There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to
    1.0.7, Crass converts `CSS scientific notation` number values with unbounded exponentiation before
    clamping the result to `Float::MAX`. Applications that use Crass to parse attacker-controlled CSS strings
    can be forced to spend disproportionate CPU and memory parsing a tiny input, potentially resulting in a
    crash. This issue is fixed in version 1.0.7. (CVE-2026-61845)

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - Crass 是一個 Ruby CSS 解析器，完全符合 CSS 語法等級 3 規範。在之前 1.0.7，Crass 會以無限冪轉換「CSS 科學記數法」數字值，然後再將結果限制為「Float：：MAX」。使用 Crass 解析攻擊者控制的 CSS 字串的應用程式可能會被迫花費不成比例的 CPU 和記憶體來解析微小的輸入，從而可能導致崩潰。1.0.7 版已修正此問題。(CVE-2026-61845)

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - Crass 是一个完全符合 CSS 语法级别 3 规范的 Ruby CSS 解析器。在之前 1.0.7，Crass 会先使用无界乘幂转换“CSS scientific notation”数值，然后再将结果限制为“Float：：MAX”。使用 Crass 解析攻击者控制的 CSS 字符串的应用程序可被强制花费不成比例的 CPU 和内存解析微小输入，从而可能导致崩溃。此问题已在 1.0.7 版本中修复。(CVE-2026-61845)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - Crass は、CSS 構文レベル 3 仕様に完全準拠する Ruby CSS パーサーです。1.0.7の前に、Crass は結果を「Float::MAX」にクランプする前に、「CSS 科学的記数法」の数値を無限累乗で変換します。Crass を使用して攻撃者がコントロールする CSS 文字列を解析するアプリケーションは、小さな入力の解析に不均衡な CPU とメモリを費やすように強制され、クラッシュを引き起こす可能性があります。この問題はバージョン 1.0.7 で修正されています。(CVE-2026-61845)

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:99952 advisory.

    Red Hat Satellite is a system management solution that allows organizations     to configure and maintain their systems without the necessity to provide     public Internet access to their servers or other client systems. It     performs provisioning and configuration management of predefined standard     operating environments.

    Security fix(es):

    * rubygem-katello: Cross-tenant Content View Filter rule access and modification via unauthorized parent     filter lookup (CVE-2026-81668)

    * sequoia-openpgp: Cryptographic integrity compromise via key flag confusion (CVE-2026-42784)

    * pyjwt: Token forgery via acceptance of public JWK containers as HMAC secrets (CVE-2026-102273)

    * python3.12-pulp-rpm: Distribution tree publish creates directories from .treeinfo ids (CVE-2026-103870)

    * candlepin: broken object-level authorization via VerifyAuthorizationFilter multi-@Verify hasAccess     latching (CVE-2026-106471)

    * pyjwt: Verification key substitution via unvalidated JWKS redirects (CVE-2026-102267)

    * pyjwt: Authentication bypass via improper public key validation (CVE-2026-102268)

    * pyjwt: Token forgery via improper Unicode byte-order mark handling (CVE-2026-102272)

    * candlepin: Consumer certificate can register systems in another organization (CVE-2026-111456)

    * foreman: Cross-tenant disclosure of template revisions via unauthorized audit lookup (CVE-2026-81658)

    * foreman: authorization flaw in the Foreman::Controller::UserAware#find_user handling used by     Api::V2::PersonalAccessTokensController (CVE-2026-86322)

    * foreman: authorization flaw in the mail-notification endpoints implemented by     Api::V2::MailNotificationsController (CVE-2026-86323)

    * foreman: authorization flaw in the Foreman::Controller::UserAware handling used by     Api::V2::SshKeysController (CVE-2026-86324)

    * foreman: API filter lookup ignores a search-limited filter permission (CVE-2026-107193)

    * foreman: API host template render discloses secrets to view_hosts users (incomplete CVE-2026-96659 fix)     (CVE-2026-107443)

    * safemode: Jail allow-list bypass via op-assign expressions (CVE-2026-107360)

