The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.

The remote Ubuntu 22.04 LTS / 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8089-1 advisory.

    Bahruz Jabiyev, Tommaso Innocenti, Anthony Gavazzi, Steven Sprecher, and Kaan Onarlioglu discovered that     servers using Go Networking could hang during shutdown if preempted by a fatal error. An attacker could     possibly use this to cause a denial of service. This issue only affected Ubuntu 22.04 LTS.
    (CVE-2022-27664)

    Arpad Ryszka and Jakob Ackermann discovered that a maliciously crafted stream could cause excessive CPU     usage in Go Networking's HPACK decoder. An attacker could possibly use this to cause a denial of service.
    This issue only affected Ubuntu 22.04 LTS. (CVE-2022-41723)

    Mohammad Thoriq Aziz discovered that Go Networking did not properly sanitize some text nodes. An attacker     could possibly use this to execute arbitrary code. This issue only affected Ubuntu 22.04 LTS.
    (CVE-2023-3978)

    Sean Ng discovered an error in Go Networking's HTML tag handling. An attacker could possibly use this to     cause a denial of service. (CVE-2025-22872)

    Guido Vranken and Jakub Ciolek discovered that a maliciously crafted HTML document could exhaust system     resources on servers using Go Networking. An attacker could possibly use this to cause a denial of     service. (CVE-2025-47911)

    Guido Vranken discovered that a maliciously crafted HTML document could put servers using Go Networking     into an infinite loop. An attacker could possibly use this to cause a denial of service. (CVE-2025-58190)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20327-1 advisory.

    - Update to version 3.19.1:
      * CVE-2025-47911: golang.org/x/net/html: Fixed various algorithms with         quadratic complexity when parsing HTML documents (bsc#1251442)
      * CVE-2025-58190: golang.org/x/net/html: Fixed xcessive memory         consumption by `html.ParseFragment` when processing specially         crafted input (bsc#1251649)
      * jsonschema: warn and ignore unresolved URN $ref to match         v3.18.4
      * Avoid panic: interface conversion: interface {} is nil
      * Fix `helm pull` untar dir check with repo urls
      * Fix deprecation warning
      * Add timeout flag to repo add and update flags

    - Update to version 3.19.0:
      * bump version to v3.19.0
      * fix: use username and password if provided
      * fix(helm-lint): fmt
      * fix(helm-lint): Add TLSClientConfig
      * fix(helm-lint): Add HTTP/HTTPS URL support for json schema references
      * chore(deps): bump the k8s-io group with 7 updates
      * fix: go mod tidy for v3
      * fix Chart.yaml handling
      * Handle messy index files
      * json schema fix
      * fix: k8s version parsing to match original
      * Do not explicitly set SNI in HTTPGetter
      * Disabling linter due to unknown issue
      * Updating link handling
      * fix: user username password for login
      * Update pkg/registry/transport.go
      * fix: add debug logging to oci transport
      * fix: legacy docker support broken for login
      * fix: plugin installer test with no Internet
      * Handle an empty registry config file.
      * Prevent fetching newReference again as we have in calling method
      * Prevent failure when resolving version tags in oras memory store
      * fix(client): skipnode utilization for PreCopy
      * test: Skip instead of returning early. looks more intentional
      * test: tests repo stripping functionality
      * test: include tests for Login based on different protocol prefixes
      * fix(client): layers now returns manifest - remove duplicate from descriptors
      * fix(client): return nil on non-allowed media types
      * Fix 3.18.0 regression: registry login with scheme
      * Update pkg/plugin/plugin.go
      * Wait for Helm v4 before raising when platformCommand and Command are set
      * Revert fix (helm) : toToml` renders int as float [ backport to v3 ]
      * build(deps): bump the k8s-io group with 7 updates
      * chore: update generalization warning message
      * fix: move warning to top of block
      * fix: govulncheck workflow
      * fix: replace fmt warning with slog
      * fix: add warning when ignore repo flag
      * feat: add httproute from gateway-api to create chart template

    - Update to version 3.18.6:
      * fix(helm-lint): fmt
      * fix(helm-lint): Add TLSClientConfig
      * fix(helm-lint): Add HTTP/HTTPS URL support for json schema         references

    - Update to version 3.18.5:
      * fix Chart.yaml handling 7799b48 (Matt Farina)
      * Handle messy index files dd8502f (Matt Farina)
      * json schema fix cb8595b (Robert Sirchia)

    - Fix shell completion dependencies
      * Add BuildRequires to prevent inclusion of folders owned by shells.
      * Add Requires because installing completions without appropriate         shell is questionable.

    - Fix zsh completion location

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20318-1 advisory.

    Changes in gitea-tea:

    - update to 0.12.0:
      * New Features
        - Add tea actions commands for managing workflow runs and           workflows in #880, #796
        - Add tea api subcommand for arbitrary API calls not covered by           existing commands in #879
        - Add repository webhook management commands in #798
        - Add JSON output support for single PR view in #864
        - Add JSON output and file redirection for issue detail view in           #841
        - Support creating AGit flow pull requests in #867
      * Bug Fixes
        - Fix authentication via environment variables when specifying           repo argument in #809
        - Fix issue detail view ignoring --owner flag in #899
        - Fix PR create crash in #823
        - Fix TTY prompt handling in #897
        - Fix termenv OSC RGBA handling in #907
        - Fix labels delete command and --id flag type in #865
        - Fix delete repo command description in #858
        - Fix pagination flags for secrets list, webhooks list, and           pull requests list in #853, #852,
        - #851
        - Enable git worktree support and improve PR create error           handling in #850
        - Only prompt for SSH passphrase when necessary in #844
        - Only prompt for login confirmation when no default login is           set in #839
        - Skip token uniqueness check when using SSH authentication in           #898
        - Require non-empty token in GetLoginByToken in #895
        - Fix config file permissions to remove group read/write in           #856
      * Improvements
        - Add file locking for safe concurrent access to config file in           #881
        - Improve error messages throughout the CLI in #871
        - Send consistent HTTP request headers in #888
        - Revert requiring HTTP/HTTPS login URLs; restore SSH as a           login method in #891
        - Refactor context into dedicated subpackages in #873, #888
        - General code cleanup and improvements in #869, #870
        - Add test coverage for login matching in #820
      * Build & Dependencies
        - Build with Go 1.25 in #886
        - Build for Windows aarch64
        - Update Gitea SDK version in #868
        - Update Nix flake in #872
        - Update dependencies including lipgloss v2, urfave/cli v3.6.2,           go-git v5.16.5, and various Go modules in #849, #875, #876,           #878, #884, #885, #900, #901, #904, #905
        - Update CI actions (checkout v6, setup-go v6) in #882, #883

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of ecs-init installed on the remote host is prior to 1.101.3-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2026-097 advisory.

