The remote Windows host is missing security update 5126868. It is, therefore, affected by multiple vulnerabilities

  - Use after free in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code     over a network. (CVE-2026-100202)

  - Heap-based buffer overflow in Network Policy Server (NPS) allows an unauthorized attacker to execute code     over a network. (CVE-2026-100222)

  - Use after free in Microsoft Windows Search Component allows an unauthorized attacker to elevate privileges     over a network. (CVE-2026-105010)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Out-of-bounds write in .NET Framework allows an unauthorized attacker to execute code over a network.
    (CVE-2026-70007)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-6dc45f0579 advisory.

    Update to .NET SDK 9.0.122 and Runtime 9.0.21

    Fixes: CVE-2026-105016,CVE-2026-58280,CVE-2026-66822,CVE-2026-69651,CVE-2026-70007,CVE-2026-70035,CVE-     2026-70159,CVE-2026-70161,CVE-2026-70162,CVE-2026-70165,CVE-2026-70174,CVE-2026-70175,CVE-2026-70179,CVE-     2026-70181,CVE-2026-70183,CVE-2026-70186,CVE-2026-70188,CVE-2026-70190,CVE-2026-70196,CVE-2026-70197,CVE-     2026-83520,CVE-2026-84008,CVE-2026-85363,CVE-2026-85790,CVE-2026-87697,CVE-2026-88092,CVE-2026-92707,CVE-     2026-96224,CVE-2026-96225,CVE-2026-96229,CVE-2026-96230,CVE-2026-96231,CVE-2026-96232,CVE-2026-96233,CVE-     2026-96234,CVE-2026-96235,CVE-2026-96236,CVE-2026-96237,CVE-2026-96238,CVE-2026-96958,CVE-2026-96959,CVE-     2026-96960

    Release Notes:

    - SDK: https://github.com/dotnet/core/blob/main/release-notes/9.0/9.0.21/9.0.122.md
    - Runtime: https://github.com/dotnet/core/blob/main/release-notes/9.0/9.0.21/9.0.21.md

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-c8cb08de43 advisory.

    Update to .NET SDK 10.0.113 and Runtime 10.0.13

    Fixes: CVE-2026-102870,CVE-2026-105016,CVE-2026-58280,CVE-2026-66822,CVE-2026-69651,CVE-2026-70007,CVE-     2026-70035,CVE-2026-70159,CVE-2026-70161,CVE-2026-70162,CVE-2026-70165,CVE-2026-70174,CVE-2026-70175,CVE-     2026-70179,CVE-2026-70181,CVE-2026-70183,CVE-2026-70186,CVE-2026-70188,CVE-2026-70190,CVE-2026-70196,CVE-     2026-70197,CVE-2026-83520,CVE-2026-84008,CVE-2026-85363,CVE-2026-85790,CVE-2026-87697,CVE-2026-88092,CVE-     2026-92707,CVE-2026-96224,CVE-2026-96225,CVE-2026-96229,CVE-2026-96230,CVE-2026-96231,CVE-2026-96232,CVE-     2026-96233,CVE-2026-96234,CVE-2026-96235,CVE-2026-96236,CVE-2026-96237,CVE-2026-96238,CVE-2026-96957,CVE-     2026-96958,CVE-2026-96959,CVE-2026-96960

    Release Notes:

    - SDK: https://github.com/dotnet/core/blob/main/release-notes/10.0/10.0.13/10.0.113.md
    - Runtime: https://github.com/dotnet/core/blob/main/release-notes/10.0/10.0.13/10.0.13.md

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Microsoft .NET Framework installation on the remote host is missing a security update. It is, therefore, affected by multiple vulnerabilities, including the following:

  - Out-of-bounds write in .NET Framework allows an unauthorized attacker to execute code over a network.
    (CVE-2026-70007)

  - Deserialization of untrusted data in .NET Framework allows an unauthorized attacker to execute code over a     network. (CVE-2026-70035)

  - Improperly implemented security check for standard in .NET allows an unauthorized attacker to execute code     over a network. (CVE-2026-70174)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-3a916dbb6c advisory.