    * Puma: HTTP Request Smuggling via Underscore Header Name Confusion (CVE-2026-68006)

    * rubygem-smart_proxy_dynflow: Dynflow console authorizes any client certificate the capsule CA signed     (CVE-2026-107152)

    * crass: Denial of Service via crafted scientific notation in CSS (CVE-2026-61845)

    * ansible-core: ansible.builtin.git invokes git without a `--` separator, allowing argument injection via     a `-`-leading repository URL (e.g. --upload-pack) -> RCE (CVE-2026-84503)

    * crass: Denial of Service via excessive recursion when processing comments (CVE-2026-61847)

    * pulpcore: file:// scheme allowlist bypass in content upload file_url field enables arbitrary file read     and Pulp Container registry signing key theft (CVE-2026-90959)

    Bug fix(es):

    * Adding hosts to a large host collection is slow (SAT-50731)

    * Automatic Capsule sync is not triggered during subsequent Rolling Content View refreshes in Satellite     6.18 (SAT-50730)

    * PG::SequenceGeneratorLimitExceeded: reached maximum value of sequence katello_rpms_id_seq during repo     sync (SAT-53451)

    * Recurring cookie store unavailable: :hash, error: key not found: :hash under bulk RHSM load (SAT-53458)

    * Attempting to assign content-view-environments via hammer when LCE is not synced by content source     should propagate error message text to hammer (SAT-53454)

    * Client failed to register to the Satellite with integer out of range error (SAT-53455)

    * Host::Managed audit exclusions not applied, resulting in excessive audit records (SAT-53456)

    * RHSA-2026:74504: Token enforcement breaks generic non-PXE provisioning and fails when token_lifetime=0     (SAT-52738)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:99949 advisory.

    Red Hat Satellite is a system management solution that allows organizations     to configure and maintain their systems without the necessity to provide     public Internet access to their servers or other client systems. It     performs provisioning and configuration management of predefined standard     operating environments.

    Security Fix(es):
    * sequoia-openpgp: Cryptographic integrity compromise via key flag confusion (CVE-2026-42784)
    * crass: Denial of Service via crafted scientific notation in CSS (CVE-2026-61845)
    * crass: Denial of Service via excessive recursion when processing comments (CVE-2026-61847)
    * Puma: HTTP Request Smuggling via Underscore Header Name Confusion (CVE-2026-68006)
    * foreman: Cross-tenant disclosure of template revisions via unauthorized audit lookup (CVE-2026-81658)
    * rubygem-katello: Cross-tenant Content View Filter rule access and modification via unauthorized parent     filter lookup (CVE-2026-81668)
    * foreman: authorization flaw in the Foreman::Controller::UserAware#find_user handling used by     Api::V2::PersonalAccessTokensController (CVE-2026-86322)
    * foreman: authorization flaw in the mail-notification endpoints implemented by     Api::V2::MailNotificationsController (CVE-2026-86323)
    * foreman: authorization flaw in the Foreman::Controller::UserAware handling used by     Api::V2::SshKeysController (CVE-2026-86324)
    * pulpcore: file:// scheme allowlist bypass in content upload file_url field enables arbitrary file read     and Pulp Container registry signing key theft (CVE-2026-90959)
    * pyjwt: Verification key substitution via unvalidated JWKS redirects (CVE-2026-102267)
    * PyJWT: Authentication bypass via improper public key validation (CVE-2026-102268)
    * pyjwt: Token forgery via improper Unicode byte-order mark handling (CVE-2026-102272)
    * pyjwt: Token forgery via acceptance of public JWK containers as HMAC secrets (CVE-2026-102273)
    * python-pulp-rpm: Distribution tree publish creates directories from .treeinfo ids (CVE-2026-103870)
    * candlepin: broken object-level authorization via VerifyAuthorizationFilter multi-@Verify hasAccess     latching (CVE-2026-106471)
    * rubygem-smart_proxy_dynflow: Dynflow console authorizes any client certificate the capsule CA signed     (CVE-2026-107152)
    * foreman: API filter lookup ignores a search-limited filter permission (CVE-2026-107193)
    * safemode: Jail allow-list bypass via op-assign expressions (CVE-2026-107360)
    * foreman: API host template render discloses secrets to view_hosts users (CVE-2026-107443)
    * candlepin: Consumer certificate can register systems in another organization (CVE-2026-111456)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:100120 advisory.

