DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cross-site scripting (mXSS).

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:2769 advisory.

    Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable     version of the Ceph storage system with a Ceph management platform, deployment utilities, and support     services.

    These new packages include numerous security and bug fixes. Space precludes documenting all of these     changes in this advisory. Users are directed to the Red Hat Ceph Storage Release Notes for information on     the most significant of these changes:

    https://docs.redhat.com/en/documentation/red_hat_ceph_storage/7/html/7.1_release_notes

    ==========================================     IMPORTANT:
    The Red Hat Ceph Storage team has migrated our defect tracking from Bugzilla to an internal Jira system.
    Bug fixes and CVE information that was previously listed in the errata releases are now listed in the     Release Notes.

    During the migration period, some defect details might still appear temporarily in the Errata. However,     the release notes contain the most current and authoritative information, including the complete list of     fixes and security updates.

    Refer to the release notes going forward for the latest and most accurate fix and CVE information.
    ==========================================

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Primavera P6 Enterprise Project Portfolio Management installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2026 CPU advisory.

  - Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction     and Engineering (component: Team Member (DOMPurify)). Supported versions that are affected are     21.12.0.0-21.12.21.5, 22.12.0.0-22.12.20.0, 23.12.0.0-23.12.17.0 and 24.12.0.0-24.12.11.0. Difficult to     exploit vulnerability allows low privileged attacker with logon to the infrastructure where Primavera P6     Enterprise Project Portfolio Management executes to compromise Primavera P6 Enterprise Project Portfolio     Management. Successful attacks require human interaction from a person other than the attacker and while     the vulnerability is in Primavera P6 Enterprise Project Portfolio Management, attacks may significantly     impact additional products (scope change). Successful attacks of this vulnerability can result in     unauthorized update, insert or delete access to some of Primavera P6 Enterprise Project Portfolio     Management accessible data as well as unauthorized read access to a subset of Primavera P6 Enterprise     Project Portfolio Management accessible data. (CVE-2025-26791)

  - Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction     and Engineering (component: Integrators (Apache CXF)). Supported versions that are affected are     22.12.0.0-22.12.20.0, 23.12.0.0-23.12.17.0 and 24.12.0.0-24.12.11.0. Difficult to exploit vulnerability     allows unauthenticated attacker with network access via HTTP to compromise Primavera P6 Enterprise Project     Portfolio Management. Successful attacks of this vulnerability can result in unauthorized update, insert     or delete access to some of Primavera P6 Enterprise Project Portfolio Management accessible data as well     as unauthorized read access to a subset of Primavera P6 Enterprise Project Portfolio Management accessible     data and unauthorized ability to cause a partial denial of service (partial DOS) of Primavera P6     Enterprise Project Portfolio Management. (CVE-2025-48795)

  - Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction     and Engineering (component: Web Access (Apache Commons BeanUtils)). Supported versions that are affected     are 21.12.0.0-21.12.21.5, 22.12.0.0-22.12.20.0, 23.12.0.0-23.12.17.0 and 24.12.0.0-24.12.6.0. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise     Primavera P6 Enterprise Project Portfolio Management. Successful attacks of this vulnerability can result     in unauthorized read access to a subset of Primavera P6 Enterprise Project Portfolio Management accessible     data. (CVE-2025-48734)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-dbeb2c60c3 advisory.

    31.0.2 release RHBZ#2345769 RHBZ#2345775 RHBZ#2350414

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-9e6b55e70b advisory.

    31.0.2 release RHBZ#2345769 RHBZ#2345775 RHBZ#2350414

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-e50201543b advisory.

    Update to 4.3.6 (rhbz#2352545)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-1d68ba6806 advisory.

    Update to 4.3.6 (rhbz#2352545)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:2518 advisory.

    Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing     IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to     individual teams, while automation developers retain the freedom to write tasks that leverage existing     knowledge without the overhead. Ansible Automation Platform makes it possible for users across an     organization to share, vet, and manage automation content by means of a simple, powerful, and agentless     language.

    Security Fix(es):

    * automation-gateway: Mutation XSS in DOMPurify Due to Improper Template Literal Handling (CVE-2025-26791)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Updates and fixes included:

    Automation Platform
    * Fixed an issue that would prevent some types of resources from getting synced if there was a naming     conflict (AAP-41241)
    * Fixed an issue where login would fail for users who were members of a team or organization that had a     naming conflict (AAP-41240)
    * Fixed an issue in the user collection module where running with state: present would cause a stack trace     (AAP-40887)
    * Fixed an issue preventing the controller admin password to get set for the gateway admin account during     upgrades (AAP-40839)
    * Fixed an issue that caused updates to SAML authenticators to ignore an updated public certificate     provided via UI or API and then fail with the message The certificate and private key do not match     (AAP-40767)
    * Allow services to request cloud.redhat.com settings from gateway using ServiceTokenAuth (AAP-39649)
    * Fixed ServiceAuthToken destroy method to allow HTTP delete via ServiceAuth to work properly (AAP-37630)
    * automation-gateway has been updated to 2.5.20250312
    * python3.11-django-ansible-base has been updated to 2.5.20250312

    Automation controller
    * Fixed the indirect host counting name to not record the hostname, but from the query result instead     (AAP-41033)
    * Fixed OpaClient to initialize properly after timeouts and retries (AAP-40997)
    * Added service account credentials for Analytics in controller (AAP-40769)
    * Added a helper method in the API for fetching the service account token from sso.redhat.com (AAP-39637)
    * automation-controller has been updated to 4.6.9