    The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain     inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.
    (CVE-2025-47911)

    The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain     inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.
    (CVE-2025-58190)

    net/http: memory exhaustion in Request.ParseForm (CVE-2025-61726)

    archive/zip: denial of service when parsing arbitrary ZIP archives (CVE-2025-61728)

    crypto/tls: handshake messages may be processed at the incorrect encryption level (CVE-2025-61730)

    crypto/tls: Config.Clone copies automatically generated session ticket keys, session resumption does not     account for the expiration of full certificate chain (CVE-2025-68121)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0580-1 advisory.

    - CVE-2025-58190: Fixed a HTML parser misimplementation of a part of the HTML specification for table     related tags. (bsc#1258048).
    - CVE-2025-47911: Fixed an issue where the HTML parser takes a very long time or even never returns.
    (bsc#1258047).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1443 advisory.

    The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain     inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.
    (CVE-2025-47911)

    The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain     inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.
    (CVE-2025-58190)

    net/http: memory exhaustion in Request.ParseForm (CVE-2025-61726)

    archive/zip: denial of service when parsing arbitrary ZIP archives (CVE-2025-61728)

    crypto/tls: handshake messages may be processed at the incorrect encryption level (CVE-2025-61730)

    crypto/tls: Config.Clone copies automatically generated session ticket keys, session resumption does not     account for the expiration of full certificate chain (CVE-2025-68121)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20206-1 advisory.

    Update to version 0.11.3.

    Security issues fixed:

    - CVE-2025-47911: golang.org/x/net/html: quadratic complexity algorithms used when parsing untrusted HTML     documents       (bsc#1251427).
    - CVE-2025-58190: golang.org/x/net/html: excessive memory consumption by `html.ParseFragment` when     processing specially       crafted input (bsc#1251632).

    Other updates and bugfixes:

    - Version 0.11.2:
      * Fix: Fix node power metrics for Virtual Machines.
      * Fix: Resolve an issue with pod energy metrics when a container has no usage.

    - Version 0.11.1:
      * Fix: Added missing serviceaccount in the Helm chart.

    - Version 0.11.0:
      * Feature: Added support for platform power metrics (AC).
      * Feature: Introduced experimental support for trained power models.
      * Fix: Improved the accuracy of power estimation for Virtual Machines.
      * Breaking Change: Metrics related to `kepler_vm_` have been refactored.

    - Version 0.10.1:
      * Feature: Added support for the ARM64 architecture.
      * Fix: Addressed issues when running on Virtual Machines without RAPL.
      * Fix: Includes several other bug fixes and stability improvements.

    - Version 0.10.0:
      * Breaking Change: This is a major rewrite with significant architectural changes.
      * Breaking Change: Legacy versions (0.9.0 and earlier) are now frozen, with no new features or bug     fixes.
      * Breaking Change: The configuration format has been updated.
      * Breaking Change: The Kepler Model Server is not compatible with this version and above.
      * Feature: New modular architecture for better extensibility.
      * Feature: Enhanced performance and accuracy with dynamic detection of RAPL zones.
      * Feature: Reduced security requirements, no longer needing CAP_SYS_ADMIN or CAP_BPF capabilities.
      * Fix: Significantly reduced resource usage.

    - Version 0.9.0:
      * Note: This is the final legacy release.
      * Feature: Added support for GPU power monitoring.
      * Feature: Introduced a model server for training power models.

    - Version 0.8.2:
      * Fix: Addressed a bug in RAPL power calculation on multi-socket systems.

    - Version 0.8.1:
      * Fix: This version includes multiple bug fixes and stability improvements.

    - Version 0.8.0:
      * Feature: Introduced a new estimator framework.
      * Breaking Change: The API is backward incompatible with previous versions.

    - Version 0.7.12:
      * Fix: This version includes multiple bug fixes and stability improvements.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain     inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.
    (CVE-2025-58190)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20132-1 advisory.

    elemental-register was updated to 1.8.1:

    Changes on top of v1.8.1:

      * Update headers to 2026
      * Update questions to include SL Micro 6.2

    Update to v1.8.1:

      * Install yip config files in before-install step
      * Bump github.com/rancher-sandbox/go-tpm and its dependencies         This includes few CVE fixes:
        * bsc#1241826 (CVE-2025-22872)
        * bsc#1241857 (CVE-2025-22872)
        * bsc#1251511 (CVE-2025-47911)
        * bsc#1251679 (CVE-2025-58190)

    elemental-toolkit was updated to v2.3.2:

      * Bump golang.org/x/crypto library         This includes few CVE fixes:
        * bsc#1241826 (CVE-2025-22872)
        * bsc#1241857 (CVE-2025-22872)
        * bsc#1251511 (CVE-2025-47911)
        * bsc#1251679 (CVE-2025-58190)
        * bsc#1253581 (CVE-2025-47913)
        * bsc#1253901 (CVE-2025-58181)
        * bsc#1254079 (CVE-2025-47914)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20105-1 advisory.

    Changes in sbctl:

    - Upgrade the embedded golang.org/x/net to 0.46.0
      * Fixes: bsc#1251399, CVE-2025-47911: various algorithms with         quadratic complexity when parsing HTML documents
      * Fixes: bsc#1251609, CVE-2025-58190: excessive memory consumption         by 'html.ParseFragment' when processing specially crafted input

    - Update to version 0.18:
      * logging: fixup new go vet warning
      * workflows: add cc for cross compile
      * workflow: add sudo to apt
      * workflow: add pcsclite to ci
      * workflow: try enable cgo
      * go.mod: update golang.org/x/ dependencies
      * fix: avoid adding bogus Country attribute to subject DNs
      * sbctl: only store file if we did actually sign the file
      * installkernel: add post install hook for Debian's traditional installkernel
      * CI: missing libpcsclite pkg
      * workflows: add missing depends and new pattern keyword
      * Add yubikey example for create keys to the README
      * Initial yubikey backend keytype support
      * verify: ensure we pass args in correct order

    - bsc#1248949 (CVE-2025-58058):
      Bump xz to 0.5.14

    - Update to version 0.17:
      * Ensure we don't wrongly compare input/output files when signing
      * Added --json supprt to sbctl verify
      * Ensure sbctl setup with no arguments returns a helpful output
      * Import latest Microsoft keys for KEK and db databases
      * Ensure we print the path of the file when encountering an invalid PE file
      * Misc fixups in tests
      * Misc typo fixes in prints

    - Update to version 0.16:
      * Ensure sbctl reads --config even if /etc/sbctl/sbctl.conf is         present
      * Fixed a bug where sbctl would abort if the TPM eventlog         contains the same byte multiple times
      * Fixed a landlock bug where enroll-keys --export did not work
      * Fixed a bug where an ESP mounted to multiple paths would not be         detected
      * Exporting keys without efivars present work again
      * sbctl sign will now use the saved output path if the signed         file is enrolled
      * enroll-keys --append will now work without --force.
    - Updates from version 0.15.4:
      * Fixed an issue where sign-all did not report a non-zero exit         code when something failed
      * Fixed and issue where we couldn't write to a file with landlock
      * Fixed an issue where --json would print the human readable         output and the json
      * Fixes landlock for UKI/bundles by disabling the sandbox feature
      * Some doc fixups that mentioned /usr/share/

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20058-1 advisory.