    Update to .NET SDK 11.0.100-rc.3.26522.148 and Runtime 11.0.0-rc.3.26522.148

    Fixes: CVE-2026-102870, CVE-2026-105016, CVE-2026-111497, CVE-2026-114148, CVE-2026-58280, CVE-2026-66822,     CVE-2026-69651, CVE-2026-70007, CVE-2026-70035, CVE-2026-70159, CVE-2026-70161, CVE-2026-70162,     CVE-2026-70165, CVE-2026-70174, CVE-2026-70183, CVE-2026-70188, CVE-2026-70190, CVE-2026-70194,     CVE-2026-70197, CVE-2026-83520, CVE-2026-84008, CVE-2026-85363, CVE-2026-85790, CVE-2026-87697,     CVE-2026-88092, CVE-2026-92707, CVE-2026-96224, CVE-2026-96225, CVE-2026-96229, CVE-2026-96230,     CVE-2026-96231, CVE-2026-96232, CVE-2026-96233, CVE-2026-96234, CVE-2026-96235, CVE-2026-96236,     CVE-2026-96238, CVE-2026-96957, CVE-2026-96958, CVE-2026-96959, CVE-2026-96960

    Release Notes:
    - SDK: https://github.com/dotnet/core/blob/main/release-     notes/11.0/11.0.0-rc.2.26504.105/11.0.100-rc.2.26504.105.md
    - SDK: https://github.com/dotnet/core/blob/main/release-     notes/11.0/11.0.0-rc.3.26522.148/11.0.100-rc.3.26522.148.md
    - Runtime: https://github.com/dotnet/core/blob/main/release-     notes/11.0/11.0.0-rc.2.26504.105/11.0.0-rc.2.26504.105.md
    - Runtime: https://github.com/dotnet/core/blob/main/release-     notes/11.0/11.0.0-rc.3.26522.148/11.0.0-rc.3.26522.148.md

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Microsoft .NET Core installations on the remote host are missing a security update. It is, therefore, affected by multiple vulnerabilities as referenced in the vendor advisory.

  - Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.
    (CVE-2026-87697)

  - Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.
    (CVE-2026-96224, CVE-2026-96235)

  - Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a     network. (CVE-2026-105016)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-c7c459ff4d advisory.

    Update to .NET SDK 10.0.113 and Runtime 10.0.13

    Fixes: CVE-2026-102870,CVE-2026-105016,CVE-2026-58280,CVE-2026-66822,CVE-2026-69651,CVE-2026-70007,CVE-     2026-70035,CVE-2026-70159,CVE-2026-70161,CVE-2026-70162,CVE-2026-70165,CVE-2026-70174,CVE-2026-70175,CVE-     2026-70179,CVE-2026-70181,CVE-2026-70183,CVE-2026-70186,CVE-2026-70188,CVE-2026-70190,CVE-2026-70196,CVE-     2026-70197,CVE-2026-83520,CVE-2026-84008,CVE-2026-85363,CVE-2026-85790,CVE-2026-87697,CVE-2026-88092,CVE-     2026-92707,CVE-2026-96224,CVE-2026-96225,CVE-2026-96229,CVE-2026-96230,CVE-2026-96231,CVE-2026-96232,CVE-     2026-96233,CVE-2026-96234,CVE-2026-96235,CVE-2026-96236,CVE-2026-96237,CVE-2026-96238,CVE-2026-96957,CVE-     2026-96958,CVE-2026-96959,CVE-2026-96960

    Release Notes:

    - SDK: https://github.com/dotnet/core/blob/main/release-notes/10.0/10.0.13/10.0.113.md
    - Runtime: https://github.com/dotnet/core/blob/main/release-notes/10.0/10.0.13/10.0.13.md

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-6cdafc7e45 advisory.

    Update to .NET SDK 8.0.132 and Runtime 8.0.32

    Fixes: CVE-2026-105016,CVE-2026-58280,CVE-2026-66822,CVE-2026-69651,CVE-2026-70007,CVE-2026-70035,CVE-     2026-70159,CVE-2026-70162,CVE-2026-70174,CVE-2026-70175,CVE-2026-70179,CVE-2026-70181,CVE-2026-70183,CVE-     2026-70186,CVE-2026-70188,CVE-2026-70196,CVE-2026-70197,CVE-2026-83520,CVE-2026-84008,CVE-2026-85363,CVE-     2026-85790,CVE-2026-87697,CVE-2026-88092,CVE-2026-92707,CVE-2026-96222,CVE-2026-96224,CVE-2026-96225,CVE-     2026-96229,CVE-2026-96230,CVE-2026-96231,CVE-2026-96232,CVE-2026-96233,CVE-2026-96234,CVE-2026-96235,CVE-     2026-96236,CVE-2026-96237,CVE-2026-96238,CVE-2026-96958,CVE-2026-96959,CVE-2026-96960

    Release Notes:

    - SDK: https://github.com/dotnet/core/blob/main/release-notes/8.0/8.0.32/8.0.132.md
    - Runtime: https://github.com/dotnet/core/blob/main/release-notes/8.0/8.0.32/8.0.32.md

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Microsoft .NET Core SDK installations on the remote host are missing a security update. It is, therefore, affected by multiple vulnerabilities as referenced in the vendor advisory.

  - Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an     unauthorized attacker to bypass a security feature over a network. (CVE-2026-70188)

  - Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an     unauthorized attacker to perform tampering over a network. (CVE-2026-88092)

  - Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a     network. (CVE-2026-105016)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3367 advisory.

    Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker     to execute code over a network. (CVE-2026-102870)

    Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to     deny service over a network. (CVE-2026-109468)

    A vulnerability in the Node.js Brotli decoder can result in an out-of-bounds memory write when processing     crafted Brotli input. Successful exploitation may lead to memory corruption and remote code execution.
    (CVE-2026-111497)

    Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.
    (CVE-2026-114148)

    Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network.
    (CVE-2026-58280)

    Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
    (CVE-2026-69651)

    Out-of-bounds write in .NET Framework allows an unauthorized attacker to execute code over a network.
    (CVE-2026-70007)

    Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to     deny service over a network. (CVE-2026-70159)

    Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a     network. (CVE-2026-70175)

    Authentication bypass by spoofing in ASP.NET Core allows an authorized attacker to elevate privileges over     a network. (CVE-2026-70179)

    Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to     deny service over a network. (CVE-2026-70181)

    Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET     Core allows an authorized attacker to elevate privileges over a network. (CVE-2026-70183)

    Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a network. (CVE-2026-70186)

    Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.
    (CVE-2026-70197)

    Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.
    (CVE-2026-83520)

    Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
    (CVE-2026-84008)

    Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized     attacker to perform spoofing over a network. (CVE-2026-96222)

    Improper link resolution before file access ('link following') in .NET allows an authorized attacker to     elevate privileges locally. (CVE-2026-96225)

    Improper link resolution before file access ('link following') in .NET allows an authorized attacker to     elevate privileges locally. (CVE-2026-96231)

    Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network.
    (CVE-2026-96233)

    Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to     deny service over a network. (CVE-2026-96236)

    Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to     execute code over a network. (CVE-2026-96237)

    Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
    (CVE-2026-96958)

    Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny     service over a network. (CVE-2026-96959)

    Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service     over a network. (CVE-2026-96960)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
365471	KB5126868: Windows 10 Version 1607 / Windows Server 2016 Security Update (October 2026)	Nessus	Windows : Microsoft Bulletins	2026/10/13	2026/10/22	critical
367628	Linux Distros Unpatched Vulnerability : CVE-2026-70007	Nessus	Misc.	2026/10/20	2026/10/21	high
371737	Fedora 44 : dotnet9.0 (2026-6dc45f0579)	Nessus	Fedora Local Security Checks	2026/10/24	2026/11/13	critical
371731	Fedora 44 : dotnet10.0 (2026-c8cb08de43)	Nessus	Fedora Local Security Checks	2026/10/24	2026/11/13	critical
366093	Microsoft .NET Framework (October 2026)	Nessus	Windows : Microsoft Bulletins	2026/10/15	2026/10/16	high
378672	Fedora 43 : dotnet11.0 (2026-3a916dbb6c)	Nessus	Fedora Local Security Checks	2026/11/11	2026/11/12	critical
366546	Security Update for Microsoft .NET Core (October 2026)	Nessus	Windows	2026/10/16	2026/11/13	critical
371740	Fedora 43 : dotnet10.0 (2026-c7c459ff4d)	Nessus	Fedora Local Security Checks	2026/10/24	2026/11/13	critical
371923	Fedora 44 : dotnet8.0 (2026-6cdafc7e45)	Nessus	Fedora Local Security Checks	2026/10/25	2026/11/13	critical
366547	Security Update for Microsoft .NET Core SDK (October 2026)	Nessus	Windows	2026/10/16	2026/11/13	critical
374355	Amazon Linux 2023 : aspnetcore-runtime-8.0, aspnetcore-runtime-dbg-8.0, aspnetcore-targeting-pack-8.0 (ALAS2023-2026-3367)	Nessus	Amazon Linux Local Security Checks	2026/10/30	2026/11/2	critical

偵測

搜尋 Plugin

critical

high

critical

critical

high

critical

critical

critical

critical

critical

critical