The version of runc installed on the remote host is prior to 1.3.4-5. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2026-119 advisory.

    When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of     C memory and a crash. (CVE-2026-33811)

    When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION     frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0. (CVE-2026-33814)

    Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive     CPU exhaustion and memory allocations. (CVE-2026-39820)

    CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's     <content> attribute. If the URL content were to insert ASCII whitespaces around the '=' rune inside of the     <content> attribute, the escaper would fail to similarly escape it, leading to XSS. (CVE-2026-39823)

    ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a     Rewrite function, or a Director function which parses query parameters, ReverseProxy sanitizes the     forwarded request to remove query parameters which are not parsed by url.ParseQuery. ReverseProxy does not     take ParseQuery's limit on the total number of query parameters (controlled by     GODEBUG=urlmaxqueryparams=N) into account. This can permit ReverseProxy to forward a request containing a     query parameter that is not visible to the Rewrite function. For example, the query     a1=x&a2=x&...&a10000=x&hidden=y can forward the parameter hidden=y while hiding it from the proxy's     Rewrite function. (CVE-2026-39825)

    If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type'     attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed     into the <script> block. (CVE-2026-39826)

    Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC     5322. (CVE-2026-42499)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of runfinch-finch installed on the remote host is prior to 1.17.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2026-124 advisory.

    When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of     C memory and a crash. (CVE-2026-33811)

    When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION     frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0. (CVE-2026-33814)

    Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive     CPU exhaustion and memory allocations. (CVE-2026-39820)

    CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's     <content> attribute. If the URL content were to insert ASCII whitespaces around the '=' rune inside of the     <content> attribute, the escaper would fail to similarly escape it, leading to XSS. (CVE-2026-39823)

    ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a     Rewrite function, or a Director function which parses query parameters, ReverseProxy sanitizes the     forwarded request to remove query parameters which are not parsed by url.ParseQuery. ReverseProxy does not     take ParseQuery's limit on the total number of query parameters (controlled by     GODEBUG=urlmaxqueryparams=N) into account. This can permit ReverseProxy to forward a request containing a     query parameter that is not visible to the Rewrite function. For example, the query     a1=x&a2=x&...&a10000=x&hidden=y can forward the parameter hidden=y while hiding it from the proxy's     Rewrite function. (CVE-2026-39825)

    If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type'     attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed     into the <script> block. (CVE-2026-39826)

    Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC     5322. (CVE-2026-42499)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1736 advisory.

    When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of     C memory and a crash. (CVE-2026-33811)

    When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION     frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0. (CVE-2026-33814)

    Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive     CPU exhaustion and memory allocations. (CVE-2026-39820)

    CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's     <content> attribute. If the URL content were to insert ASCII whitespaces around the '=' rune inside of the     <content> attribute, the escaper would fail to similarly escape it, leading to XSS. (CVE-2026-39823)

    ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a     Rewrite function, or a Director function which parses query parameters, ReverseProxy sanitizes the     forwarded request to remove query parameters which are not parsed by url.ParseQuery. ReverseProxy does not     take ParseQuery's limit on the total number of query parameters (controlled by     GODEBUG=urlmaxqueryparams=N) into account. This can permit ReverseProxy to forward a request containing a     query parameter that is not visible to the Rewrite function. For example, the query     a1=x&a2=x&...&a10000=x&hidden=y can forward the parameter hidden=y while hiding it from the proxy's     Rewrite function. (CVE-2026-39825)

    If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type'     attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed     into the <script> block. (CVE-2026-39826)

    Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC     5322. (CVE-2026-42499)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of runc installed on the remote host is prior to 1.3.4-5. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2026-125 advisory.