    Changes in go-sendxmpp:

    - Update to 0.15.1:
      Added
      * Add XEP-0359 Origin-ID to messages (requires go-xmpp >= v0.2.18).
      Changed
      * HTTP upload: Ignore timeouts on disco IQs as some components do         not reply.
    - Upgrades the embedded golang.org/x/net to 0.46.0
      * Fixes: bsc#1251461, CVE-2025-47911: various algorithms with         quadratic complexity when parsing HTML documents
      * Fixes: bsc#1251677, CVE-2025-58190: excessive memory consumption         by 'html.ParseFragment' when processing specially crafted input

    - Update to 0.15.0:
      Added:
      * Add flag --verbose to show debug information.
      * Add flag --recipients to specify recipients by file.
      * Add flag --retry-connect to try after a waiting time if the connection fails.
      * Add flag --retry-connect-max to specify the amount of retry attempts.
      * Add flag --legacy-pgp for using XEP-0027 PGP encryption with Ox keys.
      * Add support for punycode domains.
      Changed:
      * Update gopenpgp library to v3.
      * Improve error detection for MUC joins.
      * Don't try to connect to other SRV record targets if error contains 'auth-failure'.
      * Remove support for old SSDP version (via go-xmpp v0.2.15).
      * Http-upload: Stop checking other disco items after finding upload component.
      * Increase default TLS version to 1.3.
    - bsc#1241814 (CVE-2025-22872): This update includes golang.org/x/net/html 0.43.0

    - Update to 0.14.1:
      * Use prettier date format for error messages.
      * Update XEP-0474 to version 0.4.0 (requires go-xmpp >= 0.2.10).

    - Update to 0.14.0:
      Added:
      * Add --fast-invalidate to allow invalidating the FAST token.
      Changed:
      * Don't create legacy Ox private key directory in ~/.local/share/go-sendxmpp/oxprivkeys.
      * Delete legacy Ox private key directory if it's empty.
      * Show proper error if saved FAST mechanism isn't usable with current TLS version (requires go-xmpp >=     0.2.9).
      * Print debug output to stdout, not stderr (requires go-xmpp >= 0.2.9).
      * Show RECV: and SEND: prefix for debug output (requires go-xmpp >= 0.2.9).
      * Delete stored fast token if --fast-invalidate and --fast-off are set.
      * Show error when FAST creds are stored but non-FAST mechanism is requested.

    - Update to 0.13.0:
      Added:
      * Add --anonymous to support anonymous authentication (requires go-xmpp >= 0.2.8).
      * Add XEP-0480: SASL Upgrade Tasks support (requires go-xmpp >= 0.2.8).
      * Add support for see-other-host stream error (requires go-xmpp >= 0.2.8).
      Changed:
      * Don't automatically try other auth mechanisms if FAST authentication fails.

    - Update to 0.12.1:
      Changed:
      * Print error instead of quitting if a message of type error is received.
      * Allow upload of multiple files.
      Added:
      * Add flag --suppress-root-warning to suppress the warning when go-sendxmpp is used by the root user.

    - Update to 0.12.0:
      Added:
      * Add possibility to look up direct TLS connection endpoint via hostmeta2 (requires xmppsrv >= 0.3.3).
      * Add flag --allow-plain to allow PLAIN authentication (requires go-xmpp >= 0.2.5).
      Changed:
      * Disable PLAIN authentication per default.
      * Disable PLAIN authentication after first use of a SCRAM auth mechanism (overrides --allow-plain)     (requires         go-xmpp >= 0.2.5).

    - Update to 0.11.4:
      * Fix bug in SCRAM-SHA-256-PLUS (via go-xmpp >= 0.2.4).

    - Update to 0.11.3:
      * Add go-xmpp library version to --version output (requires go-xmpp >= 0.2.2).
      * Fix XEP-0474: SASL SCRAM Downgrade Protection hash calculation bug (via go-xmpp >= v0.2.3).
      * [gocritic]: Improve code quality.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20044-1 advisory.

    Upgrade to version 1.12.1.


    Security issues fixed:

    - CVE-2025-47911: golang.org/x/net/html: quadratic complexity algorithms used when parsing untrusted HTML     documents       (bsc#1251509).
    - CVE-2025-58190: golang.org/x/net/html: excessive memory consumption by `html.ParseFragment` when     processing specially       crafted input (bsc#1251716).
    - CVE-2025-47913: golang.org/x/crypto: early client process termination when receiving an unexpected     message type in       response to a key listing or signing request (bsc#1253609).

    Other updates and bugfixes:

    - Version 1.12.1:
      * Bugfixes
        - update to Beyla 2.7.10.

