Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - Oracle Java SE 中的漏洞（组件：Security）。支持的版本中受影响的是 Oracle Java SE： 21.0.12.1和 25.0.4.1 27。利用此漏洞的难度较大，可通过多种协议访问网络的未经身份验证的攻击者可利用此漏洞破坏 Oracle Java SE。若成功利用此漏洞进行攻击可导致在未经授权的情况下更新、插入或删除某些 Oracle Java SE 可访问数据的访问权限。注意：此漏洞可通过使用指定组件中的 API 加以利用，如通过向 API 提供数据的 Web 服务。此漏洞也适用于需加载并运行不可信代码（如来自互联网的代码）且安全性依赖于 Java 沙盒的 Java 部署，该部署通常在需在沙盒中运行 Java Web Start 应用程序或需在沙盒中运行 Java 小程序的客户端上。(CVE-2026-91333)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - Oracle Java SE 中的弱點 （元件：安全性）。受影響的支援版本有 Oracle Java SE： 21.0.12.1和 25.0.4.1 27。攻擊此弱點的難度較大，能夠透過多個通訊協定存取網路的未經驗證的攻擊者可利用此弱點入侵 Oracle Java SE。若成功攻擊此弱點，攻擊者未經授權即可更新、插入或刪除部分 Oracle Java SE 可存取資料。注意：使用指定之元件中的 API 可以惡意利用此弱點，例如，透過提供資料給 API 的 Web 服務。此弱點亦適用於 Java 部署，通常是在執行沙箱隔離的 Java Web Start 應用程式或沙箱隔離的 Java Applet 的用戶端中，這種部署會載入並執行不受信任的程式碼 (例如，來自網際網路的程式碼)，並依賴 Java 沙箱獲得安全性。(CVE-2026-91333)

請注意，Nessus 依賴供應商報告的套件存在。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - Oracle Java SE の脆弱性 (コンポーネント: セキュリティ)。サポートされているバージョンで影響を受けるのは、Oracle Java SE: 21.0.12.1、 25.0.4.1 、27です。悪用が難しい脆弱性ですが、認証されていない攻撃者が複数のプロトコルを介してネットワークにアクセスし、Oracle Java SE を侵害する可能性があります。この脆弱性に対する攻撃が成功すると、Oracle Java SE がアクセスできるデータの一部が、権限なしで更新、挿入、削除される可能性があります。注意: この脆弱性は、指定されたコンポーネントで API を使用することによって (たとえば API にデータを提供するウェブサービスを通して) 悪用される可能性があります。この脆弱性は、通常、サンドボックス化された Java Web Start アプリケーションまたはサンドボックス化された Java アプレットを実行しているクライアントで信頼できないコード (インターネットからのコードなど) を読み込んで実行し、セキュリティを Java サンドボックスに依存する Java デプロイメントも対象です。(CVE-2026-91333)

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Vulnerability in Oracle Java SE (component: Security). Supported versions that are affected are Oracle     Java SE: 21.0.12.1, 25.0.4.1 and 27. Difficult to exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this     vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE     accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g.,     through a web service which supplies data to the APIs. This vulnerability also applies to Java     deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets,     that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox     for security. (CVE-2026-91333)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:88347 advisory.

    * JDK: Enhance PKCS5 padding (CVE-2026-83374)
      * JDK: Enhance TLS certificate handling (CVE-2026-83376)
      * JDK: Improve C2 loop transformations (CVE-2026-83378)
      * JDK: Enhance LDAP logins (CVE-2026-83380)
      * JDK: Enhance SASL Authentication (CVE-2026-83381)
      * JDK: Enhance WebRowSets (CVE-2026-83387)
      * JDK: Enhance HTTP Client Response Handling (CVE-2026-83395)
      * JDK: Enhance XML Processing (CVE-2026-83400)
      * JDK: Enhance Vector Processing (CVE-2026-87255)
      * JDK: Enhance XPath Expressions (CVE-2026-87290)
      * JDK: Enhance HTTP Server (CVE-2026-87291)
      * JDK: Enhance Network Clients (CVE-2026-87292)
      * JDK: Enhance Certificate Name Checks (CVE-2026-87294)
      * JDK: Enhance Template Handling (CVE-2026-87367)
      * JDK: Enhance HTTP Client (CVE-2026-91332)
      * JDK: Improve ciphertext handling (CVE-2026-91333)
      * JDK: Enhance JPEG loading (CVE-2026-91334)
      * JDK: Enhance Image Handling (CVE-2026-91335)
      * JDK: Enhance TLS handshakes (CVE-2026-91373)
      * JDK: Enhance jstatd (CVE-2026-91374)
      * JDK: Enhance jmod handling (CVE-2026-91375)
      * JDK: Enhance JShell (CVE-2026-91379)
      * JDK: Enhance Preferences (CVE-2026-91380)
      * JDK: Enhance HTTP client caching (CVE-2026-91394)
      * JDK: Enhance diagnostic sessions (CVE-2026-91397)
      * JDK: Enhance SOCKS5 support (CVE-2026-91398)
      * JDK: Enhance MIDI file handling (CVE-2026-91400)
      * JDK: Enhance zipfs (CVE-2026-91410)
      * JDK: Enhance font rendering (CVE-2026-91415)
      * JDK: Enhance GIF loading (CVE-2026-91418)
      * JDK: Enhance HTTP server parsing (CVE-2026-91451)
      * JDK: Enhance HTTP server (CVE-2026-91452)
      * JDK: Improve HTTP headers (CVE-2026-91453)
      * JDK: Enhance TLS Extensions (CVE-2026-91461)
      * JDK: Enhance krb5 tokens (CVE-2026-91462)
      * JDK: Enhance krb5 client (CVE-2026-91463)
      * JDK: Enhance Kerberos validation (CVE-2026-91464)
      * JDK: Enhance C2 comparisons (CVE-2026-91487)
      * JDK: Enhance Certificate Constraint Checking (CVE-2026-101516)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 26.0.2 and 27 releases of Oracle Java SE installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2026 CPU advisory.