    This advisory provides security fixes for affected packages used by Red Hat     Satellite.
    The updates address the vulnerabilities described below.

    Security Fix(es):

    * python3.12-pyjwt: Fixes token verification, authentication-bypass, and     token-forgery vulnerabilities (CVE-2026-102267, CVE-2026-102268,     CVE-2026-102272, CVE-2026-102273).
    * rubygem-smart_proxy_dynflow: Restricts authorization of Dynflow console     clients to permitted client certificates (CVE-2026-107152).
    * rubygem-safemode: Fixes a jail allow-list bypass (CVE-2026-107360).
    * foreman: Fixes authorization flaws in personal access token, mail     notification, SSH key, and host template endpoints (CVE-2026-107443,     CVE-2026-86322, CVE-2026-86323, CVE-2026-86324).
    * candlepin: Prevents consumer certificates from registering systems in     another organization (CVE-2026-111456).
    * rubygem-crass: Fixes denial-of-service conditions in CSS processing     (CVE-2026-61845, CVE-2026-61847).
    * python3.12-pulpcore: Restricts file URL content uploads to prevent     arbitrary file reads (CVE-2026-90959).
    * rubygem-foreman_ansible: Enforces authorization when accessing Ansible     inventory data (CVE-2026-92893).
    * rubygem-foreman_remote_execution: Enforces object-level authorization for     job output (CVE-2026-92904).
    * rubygem-katello: Fixes cross-tenant access and modification of Content     View Filter rules (CVE-2026-81668).
    * python3.12-pysequoia: Fixes cryptographic integrity compromise caused by     key flag confusion (CVE-2026-42784).
    * python3.12-pulp-rpm: Prevents distribution tree publishing from creating     directories based on .treeinfo IDs (CVE-2026-103870).
    * candlepin: Fixes an authorization bypass caused by multiple @Verify     hasAccess checks (CVE-2026-106471).

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to     1.0.7, Crass converts `CSS scientific notation` number values with unbounded exponentiation before     clamping the result to `Float::MAX`. Applications that use Crass to parse attacker-controlled CSS strings     can be forced to spend disproportionate CPU and memory parsing a tiny input, potentially resulting in a     crash. This issue is fixed in version 1.0.7. (CVE-2026-61845)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:99950 advisory.

    Red Hat Satellite is a system management solution that allows organizations to configure and maintain     their systems without the necessity to provide public Internet access to their servers or other client     systems. It performs provisioning and configuration management of predefined standard operating     environments.

    Security Fix(es):