    - Version 1.12.0:
      * Breaking changes
        - `prometheus.exporter.blackbox`, `prometheus.exporter.snmp` and `prometheus.exporter.statsd` now use     the component           ID instead of the hostname as their instance label in their exported metrics.
      * Features
        - (Experimental) Add an `otelcol.receiver.cloudflare` component to receive logs pushed by Cloudflare's     LogPush           jobs.
        - (Experimental) Additions to experimental `database_observability.mysql` component:
          - `explain_plans`
            - collector now changes schema before returning the connection to the pool.
            - collector now passes queries more permissively.
          - enable `explain_plans` collector by default
        - (Experimental) Additions to experimental `database_observability.postgres` component:
          - `explain_plans`
            - added the explain plan collector.
            - collector now passes queries more permissively.
          - `query_samples`
            - add user field to wait events within `query_samples` collector.
            - rework the query samples collector to buffer per-query execution state across scrapes and emit     finalized               entries.
            - process turned idle rows to calculate finalization times precisely and emit first seen idle     rows.
          - `query_details`
            - escape queries coming from `pg_stat_statements` with quotes.
          - enable `explain_plans` collector by default.
          - safely generate `server_id` when UDP socket used for database connection.
          - add table registry and include validated in parsed table name logs.
        - Add `otelcol.exporter.googlecloudpubsub` community component to export metrics, traces, and logs to     Google Cloud           Pub/Sub topic.
        - Add `structured_metadata_drop` stage for `loki.process` to filter structured metadata.
        - Send remote config status to the remote server for the `remotecfg` service.
        - Send effective config to the remote server for the `remotecfg` service.
        - Add a `stat_statements` configuration block to the `prometheus.exporter.postgres` component to     enable selecting           both the query ID and the full SQL statement. The new block includes one option to enable statement     selection,           and another to configure the maximum length of the statement text.
        - Add truncate stage for `loki.process` to truncate log entries, label values, and     `structured_metadata` values.
        - Add `u_probe_links` & `load_probe` configuration fields to alloy `pyroscope.ebpf` to extend     configuration of           the `opentelemetry-ebpf-profiler` to allow uprobe profiling and dynamic probing.
        - Add `verbose_mode` configuration fields to `alloy pyroscope.ebpf` to be enable `ebpf-profiler`     verbose mode.
        - Add `file_match` block to `loki.source.file` for built-in file discovery using glob patterns.
        - Add a regex argument to the `structured_metadata` stage in `loki.process` to extract labels matching     a regular           expression.
        - OpenTelemetry Collector dependencies upgraded from v0.134.0 to v0.139.0.
          - See the upstream             [core](https://github.com/open-telemetry/opentelemetry-collector/blob/v0.139.0/CHANGELOG.md)             and             [contrib](https://github.com/open-telemetry/opentelemetry-collector-     contrib/blob/v0.139.0/CHANGELOG.md)             changelogs for more details.
        - A new `mimir.alerts.kubernetes` component which discovers AlertmanagerConfig Kubernetes resources     and loads them           into a Mimir instance.
        - Mark `stage.windowsevent` block in the `loki.process` component as GA.
      * Enhancements
        - Add per-application rate limiting with the strategy attribute in the `faro.receiver` component, to     prevent one           application from consuming the rate limit quota of others.
        - Add support of tls in components `loki.source.(awsfirehose|gcplog|heroku|api)` and     `prometheus.receive_http` and           `pyroscope.receive_http`.
        - Remove `SendSIGKILL=no` from unit files and recommendations.
        - Reduce memory overhead of `prometheus.remote_write`'s WAL by lowering the size of the allocated     series storage.
        - Reduce lock wait/contention on the `labelstore.LabelStore` by removing unecessary usage from           `prometheus.relabel`.
        - `prometheus.exporter.postgres` dependency has been updated to v0.18.1.
        - Update Beyla component to 2.7.8.
        - Support delimiters in `stage.luhn`.
        - `pyroscope.java`: update `async-profiler` to 4.2.
        - `prometheus.exporter.unix`: Add an arp config block to configure the ARP collector.
        - `prometheus.exporter.snowflake` dependency has been updated to 20251016132346-6d442402afb2.
        - `loki.source.podlogs` now supports `preserve_discovered_labels` parameter to preserve discovered pod     metadata           labels for use by downstream components.
        - Rework underlying framework of Alloy UI to use Vite instead of Create React App.
        - Use POST requests for remote config requests to avoid hitting http2 header limits.
        - `loki.source.api` during component shutdown will now reject all the inflight requests with status     code 503 after           `graceful_shutdown_timeout` has expired.
        - `kubernetes.discovery`: Add support for attaching namespace metadata.
        - Add `meta_cache_address` to `beyla.ebpf` component.
      * Bugfixes
        - Stop `loki.source.kubernetes` discarding log lines with duplicate timestamps.
        - Fix direction of arrows for pyroscope components in UI graph.
        - Only log EOF errors for syslog port investigations in `loki.source.syslog` as Debug, not Warn.
        - Fix `prometheus.exporter.process` ignoring the `remove_empty_groups` argument.
        - Fix issues with unknown series ref when trying to add exemplar from `prometheus.remote_write` by     allowing           series ref links to be updated if they change.
        - Fix `loki.source.podlogs` component to register the Kubernetes field index for `spec.nodeName` when     node           filtering is enabled, preventing Index with name `field:spec.nodeName` does not exist errors.
        - Fix issue in `loki.source.file` where scheduling files could take too long.
        - Fix `loki.write` no longer includes internal labels __.
        - Fix missing native histograms custom buckets (NHCB) samples from `prometheus.remote_write`.
        - `otelcol.receiver.prometheus` now supports mixed histograms if `prometheus.scrape` has     `honor_metadata` set to           true.
        - `loki.source.file` has better support for non-UTF-8 encoded files.
        - Fix the `loki.write` endpoint block's `enable_http2` attribute to actually affect the client.
        - Optionally remove trailing newlines before appending entries in `stage.multiline`.
        - `loki.source.api` no longer drops request when relabel rules drops a specific stream.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-openSUSE-RU-2026:20010-1 advisory.

    - Update to version 0.68.2:
      * release: v0.68.2 [release/v0.68] (#9950)
      * fix(deps): bump alpine from `3.22.1` to `3.23.0` [backport: release/v0.68] (#9949)
      * ci: enable `check-latest` for `setup-go` [backport: release/v0.68] (#9946)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0028-1 advisory.

    Upgrade to version 1.12.1.

    Security issues fixed:

    - CVE-2025-47911: golang.org/x/net/html: quadratic complexity algorithms used when parsing untrusted HTML     documents       (bsc#1251509).
    - CVE-2025-47913: golang.org/x/crypto: early client process termination when receiving an unexpected     message type in       response to a key listing or signing request (bsc#1253609).
    - CVE-2025-58190: golang.org/x/net/html: excessive memory consumption by `html.ParseFragment` when     processing specially       crafted input (bsc#1251716).

    Other updates and bugfixes:

    - Version 1.12.1:
      * Bugfixes
        - update to Beyla 2.7.10.

