The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-21757 advisory.

    [1.16.0-9.1]
    - Fix arbitrary code execution via crafted symlinks in sandbox-expose options       Resolves: RHEL-165630
    - Fix arbitrary file deletion on host via improper cache file path validation       Resolves: RHEL-170157

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1781603962 advisory.

  - Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the Flatpak portal     accepts paths in the sandbox-expose options which can be app-controlled symlinks pointing at arbitrary     paths. Flatpak run mounts the resolved host path in the sandbox. This gives apps access to all host files     and can be used as a primitive to gain code execution in the host context. This vulnerability is fixed in     1.16.4. (CVE-2026-34078)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_21756 advisory.

    * flatpak: Flatpak: Arbitrary code execution via crafted symlinks in sandbox-expose options     (CVE-2026-34078)

    * flatpak: Flatpak: Arbitrary file deletion on host via improper cache file path validation     (CVE-2026-34079)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_21755 advisory.

    * flatpak: Flatpak: Arbitrary code execution via crafted symlinks in sandbox-expose options     (CVE-2026-34078)

    * flatpak: Flatpak: Arbitrary file deletion on host via improper cache file path validation     (CVE-2026-34079)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1780908222 advisory.

  - Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the Flatpak portal     accepts paths in the sandbox-expose options which can be app-controlled symlinks pointing at arbitrary     paths. Flatpak run mounts the resolved host path in the sandbox. This gives apps access to all host files     and can be used as a primitive to gain code execution in the host context. This vulnerability is fixed in     1.16.4. (CVE-2026-34078)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6207 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6207-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     April 12, 2026                        https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : flatpak     CVE ID         : CVE-2026-34078 CVE-2026-34079

    Multiple security vulnerabilities were discovered in Flatpak, an     application deployment framework for desktop apps, which could allow a     Flatpak app to delete arbitrary hosts on the host or break out of the     sandbox resulting in code execution in the host context.

    For the stable distribution (trixie), these problems have been fixed in     version 1.16.6-1~deb13u1.

    We recommend that you upgrade your flatpak packages.

    For the detailed security status of flatpak please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/flatpak

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1511-1 advisory.

    - CVE-2026-34078: Arbitrary code execution via crafted symlinks in sandbox-expose options (bsc#1261769).
    - CVE-2026-34079: Arbitrary file deletion on host via improper cache file path validation (bsc#1261770).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1600-1 advisory.

    - CVE-2026-34078: Arbitrary code execution via crafted symlinks in sandbox-expose options (bsc#1261769).
    - CVE-2026-34079: Arbitrary file deletion on host via improper cache file path validation (bsc#1261770).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1781603962 advisory.

  - Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the Flatpak portal     accepts paths in the sandbox-expose options which can be app-controlled symlinks pointing at arbitrary     paths. Flatpak run mounts the resolved host path in the sandbox. This gives apps access to all host files     and can be used as a primitive to gain code execution in the host context. This vulnerability is fixed in     1.16.4. (CVE-2026-34078)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-35843 advisory.

    - Backport upstream patches for CVE-2024-42472
    - Require bubblewrap version that has new --bind-fd option backported for       addressing CVE-2024-42472
    - Update to 1.12.9 (CVE-2024-32462)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the Flatpak portal     accepts paths in the sandbox-expose options which can be app-controlled symlinks pointing at arbitrary     paths. Flatpak run mounts the resolved host path in the sandbox. This gives apps access to all host files     and can be used as a primitive to gain code execution in the host context. This vulnerability is fixed in     1.16.4. (CVE-2026-34078)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名稱	產品	系列	已發布	已更新	嚴重性
327523	Oracle Linux 10 : flatpak (ELSA-2026-21757)	Nessus	Oracle Linux Local Security Checks	2026/7/17	2026/7/17	critical
352623	AlmaLinux 9.6 [TuxCare] Security Update: flatpak / flatpak-devel / flatpak-libs / flatpak-selinux / etc (ALMALINUX9.6:CLSA-2026:1781603962)	Nessus	Alma Linux Local Security Checks	2026/9/30	2026/9/30	critical
355139	Rocky Linux 8 [CIQ] Security Update: flatpak / flatpak-debuginfo / flatpak-debugsource / flatpak-devel / etc Multiple Vulnerabilities (crlsa-2026_21756)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	critical
356675	Rocky Linux 9 [CIQ] Security Update: flatpak / flatpak-debuginfo / flatpak-debugsource / flatpak-devel / etc Multiple Vulnerabilities (crlsa-2026_21755)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	critical
359668	AlmaLinux 9.2 [TuxCare] Security Update: flatpak / flatpak-devel / flatpak-libs / flatpak-selinux / etc (ALMALINUX9.2:CLSA-2026:1780908222)	Nessus	Alma Linux Local Security Checks	2026/10/1	2026/10/1	critical
307634	Debian dsa-6207 : flatpak - security update	Nessus	Debian Local Security Checks	2026/4/20	2026/4/27	critical
309122	SUSE SLES15 Security Update : flatpak (SUSE-SU-2026:1511-1)	Nessus	SuSE Local Security Checks	2026/4/22	2026/4/27	critical
310241	SUSE SLED15 / SLES15 Security Update : flatpak (SUSE-SU-2026:1600-1)	Nessus	SuSE Local Security Checks	2026/4/25	2026/4/25	critical
352918	Rocky Linux 9.6 [TuxCare] Security Update: flatpak / flatpak-devel / flatpak-libs / flatpak-selinux / etc (ALMALINUX9.6:CLSA-2026:1781603962)	Nessus	Rocky Linux Local Security Checks	2026/9/30	2026/9/30	critical
365561	Oracle Linux 7 : flatpak (ELSA-2026-35843)	Nessus	Oracle Linux Local Security Checks	2026/10/14	2026/10/14	critical
305259	Linux Distros Unpatched Vulnerability : CVE-2026-34078	Nessus	Misc.	2026/4/7	2026/9/10	critical

偵測

搜尋 Plugin

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical