The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4566 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4566-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/               Emilio Pozuelo Monfort     May 06, 2026                                  https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : openjdk-11     Version        : 11.0.31+11-1~deb11u1     CVE ID         : CVE-2026-22007 CVE-2026-22013 CVE-2026-22016 CVE-2026-22018                      CVE-2026-22021 CVE-2026-34268 CVE-2026-34282

    Several vulnerabilities have been discovered in the OpenJDK Java     runtime, which may result in incorrect generation of cryptographic     keys, denial of service, information disclosure, XEE/XEE attacks     or incorrect validation of Kerberos credentials.

    For Debian 11 bullseye, these problems have been fixed in version     11.0.31+11-1~deb11u1.

    We recommend that you upgrade your openjdk-11 packages.

    For the detailed security status of openjdk-11 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/openjdk-11

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4565 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4565-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/               Emilio Pozuelo Monfort     May 06, 2026                                  https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : openjdk-17     Version        : 17.0.19+10-1~deb11u1     CVE ID         : CVE-2026-22007 CVE-2026-22013 CVE-2026-22016 CVE-2026-22018                      CVE-2026-22021 CVE-2026-34268 CVE-2026-34282

    Several vulnerabilities have been discovered in the OpenJDK Java     runtime, which may result in incorrect generation of cryptographic     keys, denial of service, information disclosure, XEE/XEE attacks     or incorrect validation of Kerberos credentials.

    For Debian 11 bullseye, these problems have been fixed in version     17.0.19+10-1~deb11u1.

    We recommend that you upgrade your openjdk-17 packages.

    For the detailed security status of openjdk-17 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/openjdk-17

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1683 advisory.

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Security).  Supported versions that are affected are Oracle Java SE: 8u481,     8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and     21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Difficult to exploit vulnerability allows     unauthenticated attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle     GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized read     access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible     data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a     web service which supplies data to the APIs. This vulnerability also applies to Java deployments,     typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load     and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for     security. CVSS 3.1 Base Score 2.9 (Confidentiality impacts).  CVSS Vector:
    (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N). (CVE-2026-22007)

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: JGSS).  Supported versions that are affected are Oracle Java SE: 8u481,     8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and     21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle     GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks require human interaction from a     person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized     access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in     clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run     untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This     vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted     code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS     Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N). (CVE-2026-22013)

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: JAXP).  Supported versions that are affected are Oracle Java SE: 8u481,     8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and     21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Easily exploitable vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle     GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result     in  unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs     in the specified Component, e.g., through a web service which supplies data to the APIs. This     vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).
    CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). (CVE-2026-22016)

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Libraries).  Supported versions that are affected are Oracle Java SE: 8u481,     8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and     21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle     GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result     in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle     GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using     APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This     vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Availability impacts).  CVSS     Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2026-22018)

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: JSSE).  Supported versions that are affected are Oracle Java SE: 8u481,     8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and     21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTPS to compromise Oracle Java SE, Oracle GraalVM for     JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM     for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the     specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and     rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2026-22021)

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Security).  Supported versions that are affected are Oracle Java SE: 8u481,     8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and     21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Difficult to exploit vulnerability allows     unauthenticated attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle     GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized read     access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible     data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a     web service which supplies data to the APIs. This vulnerability also applies to Java deployments,     typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load     and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for     security. CVSS 3.1 Base Score 2.9 (Confidentiality impacts).  CVSS Vector:
    (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N). (CVE-2026-34268)

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Networking).  Supported versions that are affected are Oracle Java SE:
    8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and  21.0.10; Oracle     GraalVM Enterprise Edition: 21.3.17. Easily exploitable vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause     a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle     GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified     Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to     Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java     applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java     sandbox for security. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). (CVE-2026-34282)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1686 advisory.

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Security).  Supported versions that are affected are Oracle Java SE: 8u481,     8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and     21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Difficult to exploit vulnerability allows     unauthenticated attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle     GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized read     access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible     data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a     web service which supplies data to the APIs. This vulnerability also applies to Java deployments,     typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load     and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for     security. CVSS 3.1 Base Score 2.9 (Confidentiality impacts).  CVSS Vector:
    (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N). (CVE-2026-22007)

    Vulnerability in Oracle Java SE (component: Libraries).   The supported version that is affected is Oracle     Java SE: 25.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access     via multiple protocols to compromise Oracle Java SE.  Successful attacks of this vulnerability can result     in  unauthorized update, insert or delete access to some of Oracle Java SE accessible data. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java     deployments, typically in servers, that load and run only trusted code (e.g., code installed by an     administrator). CVSS 3.1 Base Score 3.7 (Integrity impacts).  CVSS Vector:
    (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). (CVE-2026-22008)