    - Version 1.12.0:
      * Breaking changes
        - `prometheus.exporter.blackbox`, `prometheus.exporter.snmp` and `prometheus.exporter.statsd` now use     the component           ID instead of the hostname as their instance label in their exported metrics.
      * Features
        - (Experimental) Add an `otelcol.receiver.cloudflare` component to receive logs pushed by Cloudflare's     LogPush           jobs.
        - (Experimental) Additions to experimental `database_observability.mysql` component:
          - `explain_plans`
            - collector now changes schema before returning the connection to the pool.
            - collector now passes queries more permissively.
          - enable `explain_plans` collector by default
        - (Experimental) Additions to experimental `database_observability.postgres` component:
          - `explain_plans`
            - added the explain plan collector.
            - collector now passes queries more permissively.
          - `query_samples`
            - add user field to wait events within `query_samples` collector.
            - rework the query samples collector to buffer per-query execution state across scrapes and emit     finalized               entries.
            - process turned idle rows to calculate finalization times precisely and emit first seen idle     rows.
          - `query_details`
            - escape queries coming from `pg_stat_statements` with quotes.
          - enable `explain_plans` collector by default.
          - safely generate `server_id` when UDP socket used for database connection.
          - add table registry and include 'validated' in parsed table name logs.
        - Add `otelcol.exporter.googlecloudpubsub` community component to export metrics, traces, and logs to     Google Cloud           Pub/Sub topic.
        - Add `structured_metadata_drop` stage for `loki.process` to filter structured metadata.
        - Send remote config status to the remote server for the `remotecfg` service.
        - Send effective config to the remote server for the `remotecfg` service.
        - Add a `stat_statements` configuration block to the `prometheus.exporter.postgres` component to     enable selecting           both the query ID and the full SQL statement. The new block includes one option to enable statement     selection,           and another to configure the maximum length of the statement text.
        - Add truncate stage for `loki.process` to truncate log entries, label values, and     `structured_metadata` values.
        - Add `u_probe_links` & `load_probe` configuration fields to alloy `pyroscope.ebpf` to extend     configuration of           the `opentelemetry-ebpf-profiler` to allow uprobe profiling and dynamic probing.
        - Add `verbose_mode` configuration fields to `alloy pyroscope.ebpf` to be enable `ebpf-profiler`     verbose mode.
        - Add `file_match` block to `loki.source.file` for built-in file discovery using glob patterns.
        - Add a regex argument to the `structured_metadata` stage in `loki.process` to extract labels matching     a regular           expression.
        - OpenTelemetry Collector dependencies upgraded from v0.134.0 to v0.139.0.
          - See the upstream             [core](https://github.com/open-telemetry/opentelemetry-collector/blob/v0.139.0/CHANGELOG.md)             and             [contrib](https://github.com/open-telemetry/opentelemetry-collector-     contrib/blob/v0.139.0/CHANGELOG.md)             changelogs for more details.
        - A new `mimir.alerts.kubernetes` component which discovers AlertmanagerConfig Kubernetes resources     and loads them           into a Mimir instance.
        - Mark `stage.windowsevent` block in the `loki.process` component as GA.
      * Enhancements
        - Add per-application rate limiting with the strategy attribute in the `faro.receiver` component, to     prevent one           application from consuming the rate limit quota of others.
        - Add support of tls in components `loki.source.(awsfirehose|gcplog|heroku|api)` and     `prometheus.receive_http` and           `pyroscope.receive_http`.
        - Remove `SendSIGKILL=no` from unit files and recommendations.
        - Reduce memory overhead of `prometheus.remote_write`'s WAL by lowering the size of the allocated     series storage.
        - Reduce lock wait/contention on the `labelstore.LabelStore` by removing unecessary usage from           `prometheus.relabel`.
        - `prometheus.exporter.postgres` dependency has been updated to v0.18.1.
        - Update Beyla component to 2.7.8.
        - Support delimiters in `stage.luhn`.
        - `pyroscope.java`: update `async-profiler` to 4.2.
        - `prometheus.exporter.unix`: Add an arp config block to configure the ARP collector.
        - `prometheus.exporter.snowflake` dependency has been updated to 20251016132346-6d442402afb2.
        - `loki.source.podlogs` now supports `preserve_discovered_labels` parameter to preserve discovered pod     metadata           labels for use by downstream components.
        - Rework underlying framework of Alloy UI to use Vite instead of Create React App.
        - Use POST requests for remote config requests to avoid hitting http2 header limits.
        - `loki.source.api` during component shutdown will now reject all the inflight requests with status     code 503 after           `graceful_shutdown_timeout` has expired.
        - `kubernetes.discovery`: Add support for attaching namespace metadata.
        - Add `meta_cache_address` to `beyla.ebpf` component.
      * Bugfixes
        - Stop `loki.source.kubernetes` discarding log lines with duplicate timestamps.
        - Fix direction of arrows for pyroscope components in UI graph.
        - Only log EOF errors for syslog port investigations in `loki.source.syslog` as Debug, not Warn.
        - Fix `prometheus.exporter.process` ignoring the `remove_empty_groups` argument.
        - Fix issues with 'unknown series ref when trying to add exemplar' from `prometheus.remote_write` by     allowing           series ref links to be updated if they change.
        - Fix `loki.source.podlogs` component to register the Kubernetes field index for `spec.nodeName` when     node           filtering is enabled, preventing 'Index with name `field:spec.nodeName` does not exist' errors.
        - Fix issue in `loki.source.file` where scheduling files could take too long.
        - Fix `loki.write` no longer includes internal labels __.
        - Fix missing native histograms custom buckets (NHCB) samples from `prometheus.remote_write`.
        - `otelcol.receiver.prometheus` now supports mixed histograms if `prometheus.scrape` has     `honor_metadata` set to           true.
        - `loki.source.file` has better support for non-UTF-8 encoded files.
        - Fix the `loki.write` endpoint block's `enable_http2` attribute to actually affect the client.
        - Optionally remove trailing newlines before appending entries in `stage.multiline`.
        - `loki.source.api` no longer drops request when relabel rules drops a specific stream.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4482-1 advisory.

    grafana was updated from version 11.5.5 to 11.5.10:

    - Security issues fixed:

      * CVE-2025-64751: Dropped experimental implementation of authorization Zanzana server/client (version     11.5.10)         (bsc#1254113)
      * CVE-2025-47911: Fixed parsing HTML documents (version 11.5.10) (bsc#1251454)
      * CVE-2025-58190: Fixed excessive memory consumption (version 11.5.10) (bsc#1251657)
      * CVE-2025-11065: Fixed sensitive information leak in logs (version 11.5.9) (bsc#1250616)
      * CVE-2025-6023: Fixed cross-site-scripting via scripted dashboards (version 11.5.7) (bsc#1246735)
      * CVE-2025-6197: Fixed open redirect in organization switching (version 11.5.7) (bsc#1246736)
      * CVE-2025-3415: Fixed exposure of DingDing alerting integration URL to Viewer level users (version     11.5.6)                        (bsc#1245302)


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4479-1 advisory.

    release-notes-susemanager:

    - Update to SUSE Manager 4.3.16.2
      * SUSE Linux Enterprise Server 15 SP6 LTSS channels enabled
      * CVEs Fixed:
        CVE-2025-11065, CVE-2025-64751, CCVE-2025-47911, CVE-2025-58190         CVE-2025-62349, CVE-2025-62348
      * Bugs mentioned:
        bsc#1237060, bsc#1241455, bsc#1250911, bsc#1251864, bsc#1253024

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2025:20160-1 advisory.

