The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-787:10 advisory.

    * dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)
      * dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-0dce096c13 advisory.

    Update to .NET SDK 9.0.118 and Runtime 9.0.17

    Fixes: CVE-2026-45490,CVE-2026-45491,CVE-2026-45591

    Release Notes:

    - SDK: https://github.com/dotnet/core/blob/main/release-notes/9.0/9.0.17/9.0.118.md
    - Runtime: https://github.com/dotnet/core/blob/main/release-notes/9.0/9.0.17/9.0.17.md

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-dec081126f advisory.

    Update to .NET SDK 10.0.109 and Runtime 10.0.9

    Fixes: CVE-2026-45490,CVE-2026-45491,CVE-2026-45591

    Release Notes:

    - SDK: https://github.com/dotnet/core/blob/main/release-notes/10.0/10.0.9/10.0.109.md
    - Runtime: https://github.com/dotnet/core/blob/main/release-notes/10.0/10.0.9/10.0.9.md

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:28007 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 8.0.128 and .NET Runtime 8.0.28.

    Security Fix(es):

    * dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)

    * dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-25111 advisory.

    [8.0.128-1.0.1]
    - Add support for Oracle Linux

    [8.0.128-1]
    - Update to .NET SDK 8.0.128 and Runtime 8.0.28
    - Resolves: RHEL-181056

    [8.0.127-1]
    - Update to .NET SDK 8.0.127 and Runtime 8.0.27
    - Resolves: RHEL-173924

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-2f80369c73 advisory.

    Update to .NET SDK 8.0.128 and Runtime 8.0.28

    Fixes: CVE-2026-45490,CVE-2026-45491,CVE-2026-45591

    Release Notes:

    - SDK: https://github.com/dotnet/core/blob/main/release-notes/8.0/8.0.28/8.0.128.md
    - Runtime: https://github.com/dotnet/core/blob/main/release-notes/8.0/8.0.28/8.0.28.md

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tenable Identity Exposure running on the remote host is prior to 3.93.5. It is, therefore, affected by multiple vulnerabilities according to advisory TNS-2026-16:

  - Tenable Identity Exposure contains multiple unauthenticated API endpoints under /w/api/* that expose     sensitive application configuration data including cleartext LDAP credentials, SAML configuration, user     accounts, and directory settings to unauthenticated remote attackers. Affected responses are served with     Cache-Control: public headers and without Vary: Cookie, allowing reverse proxies and CDNs to cache and     serve sensitive data to unauthenticated users even after authentication is applied. (CVE-2026-13007)

  - Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows     an authorized attacker to bypass a security feature over a network. (CVE-2025-55315)

  - Converting an excessively large OCTET STRING value to a hexadecimal string leads to a heap buffer     overflow on 32 bit platforms. A heap buffer overflow may lead to a crash or possibly an attacker     controlled code execution or other undefined behavior. (CVE-2026-31789)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-25221 advisory.

    [9.0.118-1.0.1]
    - Add support for Oracle Linux

    [9.0.118-1]
    - Update to .NET SDK 9.0.118 and Runtime 9.0.17
    - Resolves: RHEL-181553

    [9.0.117-1]
    - Update to .NET SDK 9.0.117 and Runtime 9.0.16
    - Resolves: RHEL-173918

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a424c1061e advisory.

    Update to .NET SDK 10.0.109 and Runtime 10.0.9

    Fixes: CVE-2026-45490,CVE-2026-45491,CVE-2026-45591

    Release Notes:

    - SDK: https://github.com/dotnet/core/blob/main/release-notes/10.0/10.0.9/10.0.109.md
    - Runtime: https://github.com/dotnet/core/blob/main/release-notes/10.0/10.0.9/10.0.9.md

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:25110 advisory.

    * dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)
      * dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-25114 advisory.

    [10.0.109-1.0.1]
    - Add support for Oracle Linux

    [10.0.109-1]
    - Update to .NET SDK 10.0.109 and Runtime 10.0.9
    - Resolves: RHEL-181555

    [10.0.106-2]
    - Update to .NET SDK 10.0.106 and Runtime 10.0.6
    - Resolves: RHEL-163381

    [10.0.104-2]
    - Update to .NET SDK 10.0.104 and Runtime 10.0.4
    - Resolves: RHEL-152949

    [10.0.103-2]
    - Update to .NET SDK 10.0.103 and Runtime 10.0.3
    - Resolves: RHEL-144973

    [10.0.102-2]
    - Update to .NET SDK 10.0.102 and Runtime 10.0.2
    - Resolves: RHEL-138639

    [10.0.101-2]
    - Update to .NET SDK 10.0.101 and Runtime 10.0.1
    - Resolves: RHEL-130937

    [10.0.100-1]
    - Update to .NET SDK 10.0.100 and Runtime 10.0.0
    - Resolves: RHEL-125747

    [10.0.100~rc.2.25502.107-0.10]
    - Update to .NET SDK 10.0.100-rc.2.25502.107 and Runtime 10.0.0-rc.2.25502.107
    - Resolves: RHEL-121301

    [10.0.100~preview.6.25358.103-0.9]
    - Disable bootstrap
    - Resolves: RHEL-114568

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8420-1 advisory.

