advisory.

    An authenticated SSH client that repeatedly opened channels which were rejected by the server caused     unbounded memory growth, eventually crashing the server process and affecting all connected users.
    Rejected channels are now properly removed from the connection's internal state and released for garbage     collection. (CVE-2026-39827)

    When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those     permissions were silently discarded, potentially dropping certificate restrictions such as force-command     after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a     connection error. (CVE-2026-39828)

    The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key     with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during     signature verification. This could be triggered by unauthenticated clients during public key     authentication. RSA moduli are now limited to 8192 bits, and DSA parameters are validated per FIPS 186-2.
    (CVE-2026-39829)

    A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking     the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a     resource leak per connection. Unsolicited global responses are now discarded. (CVE-2026-39830)

    The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-     ed25519@openssh.com) did not check the User Presence flag. Signatures generated without physical touch     were accepted, allowing unattended use of a hardware security key. To restore the previous behavior,     return a no-touch-required extension in Permissions.Extensions from PublicKeyCallback. (CVE-2026-39831)

    When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com     were not serialized in the request. Destination restrictions were silently stripped when forwarding keys,     allowing unrestricted use of the key on the remote host. The client now serializes all constraint     extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported     constraint extensions instead of silently ignoring them. (CVE-2026-39832)

    The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint     but never enforced it. The key would sign without any confirmation prompt, with no indication to the     caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported     constraints are requested. (CVE-2026-39833)

    When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the     internal payload size calculation caused the write loop to spin indefinitely, sending empty packets     without making progress. The size comparison now uses int64 to prevent truncation. (CVE-2026-39834)

    SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or     IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an     error instead of panicking when these callbacks are nil. (CVE-2026-39835)

    Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both     the 'key' and 'key.SignatureKey' are checked for @revoked. (CVE-2026-42508)

    Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any     other type of callback is passed other than public key, then the source-address validation would be     skipped. (CVE-2026-46595)

    For certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire bytes, leading to     a panic when used. (CVE-2026-46598)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:22193-1 advisory.

    This update for mcphost fixes the following issues

    - CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: golang.org/x/net/html:
    multiple issues       when parsing HTML files (bsc#1267109).
    - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad     SETTINGS_MAX_FRAME_SIZE       (bsc#1265730).
    - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for     validation       bypass and privilege escalation (bsc#1266572).
    - CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh     (bsc#1266145).
    - CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266145).
    - CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh     (bsc#1266145).
    - CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in     golang.org/x/crypto/ssh       (bsc#1266145).
    - CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in     golang.org/x/crypto/ssh       (bsc#1266145).
    - CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent       (bsc#1266145).
    - CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266145).
    - CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266145).
    - CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh     (bsc#1266145).
    - CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in     golang.org/x/crypto/ssh/knownhosts       (bsc#1266145).
    - CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in     golang.org/x/crypto/ssh       (bsc#1266145).
    - CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh     (bsc#1266145).
    - CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent     (bsc#1266145).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2706-1 advisory.

    This update for buildah fixes the following issues

    - CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: golang.org/x/net/html:
    multiple issues       when parsing HTML files (bsc#1267179).
    - CVE-2026-34986: github.com/go-jose/go-jose/v4,github.com/go-jose/go-jose/v3: crafted JWE input with a     missing       encrypted key can lead to a denial of service (bsc#1262953).
    - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for     validation       bypass and privilege escalation (bsc#1266648).
    - CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh     (bsc#1266191).
    - CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266191).
    - CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh     (bsc#1266191).
    - CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in     golang.org/x/crypto/ssh       (bsc#1266191).
    - CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in     golang.org/x/crypto/ssh       (bsc#1266191).
    - CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent       (bsc#1266191).
    - CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266191).
    - CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266191).
    - CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh     (bsc#1266191).
    - CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in     golang.org/x/crypto/ssh/knownhosts       (bsc#1266191).
    - CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in     golang.org/x/crypto/ssh       (bsc#1266191).
    - CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh     (bsc#1266191).
    - CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent     (bsc#1266191).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:22376-1 advisory.

    This update for google-guest-agent fixes the following issues

    - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2     :path pseudo-       header (bsc#1260264).
    - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for     validation       bypass and privilege escalation (bsc#1266603).
    - CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh     (bsc#1266171).
    - CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266171).
    - CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh     (bsc#1266171).
    - CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in     golang.org/x/crypto/ssh       (bsc#1266171).
    - CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in     golang.org/x/crypto/ssh       (bsc#1266171).
    - CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent       (bsc#1266171).
    - CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266171).
    - CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266171).
    - CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh     (bsc#1266171).
    - CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in     golang.org/x/crypto/ssh/knownhosts       (bsc#1266171).
    - CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in     golang.org/x/crypto/ssh       (bsc#1266171).
    - CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh     (bsc#1266171).
    - CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent     (bsc#1266171).