    * Distribution tree publish creates directories from .treeinfo ids (CVE-2026-103870)
    * Puma: HTTP Request Smuggling via Underscore Header Name Confusion (CVE-2026-68006)
    * PyJWT: Authentication bypass via improper public key validation (CVE-2026-102268)
    * ansible-core: ansible-core: ansible.builtin.git invokes git without a `--` separator, allowing argument     injection via a `-`-leading repository URL (e.g. --upload-pack) -> RCE (CVE-2026-84503)
    * candlepin: Consumer certificate can register systems in another organization (CVE-2026-111456)
    * candlepin: candlepin: broken object-level authorization via VerifyAuthorizationFilter multi-@Verify     hasAccess latching (CVE-2026-106471)
    * crass: Denial of Service via crafted scientific notation in CSS (CVE-2026-61845)
    * crass: Denial of Service via excessive recursion when processing comments (CVE-2026-61847)
    * foreman: API filter lookup ignores a search-limited filter permission (CVE-2026-107193)
    * foreman: Cross-tenant disclosure of template revisions via unauthorized audit lookup (CVE-2026-81658)
    * foreman: authorization flaw in the Foreman::Controller::UserAware handling used by     Api::V2::SshKeysController (CVE-2026-86324)
    * foreman: authorization flaw in the Foreman::Controller::UserAware#find_user handling used by     Api::V2::PersonalAccessTokensController (CVE-2026-86322)
    * foreman: authorization flaw in the mail-notification endpoints implemented by     Api::V2::MailNotificationsController (CVE-2026-86323)
    * foreman: foreman: API host template render discloses secrets to view_hosts users (CVE-2026-107443)
    * pulpcore: file:// scheme allowlist bypass in content upload file_url field enables arbitrary file read     and Pulp Container registry signing key theft (CVE-2026-90959)
    * pyjwt: Token forgery via acceptance of public JWK containers as HMAC secrets (CVE-2026-102273)
    * pyjwt: Token forgery via improper Unicode byte-order mark handling (CVE-2026-102272)
    * pyjwt: Verification key substitution via unvalidated JWKS redirects (CVE-2026-102267)
    * rubygem-katello: Cross-tenant Content View Filter rule access and modification via unauthorized parent     filter lookup (CVE-2026-81668)
    * rubygem-safemode: safemode: Jail allow-list bypass via op-assign expressions (CVE-2026-107360)
    * rubygem-smart_proxy_dynflow: Dynflow console authorizes any client certificate the capsule CA signed     (CVE-2026-107152)
    * sequoia-openpgp: Cryptographic integrity compromise via key flag confusion (CVE-2026-42784)

    Bug Fix(es):

    * Attempting to assign content-view-environments via hammer when LCE is not synced by content source     should propagate error message text to hammer (SAT-52669)
    * Client failed to register to the Satellite with integer out of range error (SAT-52666)
    * Host::Managed audit exclusions not applied, resulting in excessive audit records in Red Hat Satellite.
    (SAT-52667)
    * PG::SequenceGeneratorLimitExceeded: ERROR: nextval: reached maximum value of sequence     katello_rpms_id_seq during repo sync (SAT-53432)
    * RHSA-2026:74504: Token enforcement breaks generic non-PXE provisioning and fails when token_lifetime=0     (SAT-52700)
    * Recurring cookie store unavailable: :hash, error: key not found: :hash in Satellite under bulk RHSM load     (SAT-53431)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
476352	SCA: security update for crass (GHSA-6wmf-3r64-vcwv)	Tenable Cloud Security	SCA Checks	2026/10/20	2026/11/2	high
476352	SCA: security update for crass (GHSA-6wmf-3r64-vcwv)	Tenable Self-Hosted Container Security	SCA Checks	2026/10/20	2026/11/2	high
374410	Linux Distros 未修補弱點：CVE-2026-61845	Nessus	Misc.	2026/10/31	2026/10/31	high
374410	Linux Distros 未修补的漏洞：CVE-2026-61845	Nessus	Misc.	2026/10/31	2026/10/31	high
374410	Linux Distros のパッチ未適用の脆弱性: CVE-2026-61845	Nessus	Misc.	2026/10/31	2026/10/31	high
379920	RHEL 9 : Satellite 6.18.11 Async Update (Critical) (RHSA-2026:99952)	Nessus	Red Hat Local Security Checks	2026/11/12	2026/11/12	high
379924	RHEL 8 / 9 : Satellite 6.16.15 Async Update (Critical) (RHSA-2026:99949)	Nessus	Red Hat Local Security Checks	2026/11/12	2026/11/12	high
380364	RHEL 9 : Satellite 6.19.6 Async Update (Critical) (RHSA-2026:100120)	Nessus	Red Hat Local Security Checks	2026/11/13	2026/11/13	high
374410	Linux Distros Unpatched Vulnerability : CVE-2026-61845	Nessus	Misc.	2026/10/31	2026/10/31	high
379921	RHEL 9 : Satellite 6.17.13 Async Update (Critical) (RHSA-2026:99950)	Nessus	Red Hat Local Security Checks	2026/11/12	2026/11/12	high

偵測

搜尋 Plugin

high

high

high

high

high

high

high

high

high

high