    - Update to version 1.3.1 (bsc#1251516, CVE-2025-47911,       bsc#1251891, CVE-2025-11579, bsc#1251651, CVE-2025-58190,       bsc#1248937, CVE-2025-58058):
      * bump github.com/containerd/containerd (#474)
      * another fix to tests for new tests (#472)
      * fixed typo in testdata (#471)
      * fixed/cleaned new tests (#470)
      * trying a new way for hauler testing (#467)
      * update for cosign v3 verify (#469)
      * added digests view to info (#465)
      * bump github.com/nwaples/rardecode/v2 from 2.1.1 to 2.2.0 in the go_modules group across 1 directory     (#457)
      * update oras-go to v1.2.7 for security patches (#464)
      * update cosign to v3.0.2+hauler.1 (#463)
      * fixed homebrew directory deprecation (#462)
      * add registry logout command (#460)

    - Update to version 1.3.0:
      * bump the go_modules group across 1 directory with 2 updates (#455)
      * upgraded versions/dependencies/deprecations (#454)
      * allow loading of docker tarballs (#452)
      * bump the go_modules group across 1 directory with 2 updates (#449)

    - update to 1.2.5 (bsc#1246722, CVE-2025-46569):
      * Bump github.com/open-policy-agent/opa from 1.1.0 to 1.4.0 in         the go_modules group across 1 directory (CVE-2025-46569)
      * deprecate auth from hauler store copy
      * Bump github.com/cloudflare/circl from 1.3.7 to 1.6.1 in the         go_modules group across 1 directory
      * Bump github.com/go-viper/mapstructure/v2 from 2.2.1 to 2.3.0         in the go_modules group across 1 directory
      * upgraded go and dependencies versions

    - Update to version 1.2.5:
      * upgraded go and dependencies versions (#444)
      * Bump github.com/go-viper/mapstructure/v2 (#442)
      * bump github.com/cloudflare/circl (#441)
      * deprecate auth from hauler store copy (#440)
      * Bump github.com/open-policy-agent/opa (#438)

    - update to 1.2.4 (CVE-2025-22872, bsc#1241804):
      * Bump golang.org/x/net from 0.37.0 to 0.38.0 in the go_modules         group across 1 directory
      * minor tests updates

    - Update to version 1.2.3:
      * formatting and flag text updates
      * add keyless signature verification (#434)
      * bump helm.sh/helm/v3 in the go_modules group across 1 directory (#430)
      * add --only flag to hauler store copy (for images) (#429)
      * fix tlog verification error/warning output (#428)

    - Update to version 1.2.2 (bsc#1241184, CVE-2024-0406):
      * cleanup new tlog flag typos and add shorthand (#426)
      * default public transparency log verification to false to be airgap friendly but allow override (#425)
      * bump github.com/golang-jwt/jwt/v4 (#423)
      * bump the go_modules group across 1 directory with 2 updates (#422)
      * bump github.com/go-jose/go-jose/v3 (#417)
      * bump github.com/go-jose/go-jose/v4 (#415)
      * clear default manifest name if product flag used with sync (#412)
      * updates for v1.2.0 (#408)
      * fixed remote code (#407)
      * added remote file fetch to load (#406)
      * added remote and multiple file fetch to sync (#405)
      * updated save flag and related logs (#404)
      * updated load flag and related logs [breaking change] (#403)
      * updated sync flag and related logs [breaking change] (#402)
      * upgraded api update to v1/updated dependencies (#400)
      * fixed consts for oci declarations (#398)
      * fix for correctly grabbing platform post cosign 2.4 updates (#393)
      * use cosign v2.4.1+carbide.2 to address containerd annotation in index.json (#390)
      * Bump the go_modules group across 1 directory with 2 updates (#385)
      * replace mholt/archiver with mholt/archives (#384)
      * forked cosign bump to 2.4.1 and use as a library vs embedded binary (#383)
      * cleaned up registry and improved logging (#378)
      * Bump golang.org/x/crypto in the go_modules group across 1 directory (#377)
    - bump net/html dependencies (bsc#1235332, CVE-2024-45338)