    Changes for google-guest-agent:

    - Update to version 20260529.00
     * Dependency updates (#616)
    - from version 20260522.00
     * Fix improper umask calculation on socket creation (#614)
    - from version 20260520.01
     * Update OWNERS (#609)
     * Bump google.golang.org/grpc from 1.75.0 to 1.79.3 (#602) (bsc#1260264, CVE-2026-33186)
    - Update to version 20250506.01 (bsc#1243254, bsc#1243505)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:38504 advisory.

    * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)

    * golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate     (CVE-2026-39835)

    * podman: Podman: Information disclosure via malicious container image environment variables     (CVE-2026-57231)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3203-1 advisory.

    - Security: re-vendor the bundled Go dependencies (no upstream source       changes; tarball rebuilt from v1.7.4 with updated go.mod/vendor):
      * golang.org/x/net v0.48.0 -> v0.55.0: CVE-2026-33814 (bsc#1265736),         CVE-2026-39821 (bsc#1266575), CVE-2026-25680, CVE-2026-25681,         CVE-2026-27136, CVE-2026-42502, CVE-2026-42506 (bsc#1267120)
      * golang.org/x/crypto v0.46.0 -> v0.52.0: CVE-2026-39827,         CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831,         CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-39835,         CVE-2026-42508, CVE-2026-46595, CVE-2026-46597, CVE-2026-46598         (bsc#1266151)
      * github.com/moby/spdystream v0.5.0 -> v0.5.1 folded into the vendor         tree;
    - Build with Go >= 1.25 (required by golang.org/x/net 0.55).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
326526	AlmaLinux 9 : buildah (ALSA-2026:37410)	Nessus	Alma Linux Local Security Checks	2026/7/13	2026/7/13	high
325315	Fedora 43 : prometheus-podman-exporter (2026-a96d4ee174)	Nessus	Fedora Local Security Checks	2026/7/7	2026/7/7	low
325318	Fedora 43 : podman-tui (2026-1842aaea5d)	Nessus	Fedora Local Security Checks	2026/7/7	2026/7/7	low
325885	RHEL 10 : podman (RHSA-2026:37072)	Nessus	Red Hat Local Security Checks	2026/7/9	2026/7/15	high
326261	RockyLinux 10 : podman (RLSA-2026:37072)	Nessus	Rocky Linux Local Security Checks	2026/7/10	2026/7/15	high
328869	Fedora 44 : nuclei (2026-3a8abe43fb)	Nessus	Fedora Local Security Checks	2026/7/21	2026/7/21	medium
329722	openSUSE 16 Security Update : rclone (openSUSE-SU-2026:21436-1)	Nessus	SuSE Local Security Checks	2026/7/25	2026/7/25	critical
319803	Amazon Linux 2 : containerd, --advisory ALAS2DOCKER-2026-127 (ALASDOCKER-2026-127)	Nessus	Amazon Linux Local Security Checks	2026/6/8	2026/6/15	critical
321461	openSUSE 16 Security Update : trivy (openSUSE-SU-2026:20956-1)	Nessus	SuSE Local Security Checks	2026/6/17	2026/6/17	high
322069	Amazon Linux 2 : containerd, --advisory ALAS2ECS-2026-122 (ALASECS-2026-122)	Nessus	Amazon Linux Local Security Checks	2026/6/22	2026/7/16	critical
322889	SUSE SLES16 Security Update : mcphost (SUSE-SU-2026:22193-1)	Nessus	SuSE Local Security Checks	2026/6/26	2026/6/26	high
324853	SUSE SLES15 Security Update : buildah (SUSE-SU-2026:2706-1)	Nessus	SuSE Local Security Checks	2026/7/2	2026/7/2	high
324859	SUSE SLES16 Security Update : google-guest-agent (SUSE-SU-2026:22376-1)	Nessus	SuSE Local Security Checks	2026/7/2	2026/7/2	critical
326503	RockyLinux 8 : container-tools:rhel8 (RLSA-2026:38504)	Nessus	Rocky Linux Local Security Checks	2026/7/13	2026/7/17	high
329285	SUSE SLES15 Security Update : kubevirt (SUSE-SU-2026:3203-1)	Nessus	SuSE Local Security Checks	2026/7/24	2026/7/24	high

检测

插件搜索

high

low

low

high

high

medium

critical

critical

high

critical

high

high

critical

high

high