  - Vulnerability in the Oracle Java SE, Oracle JavaFX product of Oracle Java SE (component: JavaFX     (WebKitGTK)). Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4     and 27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Oracle Java SE, Oracle JavaFX. Successful attacks require human interaction from a     person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle     Java SE, Oracle JavaFX. (CVE-2026-43660)

  - Vulnerability in Oracle Java SE (component: Java plugin). Supported versions that are affected are Oracle     Java SE: 8u503 and 8u503-perf. Difficult to exploit vulnerability allows low privileged attacker with logon     to the infrastructure where Oracle Java SE executes to compromise Oracle Java SE. While the vulnerability is     in Oracle Java SE, attacks may significantly impact additional products (scope change). (CVE-2026-91484)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf,     11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle     GraalVM Enterprise Edition: 21.3.19.1.1. Successful attacks of this vulnerability can result in unauthorized     ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM for     JDK, Oracle GraalVM Enterprise Edition as well as unauthorized update, insert or delete access to some of     Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data and unauthorized     read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition     accessible data. (CVE-2026-91415)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:88347 advisory.

    The OpenJDK 25 packages provide the OpenJDK 25 Java Runtime Environment and the OpenJDK 25 Java Software     Development Kit.

    Security Fix(es):

    * JDK: Enhance PKCS5 padding (CVE-2026-83374)

    * JDK: Enhance TLS certificate handling (CVE-2026-83376)

    * JDK: Improve C2 loop transformations (CVE-2026-83378)

    * JDK: Enhance LDAP logins (CVE-2026-83380)

    * JDK: Enhance SASL Authentication (CVE-2026-83381)

    * JDK: Enhance WebRowSets (CVE-2026-83387)

    * JDK: Enhance HTTP Client Response Handling (CVE-2026-83395)

    * JDK: Enhance XML Processing (CVE-2026-83400)

    * JDK: Enhance Vector Processing (CVE-2026-87255)

    * JDK: Enhance XPath Expressions (CVE-2026-87290)

    * JDK: Enhance HTTP Server (CVE-2026-87291)

    * JDK: Enhance Network Clients (CVE-2026-87292)

    * JDK: Enhance Certificate Name Checks (CVE-2026-87294)

    * JDK: Enhance Template Handling (CVE-2026-87367)

    * JDK: Enhance HTTP Client (CVE-2026-91332)

    * JDK: Improve ciphertext handling (CVE-2026-91333)

    * JDK: Enhance JPEG loading (CVE-2026-91334)

    * JDK: Enhance Image Handling (CVE-2026-91335)

    * JDK: Enhance TLS handshakes (CVE-2026-91373)

    * JDK: Enhance jstatd (CVE-2026-91374)

    * JDK: Enhance jmod handling (CVE-2026-91375)

    * JDK: Enhance JShell (CVE-2026-91379)

    * JDK: Enhance Preferences (CVE-2026-91380)

    * JDK: Enhance HTTP client caching (CVE-2026-91394)

    * JDK: Enhance diagnostic sessions (CVE-2026-91397)

    * JDK: Enhance SOCKS5 support (CVE-2026-91398)

    * JDK: Enhance MIDI file handling (CVE-2026-91400)

    * JDK: Enhance zipfs (CVE-2026-91410)

    * JDK: Enhance font rendering (CVE-2026-91415)

    * JDK: Enhance GIF loading (CVE-2026-91418)

    * JDK: Enhance HTTP server parsing (CVE-2026-91451)

    * JDK: Enhance HTTP server (CVE-2026-91452)

    * JDK: Improve HTTP headers (CVE-2026-91453)

    * JDK: Enhance TLS Extensions (CVE-2026-91461)

    * JDK: Enhance krb5 tokens (CVE-2026-91462)

    * JDK: Enhance krb5 client (CVE-2026-91463)

    * JDK: Enhance Kerberos validation (CVE-2026-91464)

    * JDK: Enhance C2 comparisons (CVE-2026-91487)

    * JDK: Enhance Certificate Constraint Checking (CVE-2026-101516)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Note that the OpenJDK RPMs use the system certificate store, so the eMudhra CVEs (CVE-2026-91403 &     CVE-2026-114820) should be resolved by updating the ca-certificates package.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
370066	Linux Distros 未修补的漏洞：CVE-2026-91333	Nessus	Misc.	2026/10/21	2026/10/29	low
370066	Linux Distros 未修補弱點：CVE-2026-91333	Nessus	Misc.	2026/10/21	2026/10/29	low
370066	Linux Distros のパッチ未適用の脆弱性: CVE-2026-91333	Nessus	Misc.	2026/10/21	2026/10/29	low
370066	Linux Distros Unpatched Vulnerability : CVE-2026-91333	Nessus	Misc.	2026/10/21	2026/10/29	low
373647	AlmaLinux 10 : java-25-openjdk (ALSA-2026:88347)	Nessus	Alma Linux Local Security Checks	2026/10/29	2026/10/29	high
372932	Oracle Java SE Multiple Vulnerabilities (October 2026 CPU)	Nessus	Misc.	2026/10/28	2026/10/29	medium
373576	RHEL 10 / 9 : java-25-openjdk (RHSA-2026:88347)	Nessus	Red Hat Local Security Checks	2026/10/29	2026/10/29	high

偵測

搜尋 Plugin

low

low

low

low

high

medium

high