    - Update to version 1.1.1:
      * fixed cli desc for store env var (#374)
      * updated versions for go/k8s/helm (#373)
      * updated version flag to internal/flags (#369)
      * renamed incorrectly named consts (#371)
      * added store env var (#370)
      * adding ignore errors and retries for continue on error/fail on error (#368)
      * updated/fixed hauler directory (#354)
      * standardize consts (#353)
      * removed cachedir code (#355)
      * removed k3s code (#352)
      * updated dependencies for go, helm, and k8s (#351)
      * [feature] build with boring crypto where available (#344)
      * updated workflow to goreleaser builds (#341)
      * added timeout to goreleaser workflow (#340)
      * trying new workflow build processes (#337)
      * improved workflow performance (#336)
      * have extract use proper ref (#335)
      * yet another workflow goreleaser fix (#334)
      * even more workflow fixes (#333)
      * added more fixes to github workflow (#332)
      * fixed typo in hauler store save (#331)
      * updates to fix build processes (#330)
      * added integration tests for non hauler tarballs (#325)
      * bump: golang >= 1.23.1 (#328)
      * add platform flag to store save (#329)
      * Update feature_request.md
      * updated/standardize command descriptions (#313)
      * use new annotation for 'store save' manifest.json (#324)
      * enable docker load for hauler tarballs (#320)
      * bump to cosign v2.2.3-carbide.3 for new annotation (#322)
      * continue on error when adding images to store (#317)
      * Update README.md (#318)
      * fixed completion commands (#312)
      * github.com/rancherfederal/hauler => hauler.dev/go/hauler (#311)
      * pages: enable go install hauler.dev/go/hauler (#310)
      * Create CNAME
      * pages: initial workflow (#309)
      * testing and linting updates (#305)
      * feat-273: TLS Flags (#303)
      * added list-repos flag (#298)
      * fixed hauler login typo (#299)
      * updated cobra function for shell completion (#304)
      * updated install.sh to remove github api (#293)
      * fix image ref keys getting squashed when containing sigs/atts (#291)
      * fix missing versin info in release build (#283)
      * bump github.com/docker/docker in the go_modules group across 1 directory (#281)
      * updated install script (`install.sh`) (#280)
      * fix digest images being lost on load of hauls (Signed). (#259)
      * feat: add readonly flag (#277)
      * fixed makefile for goreleaser v2 changes (#278)
      * updated goreleaser versioning defaults (#279)
      * update feature_request.md (#274)
      * updated old references
      * updated actions workflow user
      * added dockerhub to github actions workflow
      * removed helm chart
      * added debug container and workflow
      * updated products flag description
      * updated chart for release
      * fixed workflow errors/warnings
      * fixed permissions on testdata
      * updated chart versions (will need to update again)
      * last bit of fixes to workflow
      * updated unit test workflow
      * updated goreleaser deprecations
      * added helm chart release job
      * updated github template names
      * updated imports (and go fmt)
      * formatted gitignore to match dockerignore
      * formatted all code (go fmt)
      * updated chart tests for new features
      * Adding the timeout flag for fileserver command
      * Configure chart commands to use helm clients for OCI and private registry support
      * Added some documentation text to sync command
      * Bump golang.org/x/net from 0.17.0 to 0.23.0
      * fix for dup digest smashing in cosign
      * removed vagrant scripts
      * last bit of updates and formatting of chart
      * updated hauler testdata
      * adding functionality and cleaning up
      * added initial helm chart
      * removed tag in release workflow
      * updated/fixed image ref in release workflow
      * updated/fixed platforms in release workflow
      * updated/cleaned github actions (#222)
      * Make Product Registry configurable (#194)
      * updated fileserver directory name (#219)
      * fix logging for files
      * add extra info for the tempdir override flag
      * tempdir override flag for load
      * deprecate the cache flag instead of remove
      * switch to using bci-golang as builder image
      * fix: ensure /tmp for hauler store load
      * added the copy back for now
      * remove copy at the image sync not needed with cosign update
      * removed misleading cache flag
      * better logging when adding to store
      * update to v2.2.3 of our cosign fork
      * add: dockerignore
      * add: Dockerfile
      * Bump google.golang.org/protobuf from 1.31.0 to 1.33.0
      * Bump github.com/docker/docker
      * updated and added new logos
      * updated github files

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2025-20143-1 advisory.

    Changes in git-bug:

    - Revendor to include fixed version of depending libraries:
      - GO-2025-4116 (CVE-2025-47913, bsc#1253506) upgrade         golang.org/x/crypto to v0.43.0
      - GO-2025-3900 (GHSA-2464-8j7c-4cjm) upgrade         github.com/go-viper/mapstructure/v2 to v2.4.0
      - GO-2025-3787 (GHSA-fv92-fjc5-jj9h) included in the previous
      - GO-2025-3754 (GHSA-2x5j-vhc8-9cwm) upgrade         github.com/cloudflare/circl to v1.6.1
      - GO-2025-4134 (CVE-2025-58181, bsc#1253930) upgrade         golang.org/x/crypto/ssh to v0.45.0
      - GO-2025-4135 (CVE-2025-47914, bsc#1254084) upgrade         golang.org/x/crypto/ssh/agent to v0.45.0

    - Revendor to include golang.org/x/net/html v 0.45.0 to prevent       possible DoS by various algorithms with quadratic complexity       when parsing HTML documents (bsc#1251463, CVE-2025-47911 and       bsc#1251664, CVE-2025-58190).

    Update to version 0.10.1:

      - cli: ignore missing sections when removing configuration (ddb22a2f)

    Update to version 0.10.0:

      - bridge: correct command used to create a new bridge (9942337b)
      - web: simplify header navigation (7e95b169)
      - webui: remark upgrade + gfm + syntax highlighting (6ee47b96)
      - BREAKING CHANGE: dev-infra: remove gokart (89b880bd)

    Update to version 0.10.0:

      - bridge: correct command used to create a new bridge (9942337b)
      - web: simplify header navigation (7e95b169)
      - web: remark upgrade + gfm + syntax highlighting (6ee47b96)

    Update to version 0.9.0:

      - completion: remove errata from string literal (aa102c91)
      - tui: improve readability of the help bar (23be684a)

    Update to version 0.8.1+git.1746484874.96c7a111:

      * docs: update install, contrib, and usage documentation (#1222)
      * fix: resolve the remote URI using url.*.insteadOf (#1394)
      * build(deps): bump the go_modules group across 1 directory with 3 updates (#1376)
      * chore: gofmt simplify gitlab/export_test.go (#1392)
      * fix: checkout repo before setting up go environment (#1390)
      * feat: bump to go v1.24.2 (#1389)
      * chore: update golang.org/x/net (#1379)
      * fix: use -0700 when formatting time (#1388)
      * fix: use correct url for gitlab PATs (#1384)
      * refactor: remove depdendency on pnpm for auto-label action (#1383)
      * feat: add action: auto-label (#1380)
      * feat: remove lifecycle/frozen (#1377)
      * build(deps): bump the npm_and_yarn group across 1 directory with 12 updates (#1378)
      * feat: support new exclusion label: lifecycle/pinned (#1375)
      * fix: refactor how gitlab title changes are detected (#1370)
      * revert: Create Dependabot config file (#1374)
      * refactor: rename //:git-bug.go to //:main.go (#1373)
      * build(deps): bump github.com/vektah/gqlparser/v2 from 2.5.16 to 2.5.25 (#1361)
      * fix: set GitLastTag to an empty string when git-describe errors (#1355)
      * chore: update go-git to v5@masterupdate_mods (#1284)
      * refactor: Directly swap two variables to optimize code (#1272)
      * Update README.md Matrix link to new room (#1275)

    - Update to version 0.8.0+git.1742269202.0ab94c9:
      * deps(crypto): bump golang.org/x/crypto from v0.26.0 to v0.31.0 (fix for CVE-2024-45337) (#1312)

    - Update golang.org/x/crypto/ssh to v0.35.0 (bsc#1239494,       CVE-2025-22869).

    - Add missing Requires to completion subpackages.

    Update to version 0.8.0+git.1733745604.d499b6e:

      * fix typos in docs (#1266)
      * build(deps): bump github.com/go-git/go-billy/v5 from 5.5.0 to 5.6.0 (#1289)

    - bump golang.org/x/crypto from v0.26.0 to v0.31.0 (fix for CVE-2024-45337, bsc#1234565).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2025-20118-1 advisory.