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: JGSS).  Supported versions that are affected are Oracle Java SE: 8u481,     8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and     21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle     GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks require human interaction from a     person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized     access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in     clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run     untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This     vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted     code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS     Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N). (CVE-2026-22013)

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: JAXP).  Supported versions that are affected are Oracle Java SE: 8u481,     8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and     21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Easily exploitable vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle     GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result     in  unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs     in the specified Component, e.g., through a web service which supplies data to the APIs. This     vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).
    CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). (CVE-2026-22016)

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Libraries).  Supported versions that are affected are Oracle Java SE: 8u481,     8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and     21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle     GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result     in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle     GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using     APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This     vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Availability impacts).  CVSS     Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2026-22018)

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: JSSE).  Supported versions that are affected are Oracle Java SE: 8u481,     8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and     21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTPS to compromise Oracle Java SE, Oracle GraalVM for     JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM     for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the     specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and     rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2026-22021)

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Security).  Supported versions that are affected are Oracle Java SE: 8u481,     8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and     21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Difficult to exploit vulnerability allows     unauthenticated attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle     GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized read     access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible     data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a     web service which supplies data to the APIs. This vulnerability also applies to Java deployments,     typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load     and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for     security. CVSS 3.1 Base Score 2.9 (Confidentiality impacts).  CVSS Vector:
    (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N). (CVE-2026-34268)

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Networking).  Supported versions that are affected are Oracle Java SE:
    8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and  21.0.10; Oracle     GraalVM Enterprise Edition: 21.3.17. Easily exploitable vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause     a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle     GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified     Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to     Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java     applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java     sandbox for security. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). (CVE-2026-34282)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20681-1 advisory.

    Update to upstream tag jdk-21.0.11+10 (April 2026 CPU).

    Security issues fixed:

    - CVE-2026-22007: Security: unauthenticated attacker with logon to the infrastructure where java executes     can gain       unauthorized read access to a subset of accessible data (bsc#1262490).
    - CVE-2026-22013: JGSS: unauthenticated attacker with network access via multiple protocols can gain     unauthorized       access to critical data (bsc#1262494).
    - CVE-2026-22016: JAXP: unauthenticated attacker with network access via multiple protocols can gain     unauthorized       to access critical data (bsc#1262495).
    - CVE-2026-22018: Libraries: unauthenticated attacker with network access via multiple protocols can cause     a partial       denial of service (bsc#1262496).
    - CVE-2026-22021: JSSE: unauthenticated attacker with network access via HTTPS can cause a partial denial     of service       (bsc#1262497).
    - CVE-2026-23865: freetype2: integer overflow in the `tt_var_load_item_variation_store` function allows     for an       out-of-bounds read when parsing HVAR/VVAR/MVAR tables in OpenType variable fonts(bsc#1259118).
    - CVE-2026-34268: Security: unauthenticated attacker with logon to the infrastructure where java executes     can gain       unauthorized read access to a subset of data (bsc#1262500).
    - CVE-2026-34282: Networking: unauthenticated attacker with network access via multiple protocols can     cause a hang or       frequently repeatable crash (bsc#1262501).

    Other updates and bugfixes:

    - Provide the timezone-java and tzdata-java (jsc#PED-15898).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1731-1 advisory.

    Upgrade to upstream tag jdk-11.0.31+11 (April 2026 CPU).

    Security issues fixed:

    - CVE-2026-22007: Security: unauthenticated attacker with logon to the infrastructure where java executes     can gain       unauthorized read access to a subset of accessible data (bsc#1262490).
    - CVE-2026-22013: JGSS: unauthenticated attacker with network access via multiple protocols can gain     unauthorized       access to critical data (bsc#1262494).
    - CVE-2026-22016: JAXP: unauthenticated attacker with network access via multiple protocols can gain     unauthorized       to access critical data (bsc#1262495).
    - CVE-2026-22018: Libraries: unauthenticated attacker with network access via multiple protocols can cause     a partial       denial of service (bsc#1262496).
    - CVE-2026-22021: JSSE: unauthenticated attacker with network access via HTTPS can cause a partial denial     of service       (bsc#1262497).
    - CVE-2026-23865: freetype2: integer overflow in the `tt_var_load_item_variation_store` function allows     for an       out-of-bounds read when parsing HVAR/VVAR/MVAR tables in OpenType variable fonts(bsc#1259118).
    - CVE-2026-34268: Security: unauthenticated attacker with logon to the infrastructure where java executes     can gain       unauthorized read access to a subset of data (bsc#1262500).
    - CVE-2026-34282: Networking: unauthenticated attacker with network access via multiple protocols can     cause a hang or       frequently repeatable crash (bsc#1262501).