    When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of     C memory and a crash. (CVE-2026-33811)

    When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION     frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0. (CVE-2026-33814)

    Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive     CPU exhaustion and memory allocations. (CVE-2026-39820)

    CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's     <content> attribute. If the URL content were to insert ASCII whitespaces around the '=' rune inside of the     <content> attribute, the escaper would fail to similarly escape it, leading to XSS. (CVE-2026-39823)

    ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a     Rewrite function, or a Director function which parses query parameters, ReverseProxy sanitizes the     forwarded request to remove query parameters which are not parsed by url.ParseQuery. ReverseProxy does not     take ParseQuery's limit on the total number of query parameters (controlled by     GODEBUG=urlmaxqueryparams=N) into account. This can permit ReverseProxy to forward a request containing a     query parameter that is not visible to the Rewrite function. For example, the query     a1=x&a2=x&...&a10000=x&hidden=y can forward the parameter hidden=y while hiding it from the proxy's     Rewrite function. (CVE-2026-39825)

    If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type'     attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed     into the <script> block. (CVE-2026-39826)

    Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC     5322. (CVE-2026-42499)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of golist installed on the remote host is prior to 0.10.1-10. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3308 advisory.

    When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of     C memory and a crash. (CVE-2026-33811)

    When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION     frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0. (CVE-2026-33814)

    Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive     CPU exhaustion and memory allocations. (CVE-2026-39820)

    CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's     <content> attribute. If the URL content were to insert ASCII whitespaces around the '=' rune inside of the     <content> attribute, the escaper would fail to similarly escape it, leading to XSS. (CVE-2026-39823)

    ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a     Rewrite function, or a Director function which parses query parameters, ReverseProxy sanitizes the     forwarded request to remove query parameters which are not parsed by url.ParseQuery. ReverseProxy does not     take ParseQuery's limit on the total number of query parameters (controlled by     GODEBUG=urlmaxqueryparams=N) into account. This can permit ReverseProxy to forward a request containing a     query parameter that is not visible to the Rewrite function. For example, the query     a1=x&a2=x&...&a10000=x&hidden=y can forward the parameter hidden=y while hiding it from the proxy's     Rewrite function. (CVE-2026-39825)

    If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type'     attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed     into the <script> block. (CVE-2026-39826)

    Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC     5322. (CVE-2026-42499)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 20d59b47-5ba3-11f1-bf1b-b42e991fc52e advisory.

    https://go.dev/issue/78913 reports:

            CVE-2026-27142 fixed a vulnerability in which URLs were             not correctly escaped inside of a <meta> tag's             <content> attribute. If the URL content were to             insert ASCII whitespaces around the '=' rune inside of the             <content> attribute, the escaper would fail to             similarly escape it, leading to XSS.


            If a trusted template author were to write a <script>             tag containing an empty 'type' attribute or a 'type'             attribute with an ASCII whitespace, the execution of the             template would incorrectly escape any data passed into the             <script> block.


Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
316940	Amazon Linux 2 : runc, --advisory ALAS2ECS-2026-119 (ALASECS-2026-119)	Nessus	Amazon Linux Local Security Checks	2026/5/27	2026/5/27	high
316946	Amazon Linux 2 : runfinch-finch, --advisory ALAS2DOCKER-2026-124 (ALASDOCKER-2026-124)	Nessus	Amazon Linux Local Security Checks	2026/5/27	2026/5/27	high
316974	Amazon Linux 2023 : docker (ALAS2023-2026-1736)	Nessus	Amazon Linux Local Security Checks	2026/5/27	2026/5/27	high
316979	Amazon Linux 2 : runc, --advisory ALAS2DOCKER-2026-125 (ALASDOCKER-2026-125)	Nessus	Amazon Linux Local Security Checks	2026/5/27	2026/5/27	high
317026	Amazon Linux 2 : golist, --advisory ALAS2-2026-3308 (ALAS-2026-3308)	Nessus	Amazon Linux Local Security Checks	2026/5/27	2026/5/27	high
318016	FreeBSD : www/gohugo -- CWE-79: XSS vulnerabilities (20d59b47-5ba3-11f1-bf1b-b42e991fc52e)	Nessus	FreeBSD Local Security Checks	2026/5/30	2026/5/30	medium

检测

插件搜索

high

high

high

high

high

medium