    Changes in gitea-tea:

    - update to 0.11.1:
      * 61d4e57 Fix Pr Create crash (#823)
      * 4f33146 add test for matching logins (#820)
      * 08b8398 Update README.md (#819)

    - CVE-2025-58190: golang.org/x/net/html: excessive memory consumption by `html.ParseFragment` when     processing specially crafted input (boo#1251663)
    - CVE-2025-47911: golang.org/x/net/html: various algorithms with quadratic complexity when parsing HTML     documents (boo#1251471)

    - update to 0.11.0:
      * Fix yaml output single quote (#814)
      * generate man page (#811)
      * feat: add validation for object-format flag in repo create         command (#741)
      * Fix release version (#815)
      * update gitea sdk to v0.22 (#813)
      * don't fallback login directly (#806)
      * Check duplicated login name in interact mode when creating new         login (#803)
      * Fix bug when output json with special chars (#801)
      * add debug mode and update readme (#805)
      * update go.mod to retract the wrong tag v1.3.3 (#802)
      * revert completion scripts removal (#808)
      * Remove pagination from context (#807)
      * Continue auth when failed to open browser (#794)
      * Fix bug (#793)
      * Fix tea login add with ssh public key bug (#789)
      * Add temporary authentication via environment variables (#639)
      * Fix attachment size (#787)
      * deploy image when tagging (#792)
      * Add Zip URL for release list (#788)
      * Use bubbletea instead of survey for interacting with TUI (#786)
      * capitalize a few items
      * rm out of date comparison file
      * README: Document logging in to gitea (#790)
      * remove autocomplete command (#782)
      * chore(deps): update ghcr.io/devcontainers/features/git-lfs         docker tag to v1.2.5 (#773)
      * replace arch package url (#783)
      * fix: Reenable -p and --limit switches (#778)

    - Update to 0.10.1+git.1757695903.cc20b52:
      - feat: add validation for object-format flag in repo create         command (see gh#openSUSE/openSUSE-git#60)
      - Fix release version
      - update gitea sdk to v0.22
      - don't fallback login directly
      - Check duplicated login name in interact mode when creating         new login
      - Fix bug when output json with special chars
      - add debug mode and update readme
      - update go.mod to retract the wrong tag v1.3.3
      - revert completion scripts removal
      - Remove pagination from context
      - Continue auth when failed to open browser
      - Fix bug
      - Fix tea login add with ssh public key bug
      - Add temporary authentication via environment variables
      - Fix attachment size
      - deploy image when tagging
      - Add Zip URL for release list
      - Use bubbletea instead of survey for interacting with TUI
      - capitalize a few items
      - rm out of date comparison file
      - README: Document logging in to gitea
      - remove autocomplete command
      - chore(deps): update ghcr.io/devcontainers/features/git-lfs         docker tag to v1.2.5
      - replace arch package url
      - fix: Reenable `-p` and `--limit` switches

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4190-1 advisory.

    - Update to version 3.19.1
    - CVE-2025-53547: Fixed local code execution in Helm Chart. (bsc#1246152)
    - CVE-2025-58190: Fixed excessive memory consumption by `html.ParseFragment` when processing specially     crafted input. (bsc#1251649)
    - CVE-2025-47911: Fixed various algorithms with quadratic complexity when parsing HTML documents.
    (bsc#1251442)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
302214	Ubuntu 22.04 LTS / 24.04 LTS : Go Networking vulnerabilities (USN-8089-1)	Nessus	Ubuntu Local Security Checks	medium
301475	openSUSE 16 Security Update : helm (openSUSE-SU-2026:20327-1)	Nessus	SuSE Local Security Checks	medium
301310	openSUSE 16 Security Update : gitea-tea (openSUSE-SU-2026:20318-1)	Nessus	SuSE Local Security Checks	medium
301253	Amazon Linux 2 : ecs-init, --advisory ALAS2ECS-2026-097 (ALASECS-2026-097)	Nessus	Amazon Linux Local Security Checks	critical
299656	SUSE SLES15 / openSUSE 15 Security Update : apptainer (SUSE-SU-2026:0580-1)	Nessus	SuSE Local Security Checks	medium
299551	Amazon Linux 2023 : ecs-init (ALAS2023-2026-1443)	Nessus	Amazon Linux Local Security Checks	critical
299127	openSUSE 16 Security Update : kepler (openSUSE-SU-2026:20206-1)	Nessus	SuSE Local Security Checks	medium
298280	Linux Distros Unpatched Vulnerability : CVE-2025-58190	Nessus	Misc.	medium
297788	openSUSE 16 Security Update : elemental-register, elemental-toolkit (openSUSE-SU-2026:20132-1)	Nessus	SuSE Local Security Checks	medium
296569	openSUSE 16 Security Update : sbctl (openSUSE-SU-2026:20105-1)	Nessus	SuSE Local Security Checks	medium
291338	openSUSE 16 Security Update : go-sendxmpp (openSUSE-SU-2026:20058-1)	Nessus	SuSE Local Security Checks	medium
291311	openSUSE 16 Security Update : alloy (openSUSE-SU-2026:20044-1)	Nessus	SuSE Local Security Checks	medium
282650	openSUSE 16 : Recommended update for trivy (SUSE-SU-openSUSE-RU-2026:20010-1)	Nessus	SuSE Local Security Checks	medium
281835	SUSE SLED15 / SLES15 Security Update : alloy (SUSE-SU-2026:0028-1)	Nessus	SuSE Local Security Checks	medium
279356	SUSE SLES15 / openSUSE 15 Security Update : grafana (SUSE-SU-2025:4482-1)	Nessus	SuSE Local Security Checks	medium
279354	SUSE SLES15 : Security update 4.3.16.2 for Multi-Linux Manager Server LTS (SUSE-SU-2025:4479-1)	Nessus	SuSE Local Security Checks	high
278653	openSUSE 16 Security Update : hauler (openSUSE-SU-2025:20160-1)	Nessus	SuSE Local Security Checks	high
277676	openSUSE 16 Security Update : git-bug (openSUSE-SU-2025-20143-1)	Nessus	SuSE Local Security Checks	medium
277014	openSUSE 16 Security Update : gitea-tea (openSUSE-SU-2025-20118-1)	Nessus	SuSE Local Security Checks	medium
276786	SUSE SLES15 / openSUSE 15 Security Update : helm (SUSE-SU-2025:4190-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2025-58190

medium

Tenable Plugins

medium

medium

medium

critical

medium

critical

medium

medium

medium

medium

medium

medium

medium

medium

medium

high

high

medium

medium

high