    Event-Driven Ansible
    * Fixed ansible-rulebook support for third party python libraries (AAP-41341)
    * Modified the behavior of the ansible-rulebook and Event-Driven Ansible to help with issues when the     activation correctly started was considered unresponsive and scheduled for restarting (AAP-41070)
    * Added support for editing and copying of rulebook activations in the API (AAP-40254)
    * Rulebook activations' log message field is separated into timestamps and message fields (AAP-39743)
    * Fixed a bug where the activation was incorrectly restarted with the error message Missing container for     running activation (AAP-39545)
    * Event streams now connect to PostgreSQL by using the certificates configured at the installation     (AAP-39294)
    * User is now required to give a user defined name when copying a credential. The new credential name must     be unique (AAP-39079)
    * Enhanced error messages related to Decision Environments (AAP-38941)
    * Decision environment urls are now validated against OCI specification to ensure successful     authentication to the container registry when pulling the image (AAP-38822)
    * ansible-rulebook has been updated to 1.1.3
    * automation-eda-controller has been updated to 1.1.6

    Receptor:
    * Fixed an issue where receptor was creating too many inotify processes, and where the user would     encounter a too many open files error (AAP-22605)
    * receptor has been updated to 1.5.3

    Container-based Ansible Automation Platform
    * Corrected the URL in the postinstall code for automation hub to use the gateway proxy URL (AAP-41306)
    * Deprecated the variables eda_main_url and hub_main_url in favor of the gateway proxy URL (AAP-41306)
    * Receptor mesh connections are now created between all automation controller nodes (AAP-41102)
    * Fixed receptor configuration related to the container group instances type (AAP-40431)
    * Fixed behavior that would hide the errors during EDA status validation (AAP-40021)
    * Ensure the polkit RPM package is installed in order to enable user lingering (AAP-39860)
    * containerized installer setup has been updated to 2.5-11

    RPM-based Ansible Automation Platform
    * Fixed an issue where SELinux relabeling didn't happen when fcontext rules were changed (AAP-40489)
    * Fixed an issue where the credentials for execution environments and decision environments hosted in     automation hub were incorrectly configured (AAP-40419)
    * Fixed an issue where projects failed to sync due to incorrectly configured credentials for ansible     collections hosted in automation hub (AAP-40418)
    * Managed CA will now correctly assign eligible groups during discovery during installation, backup and     restore (AAP-40277)
    * Implemented argument to collect sosreport using the setup script (AAP-40085)
    * EDA Activation logging is now provided via the journald driver (AAP-39745)
    * ansible-automation-platform-installer and installer setup have been updated to 2.5-9

    Additional changes:
    * ansible-creator has been updated to 25.0.0
    * ansible-dev-environment has been updated to 25.1.0
    * ansible-dev-tools has been updated to 25.2.0
    * ansible-lint has been updated to 25.1.2
    * ansible-navigator has been updated to 25.1.0
    * automation-hub has been updated to 4.10.2
    * molecule has been updated to 25.2.0
    * python3.11-ansible-compat has been updated to 25.1.2
    * python3.11-galaxy-importer has been updated to 0.4.28
    * python3.11-galaxy-ng has been updated to 4.10.2
    * python3.11-jsonschema-path has been updated to 0.3.4
    * python3.11-podman has been updated to 5.2.0
    * python3.11-pytest-ansible has been updated to 25.1.0
    * python3.11-referencing has been updated to 0.36.2
    * python3.11-tox-ansible has been updated to 25.1.0
    * python3.11-typing-extensions has been updated to 4.9.0

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation     cross-site scripting (mXSS). (CVE-2025-26791)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation
    cross-site scripting (mXSS). (CVE-2025-26791)

ID	Name	Product	Family	Type	Severity
299273	RHEL 8 / 9 : Red Hat Ceph Storage 7.1 (RHSA-2026:2769)	Nessus	Red Hat Local Security Checks	Local	high
294995	Oracle Primavera P6 Enterprise Project Portfolio Management (January 2026 CPU)	Nessus	CGI abuses	Remote	medium
233810	Fedora 40 : nextcloud (2025-dbeb2c60c3)	Nessus	Fedora Local Security Checks	Local	medium
233805	Fedora 41 : nextcloud (2025-9e6b55e70b)	Nessus	Fedora Local Security Checks	Local	medium
233278	Fedora 41 : jupyterlab (2025-e50201543b)	Nessus	Fedora Local Security Checks	Local	medium
233277	Fedora 40 : jupyterlab (2025-1d68ba6806)	Nessus	Fedora Local Security Checks	Local	medium
232781	RHEL 8 / 9 : Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update (Moderate) (RHSA-2025:2518)	Nessus	Red Hat Local Security Checks	Local	medium
230891	Linux Distros Unpatched Vulnerability : CVE-2025-26791	Nessus	Misc.	Local	medium
420907	SCA: security update for dompurify (GHSA-vhxf-7vqr-mrjg)	Tenable Cloud Security	SCA Checks	Local	medium
420907	SCA: security update for dompurify (GHSA-vhxf-7vqr-mrjg)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2025-26791

medium

Tenable Plugins

high

medium

medium

medium

medium

medium

medium

medium

medium

medium