    Other updates and bugfixes:

    - Provide the timezone-java and tzdata-java (jsc#PED-15898).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-599:08 advisory.

    JDK: Enhance crypto algorithm support (CVE-2026-22007)         JDK: Improve Kerberos credentialing (CVE-2026-22013)         JDK: Enhance Path Factories Redux (CVE-2026-22016)         JDK: Enhance Zip file reading (CVE-2026-22018)         JDK: Enhance certificate chain validation (CVE-2026-22021)         JDK: Updating FreeType 2.14.1 (CVE-2026-23865)         JDK: Enhance TLS connection handling (CVE-2026-34282)         JDK: Enhance key generation (CVE-2026-34268)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-610:09 advisory.

    JDK: Enhance crypto algorithm support (CVE-2026-22007)         JDK: Improve Kerberos credentialing (CVE-2026-22013)         JDK: Enhance Path Factories Redux (CVE-2026-22016)         JDK: Enhance Zip file reading (CVE-2026-22018)         JDK: Enhance certificate chain validation (CVE-2026-22021)         JDK: Updating FreeType 2.14.1 (CVE-2026-23865)         JDK: Enhance key generation (CVE-2026-34268)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8331-1 advisory.

    Thomas Beckers discovered that the JAXP component of OpenJDK 11 did not correctly authenticate certain     APIs. A remote unauthenticated attacker could possibly use this issue to gain unauthorized access to     sensitive information. (CVE-2026-22016)

    It was discovered that the Networking component of OpenJDK 11 did not correctly authenticate certain APIs.
    A remote unauthenticated attacker could possibly use this issue to cause a denial of service.
    (CVE-2026-34282)

    It was discovered that the JSSE component of OpenJDK 11 did not correctly authenticate certain APIs. A     remote unauthenticated attacker could possibly use this issue to cause a denial of service.
    (CVE-2026-22021)

    It was discovered that the JGSS component of OpenJDK 11 did not correctly authenticate certain APIs. A     remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-22013)

    It was discovered that the 2D component of OpenJDK 11 did not correctly handle certain integer arithmetic.
    If a user or automated system were tricked into opening a specially crafted file, an attacker could     possibly use this issue to leak sensitive information. (CVE-2026-23865)

    It was discovered that the Libraries component of OpenJDK 11 did not correctly authenticate certain APIs.
    A remote unauthenticated attacker could possibly use this issue to cause a denial of service.
    (CVE-2026-22018)

    Ken Pyle discovered that the Security component of OpenJDK 11 did not correctly authenticate certain APIs.
    A local attacker could possibly use this issue to leak sensitive information. (CVE-2026-22007,     CVE-2026-34268)

    In addition to security fixes, the updated packages contain bug fixes, new features, and possibly     incompatible changes.

    Please see the following for more information:
    https://openjdk.org/groups/vulnerability/advisories/2026-04-21

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of IBM Engineering Requirements Management DOORS (formerly IBM Rational DOORS) installed on the remote host is 9.6.1.1 prior or equal to 9.6.1.13 or 9.7.2.1 prior or equal to 9.7.2.11. It is, therefore, affected by multiple vulnerabilities as referenced in the 7279145 advisory.

  - IBM DOORS Web Access do not limit the length of a connection which could allow for a Slowloris HTTP denial     of service attack to take place. This can cause the web server to become unresponsive. (CVE-2024-25039)

  - IBM DOORS Web Access is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated     attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality     potentially leading to credentials disclosure within a trusted session. (CVE-2025-0152)

  - IBM DOORS Web Access could allow a remote attacker to obtain sensitive information when a detailed     technical error message is returned in the browser. This information could be used in further attacks     against the system. (CVE-2020-4984)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:9693 advisory.

    * JDK: Enhance crypto algorithm support (CVE-2026-22007)

    * JDK: Improved Arena allocations (CVE-2026-22008)

    * JDK: Improve Kerberos credentialing (CVE-2026-22013)

    * JDK: Enhance Path Factories Redux (CVE-2026-22016)

    * JDK: Enhance Zip file reading (CVE-2026-22018)

    * JDK: Enhance certificate chain validation (CVE-2026-22021)

    * JDK: Updating FreeType 2.14.1 (CVE-2026-23865)

    * JDK: Enhance TLS connection handling (CVE-2026-34282)

    * JDK: Enhance key generation (CVE-2026-34268)

    This release also updates a number of third-party libraries included in the JDK.  The libraries themselves     are affected by the following CVEs, but this is not a statement that the JDK itself is affected:

    * giflib: Denial of Service via buffer overflow in EGifGCBToExtension (CVE-2026-26740)

    * libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette     expansion (CVE-2026-33636)

    * libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416)

    Bug Fix(es):

    * When copying files, OpenJDK 25 prefers to use the copy_file_range native function for performance     reasons, only falling back to sendfile when this fails.  However, in previous OpenJDK 25 releases, a     response of EOPNOTSUPP (operation not supported) did not cause the JDK to fall back to sendfile.  This is     rectified in this release. (Rocky Linux-169939, Rocky Linux-169937)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:9693 advisory.