    It was discovered that .NET did not properly handle link resolution before file access. A local attacker     could use this issue to perform unauthorized file tampering and write arbitrary files outside of the     intended extraction directory. (CVE-2026-45491)

    It was discovered that .NET did not properly handle deeply-nested MessagePack arrays. An attacker could     use this to cause .NET to consume excessive resources, resulting in a denial of service. (CVE-2026-45591)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:28051 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 9.0.118 and .NET Runtime 9.0.17.

    Security Fix(es):

    * dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)

    * dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the dotnet package has been released.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-25112 advisory.

    [9.0.118-1.0.1]
    - Add support for Oracle Linux

    [9.0.118-1]
    - Update to .NET SDK 9.0.118 and Runtime 9.0.17
    - Resolves: RHEL-181554

    [9.0.117-1]
    - Update to .NET SDK 9.0.117 and Runtime 9.0.16
    - Resolves: RHEL-173919

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_25110 advisory.

    * dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)

    * dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
321150	MiracleLinux 8 : dotnet8.0-8.0.128-1.el8_10.ML.1 (AXSA:2026-787:10)	Nessus	Miracle Linux Local Security Checks	2026/6/15	2026/6/20	medium
323282	Fedora 44 : dotnet9.0 (2026-0dce096c13)	Nessus	Fedora Local Security Checks	2026/6/28	2026/6/28	medium
323283	Fedora 44 : dotnet10.0 (2026-dec081126f)	Nessus	Fedora Local Security Checks	2026/6/28	2026/6/28	medium
321966	RHEL 10 : .NET 8.0 (RHSA-2026:28007)	Nessus	Red Hat Local Security Checks	2026/6/22	2026/6/22	medium
327540	Oracle Linux 10 : .NET / 8.0 (ELSA-2026-25111)	Nessus	Oracle Linux Local Security Checks	2026/7/17	2026/7/17	medium
323271	Fedora 43 : dotnet8.0 (2026-2f80369c73)	Nessus	Fedora Local Security Checks	2026/6/28	2026/6/28	medium
322483	Tenable Identity Exposure < 3.93.5 Multiple Vulnerabilities (TNS-2026-16)	Nessus	Misc.	2026/6/24	2026/6/25	high
322574	Oracle Linux 9 : .NET / 9.0 (ELSA-2026-25221)	Nessus	Oracle Linux Local Security Checks	2026/6/24	2026/6/24	medium
323269	Fedora 43 : dotnet10.0 (2026-a424c1061e)	Nessus	Fedora Local Security Checks	2026/6/28	2026/6/28	medium
320641	AlmaLinux 8 : .NET 8.0 (ALSA-2026:25110)	Nessus	Alma Linux Local Security Checks	2026/6/11	2026/6/22	medium
320689	Oracle Linux 8 : .NET / 10.0 (ELSA-2026-25114)	Nessus	Oracle Linux Local Security Checks	2026/6/11	2026/6/22	medium
320847	Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : .NET vulnerabilities (USN-8420-1)	Nessus	Ubuntu Local Security Checks	2026/6/12	2026/6/22	medium
323871	RHEL 9 : .NET 9.0 (RHSA-2026:28051)	Nessus	Red Hat Local Security Checks	2026/6/30	2026/6/30	medium
321548	Photon OS 4.0: Dotnet PHSA-2026-4.0-1036	Nessus	PhotonOS Local Security Checks	2026/6/19	2026/8/25	medium
327519	Oracle Linux 10 : .NET / 9.0 (ELSA-2026-25112)	Nessus	Oracle Linux Local Security Checks	2026/7/17	2026/7/17	medium
332737	Photon OS 5.0: Dotnet PHSA-2026-5.0-91-0884	Nessus	PhotonOS Local Security Checks	2026/8/5	2026/8/5	medium
357925	Rocky Linux 8 [CIQ] Security Update: aspnetcore-runtime-8.0 / aspnetcore-runtime-dbg-8.0 / etc Multiple Vulnerabilities (crlsa-2026_25110)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	medium

检测

插件搜索

medium

medium

medium

medium

medium

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium