The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-17802 advisory.

    [2.50.0-1]
    - Update to 2.50.0

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0755 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2025-43368:
    A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26,     macOS Tahoe 26, iOS 26 and iPadOS 26. Processing maliciously crafted web content may lead to an unexpected     Safari crash.

    CVE-2025-43356:
    The issue was addressed with improved handling of caches. This issue is fixed in tvOS 26, Safari 26, iOS     18.7 and iPadOS 18.7, visionOS 26, watchOS 26, macOS Tahoe 26, iOS 26 and iPadOS 26. A website may be able     to access sensor information without user consent.

    CVE-2025-43342:
    A correctness issue was addressed with improved checks. This issue is fixed in tvOS 26, Safari 26, iOS     18.7 and iPadOS 18.7, visionOS 26, watchOS 26, macOS Tahoe 26, iOS 26 and iPadOS 26. Processing     maliciously crafted web content may lead to an unexpected process crash.

    CVE-2025-43272:
    The issue was addressed with improved memory handling. This issue is fixed in Safari 26, visionOS 26,     watchOS 26, macOS Tahoe 26, iOS 26 and iPadOS 26. Processing maliciously crafted web content may lead to     an unexpected Safari crash.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-18097 advisory.

    [2.50.1-1]
    - Update to 2.50.1

    [2.50.0-1]
    - Update to 2.50.0

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:3701-1 advisory.

    - CVE-2025-43343: improved memory handling in web content processing to prevent process crash     (bsc#1251975)
     - CVE-2025-43272: improved memory handling to prevent unexpected process crash (bsc#1250439)
     - CVE-2025-43342: correctness issue was addressed with improved checks to prevent unexcepted process     crash (bsc#1250440)
     - CVE-2025-43356: improved handling of caches to prevent sensor access without consent (bsc#1250441)
     - CVE-2025-43368: improved memory management to prevent a use-after-free (bsc#1250442)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:18097 advisory.

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2025-43272)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43342)
      * webkitgtk: A website may be able to access sensor information without user consent (CVE-2025-43356)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2025-43368)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43343)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:19165 advisory.

    WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

    Security Fix(es):

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2025-43272)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43342)

    * webkitgtk: A website may be able to access sensor information without user consent (CVE-2025-43356)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2025-43368)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Azul Zulu installed on the remote host is 6 prior to 6.77.0.12 / 7 prior to 7.83.0.12 / 8 prior to 8.91.0.12 / 11 prior to 11.85.12 / 17 prior to 17.63.12 / 21 prior to 21.47.14 / 25 prior to 25.31.14. It is, therefore, affected by multiple vulnerabilities as referenced in the 2026-01-20 advisory.

  - A flaw was found in how GLib's GString manages memory when adding data to strings. If a string is already     very large, combining it with more input can cause a hidden overflow in the size calculation. This makes     the system think it has enough memory when it doesn't. As a result, data may be written past the end of     the allocated memory, leading to crashes or memory corruption. (CVE-2025-6052)

  - A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations     can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of     service when processing crafted input. (CVE-2025-6021)

  - A flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts     internal memory management. When XSLT functions, such as the key() process, result in tree fragments, this     corruption prevents the proper cleanup of ID attributes. As a result, the system may access freed memory,     causing crashes or enabling attackers to trigger heap corruption. (CVE-2025-7425)

  - A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26,     iOS 26 and iPadOS 26. Processing maliciously crafted web content may lead to an unexpected Safari crash.
    (CVE-2025-43368)

  - In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_trak function may read past the end of a     heap buffer while parsing an MP4 file, possibly leading to information disclosure. (CVE-2025-47219)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Java installed on the remote host is affected by multiple vulnerabilities as referenced in the January 2026 CPU advisory.
  - Vulnerability in Oracle Java SE (component: JavaFX (libxslt)). Supported versions that are affected are     Oracle Java SE: 8u471-b50. Difficult to exploit vulnerability allows unauthenticated attacker with network     access via multiple protocols to compromise Oracle Java SE. Successful attacks require human interaction     from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of     Oracle Java SE. (CVE-2025-7425)

  - Vulnerability in Oracle Java SE (component: JavaFX (WebKitGTK)). Supported versions that are affected are     Oracle Java SE: 8u471-b50. Difficult to exploit vulnerability allows unauthenticated attacker with network     access via multiple protocols to compromise Oracle Java SE. Successful attacks require human interaction     from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of     Oracle Java SE. (CVE-2025-43368)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u471,     8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle     GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a     hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition. (CVE-2026-21945)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
270333	Oracle Linux 8 : webkit2gtk3 (ELSA-2025-17802)	Nessus	Oracle Linux Local Security Checks	2025/10/14	2025/10/14	critical
270644	TencentOS Server 4: webkit2gtk4.1 (TSSA-2025:0755)	Nessus	Tencent Local Security Checks	2025/10/16	2025/12/4	critical
270809	Oracle Linux 9 : webkit2gtk3 (ELSA-2025-18097)	Nessus	Oracle Linux Local Security Checks	2025/10/20	2025/10/20	critical
271170	SUSE SLED15: WebKitGTK-4.0-lang / WebKitGTK-4.1-lang / WebKitGTK-6.0-lang / etc (SUSE-SU-2025:3701-1)	Nessus	SuSE Local Security Checks	2025/10/22	2026/6/25	critical
271265	AlmaLinux 9 : webkit2gtk3 (ALSA-2025:18097)	Nessus	Alma Linux Local Security Checks	2025/10/23	2025/10/23	critical
271929	RHEL 8 : webkit2gtk3 (RHSA-2025:19165)	Nessus	Red Hat Local Security Checks	2025/10/28	2025/10/28	critical
294803	Azul Zulu Java Multiple Vulnerabilities (2026-01-20)	Nessus	Misc.	2026/1/21	2026/2/4	high
294870	Oracle Java SE Multiple Vulnerabilities (January 2026 CPU)	Nessus	Misc.	2026/1/21	2026/2/4	medium

偵測

搜尋 Plugin

critical

critical

critical

critical

critical

critical

high

medium