    The OpenJDK 25 packages provide the OpenJDK 25 Java Runtime Environment and the OpenJDK 25 Java Software     Development Kit.

    Security Fix(es):

    * JDK: Enhance crypto algorithm support (CVE-2026-22007)

    * JDK: Improved Arena allocations (CVE-2026-22008)

    * JDK: Improve Kerberos credentialing (CVE-2026-22013)

    * JDK: Enhance Path Factories Redux (CVE-2026-22016)

    * JDK: Enhance Zip file reading (CVE-2026-22018)

    * JDK: Enhance certificate chain validation (CVE-2026-22021)

    * JDK: Updating FreeType 2.14.1 (CVE-2026-23865)

    * JDK: Enhance TLS connection handling (CVE-2026-34282)

    * JDK: Enhance key generation (CVE-2026-34268)

    This release also updates a number of third-party libraries included in the JDK.  The libraries themselves     are affected by the following CVEs, but this is not a statement that the JDK itself is affected:

    * giflib: Denial of Service via buffer overflow in EGifGCBToExtension (CVE-2026-26740)

    * libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette     expansion (CVE-2026-33636)

    * libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416)

    Bug Fix(es):

    * When copying files, OpenJDK 25 prefers to use the copy_file_range native function for performance     reasons, only falling back to sendfile when this fails.  However, in previous OpenJDK 25 releases, a     response of EOPNOTSUPP (operation not supported) did not cause the JDK to fall back to sendfile.  This is     rectified in this release. (RHEL-169939, RHEL-169937)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
312363	Debian dla-4566 : openjdk-11-dbg - security update	Nessus	Debian Local Security Checks	2026/5/6	2026/5/6	high
312364	Debian dla-4565 : openjdk-17-dbg - security update	Nessus	Debian Local Security Checks	2026/5/6	2026/5/6	high
313521	Amazon Linux 2023 : java-21-amazon-corretto, java-21-amazon-corretto-devel, java-21-amazon-corretto-headless (ALAS2023-2026-1683)	Nessus	Amazon Linux Local Security Checks	2026/5/9	2026/5/9	high
313523	Amazon Linux 2023 : java-25-amazon-corretto, java-25-amazon-corretto-devel, java-25-amazon-corretto-headless (ALAS2023-2026-1686)	Nessus	Amazon Linux Local Security Checks	2026/5/9	2026/5/9	high
313629	openSUSE 16 Security Update : java-21-openjdk (openSUSE-SU-2026:20681-1)	Nessus	SuSE Local Security Checks	2026/5/10	2026/5/10	high
313682	SUSE SLES15 Security Update : java-11-openjdk (SUSE-SU-2026:1731-1)	Nessus	SuSE Local Security Checks	2026/5/10	2026/5/10	high
314284	MiracleLinux 9 : java-17-openjdk-17.0.19.0.10-2.el9.ML.1 (AXSA:2026-599:08)	Nessus	Miracle Linux Local Security Checks	2026/5/11	2026/5/11	high
314365	MiracleLinux 9 : java-1.8.0-openjdk-1.8.0.492.b09-2.el9.ML.1 (AXSA:2026-610:09)	Nessus	Miracle Linux Local Security Checks	2026/5/12	2026/5/12	high
318127	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : OpenJDK 11 vulnerabilities (USN-8331-1)	Nessus	Ubuntu Local Security Checks	2026/6/1	2026/6/1	high
333335	IBM Engineering Requirements Management DOORS 9.6.1.1 <= 9.6.1.13 / 9.7.2.1 < 9.7.2.11 Multiple Vulnerabilities (7279145)	Nessus	Windows	2026/8/7	2026/8/14	high
316341	RockyLinux 10 : java-25-openjdk (RLSA-2026:9693)	Nessus	Rocky Linux Local Security Checks	2026/5/22	2026/5/22	high
309745	RHEL 10 / 9 : java-25-openjdk (RHSA-2026:9693)	Nessus	Red Hat Local Security Checks	2026/4/22	2026/4/22	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high

high