An Open Redirect vulnerability in the go-chi/chi >=5.2.2 RedirectSlashes function allows remote attackers to redirect victim users to malicious websites using the legitimate website domain.

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2830-1 advisory.

    Update to v4.7.0.

    Security issues fixed:

    - CVE-2025-69725: incorrect input validation in the `RedirectSlashes` function can lead to an open     redirect       (bsc#1258511).
    - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad     `SETTINGS_MAX_FRAME_SIZE`       can lead to a denial of service (bsc#1265653).
    - CVE-2026-34986: github.com/go-jose/go-jose/v4: crafted JWE input with a missing encrypted key can lead     to a denial of       service (bsc#1262810).
    - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for     validation       bypass and privilege escalation (bsc#1266483).

    Other updates and bugfixes:

    - Add correct flag `--update-overlays` fix (bsc#1268790).
    - v4.7.0:
      * New `wwctl` unset command
      * Refactored server routes (URLs)
      * New `/files/` route for serving individual files and templates
      * Server TLS support
      * Removed support for fetching individual overlays and individual files from overlays
      * Fixed whitespace handling around template functions
      * Security fixes, including updated Go and library versions
    - v4.6.5:
      * New wwctl overlay info command
      * Fixed `wwctl` image import `--update` option
      * Cross-arch support for `wwclient`
      * Improved IPv6 support
      * Improved support for bonded interfaces
      * Renamed `debian.interfaces` overlay to `ifupdown`
      * New `systemd-networkd` overlay
      * `warewulf-dracut` fixes, including `provision-to-disk` fixes
    - Remove `slurm-overlay` package.
    - Fix `wwctl` image import `--update` option (bsc#1254470).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-950cac64f2 advisory.

    Security update resolving 17 CVEs across both caddy itself and its vendored libraries.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-3dc324bd9a advisory.

    Security update resolving 22 CVEs across both caddy itself and its vendored libraries.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-2bb2aee489 advisory.

    Update to 1.74.0


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20702-1 advisory.

    Changes in trivy:

    - Update to version 0.70.0 (          bsc#1260193, CVE-2026-33186,          bsc#1260971, CVE-2026-33747,          bsc#1261052, CVE-2026-33748,          bsc#1262389, CVE-2026-39984,          bsc#1262893, CVE-2026-34986):
      * release: v0.70.0 [main] (#10105)
      * chore(deps): bump go.opentelemetry.io/otel/sdk from 1.42.0 to 1.43.0 (#10496)
      * chore(deps): bump github.com/sigstore/timestamp-authority/v2 from 2.0.3 to 2.0.6 (#10526)
      * chore(deps): bump the common group across 1 directory with 8 updates (#10540)
      * chore(deps): bump the docker group across 1 directory with 2 updates (#10538)
      * fix: use Development category for GoReleaser discussions (#10530)
      * chore(deps): bump testcontainers-go to v0.42.0 (#10531)
      * chore: update CODEOWNERS (#10529)
      * chore(deps): bump helm.sh/helm/v3 from 3.20.1 to 3.20.2 (#10511)
      * chore(deps): bump github.com/hashicorp/go-getter from 1.8.5 to 1.8.6 (#10510)
      * chore(deps): bump github.com/moby/buildkit from 0.27.1 to 0.28.1 (#10449)
      * ci: migrate from mkdocs-material-insiders to mkdocs-material (#10509)
      * chore: remove aquasecurity/homebrew-trivy tap from GoReleaser (#10508)
      * ci: update runners for workflows that interact with GitHub API (#10502)
      * ci: rename tokens and update runners (#10500)
      * ci: trigger helm chart publishing via helm-charts workflow (#10474)
      * ci: remove ruleset update step from release-please workflow (#10499)
      * ci: use large runner and replace ORG_REPO_TOKEN in release-please workflow (#10498)
      * ci: trigger rpm/deb deployment via trivy-repo workflow (#10476)
      * fix: remove os.Stdout from wazero module config (#10403)
      * chore(deps): bump the common group across 1 directory with 22 updates (#10408)
      * chore(deps): bump google.golang.org/grpc from 1.78.0 to 1.79.3 (#10407)
      * fix(flag): validate template file extension (#10296)
      * fix(sbom): preserve Red Hat BuildInfo when scanning SBOMs without layer info (#10378)
      * fix: handle Go 1.26 GOEXPERIMENT version format change (#10351)
      * fix(python): handle multiple version specifiers in requirements.txt (#10361)
      * ci: run Trivy version bump in trivy-action (#10272)
      * fix(python): nil pointer dereference with optional poetry groups without dependencies (#10359)
      * ci: replace personal email with github-actions[bot] in workflows (#10369)
      * chore: replace smithy epoch parsing with stdlib time.Unix (#10286)
      * test: update golden files for purl changes (#10372)
      * ci: add zizmor to scan GitHub Actions workflows (#10322)
      * refactor: log statuses as strings (#10285)
      * ci: add build provenance attestations for release artifacts (#10316)
      * fix(sbom): add NOASSERTION for licenseDeclared/licenseConcluded in SPDX non-library packages (#10368)
      * fix(report): set correct sarif ROOTPATH uri when scanning a git repository (#10366)
      * perf(plugin): optimize directory traversal by replacing filepath.Walk with filepath.WalkDir (#10325)
      * docs: correct typos in CHANGELOG and diagram (#10320)
      * chore: delete roadmap wf (#10295)
      * ci(helm): bump Trivy version to 0.69.3 for Trivy Helm Chart 0.21.3 (#10310)
      * fix(cyclonedx): include CVSS v4 vulnerability ratings (#10313)
      * fix: detected vulnerability fields in azure and mariner detector (#10275)
      * ci: add persist-credentials: false to checkout steps (#10306)
      * ci(helm): bump Trivy version to 0.69.2 for Trivy Helm Chart 0.21.2 (#10270)
      * chore(deps): bump the common group across 1 directory with 8 updates (#10248)
      * chore(deps): bump go.opentelemetry.io/otel/sdk from 1.39.0 to 1.40.0 (#10257)
      * chore(deps): bump the aws group across 1 directory with 6 updates (#10249)
      * chore(deps): bump github.com/cloudflare/circl from 1.6.1 to 1.6.3 (#10241)
      * ci: remove apidiff workflow (#10259)
      * chore(deps): bump github.com/docker/cli from 29.1.4+incompatible to 29.2.1+incompatible in the docker     group across 1 directory (#10221)
      * ci: bump golangci-lint to v2.10 in cache-test-assets (#10243)
      * feat(java): add support for proxy configuration from Maven settings.xml (#10187)
      * chore(deps): bump the github-actions group across 3 directories with 11 updates (#10242)
      * feat(python): add pylock.toml support (#10137)
      * chore: bump SPDX license IDs and exceptions to `v3.28.0` (#10233)
      * docs: fix typos and upgrade insecure HTTP links to HTTPS (#10219)
      * chore: bump golangci-lint to v2.10.0 (#10223)
      * feat(misconf): support for azurerm_network_interface_security_group_association  (#10215)
      * ci: pin Docker Engine to v29 for integration tests (#10232)
      * feat(go): detect version from ELF symbol table for binaries built with -trimpath (#10197)
      * docs: migrate private registry documentation from GCR to GAR (#10208)
      * chore(deps): bump the common group across 1 directory with 24 updates (#10206)
      * chore(deps): update Docker client SDK to v29 (#10202)
      * test: update Docker Engine integration tests for Docker API v0.29.0+ compatibility (#10199)
      * fix(misconf): initialize custom annotation field if empty (#10123)
      * feat(ubuntu): add eol data for 25.10 (#10181)
      * docs: fix incorrect count of Python package managers (#10175)
      * chore(deps): bump github.com/go-git/go-git/v5 from 5.16.4 to 5.16.5 (#10179)
      * feat(misconf): resolve Azure resources via resource_id (#10173)
      * ci(helm): bump Trivy version to 0.69.1 for Trivy Helm Chart 0.21.1 (#10155)
      * refactor: remove unused Insecure field from ServiceOption (#10113)
      * refactor: reduce complexity of init in detect.go (#10163)
      * feat(misconf): adapt ARM k8s clusters (#9696) (#10125)
      * docs: update version endpoint example in client/server documentation (#10151)
      * feat(vuln): skip third-party packages in common Detect function (#10129)
      * ci: add composite action for Go setup (#10146)
      * fix(misconf): apply check aliases when filtering results via .trivyignore (#10112)
      * docs(terraform): add limitation for data sources and computed resource attributes (#10128)
      * fix: update PhotonOS feed URL (#10122)
      * feat(server): include server version info in JSON output for client/server mode (#10075)
      * chore(deps): bump to alpine:3.23.3 and go-1.25.6 to fix CVEs (#10107)
      * refactor: unify scanner error limit and compiler limit (#10106)
      * ci(helm): bump Trivy version to 0.69.0 for Trivy Helm Chart 0.21.0 (#10103)
      * fix(java): Disable overwriting exclusions (#10088)
      * refactor(rust): use txtar format for cargo analyzer test data (#10104)
      * feat(python): add pylock.toml (PEP 751) parser (#9632)
      * chore(deps): bump the aws group across 1 directory with 6 updates (#10068)
      * fix(server): exclude JavaDB and CheckBundle from /version endpoint (#10100)

    - Update to version 0.69.3 (CVE-2026-25934, bsc#1258094):
      * release: v0.69.3 [release/v0.69] (#10293)
      * fix(deps): bump github.com/go-git/go-git/v5 from 5.16.4 to 5.16.5 [backport: release/v0.69] (#10291)
      * release: v0.69.2 [release/v0.69] (#10266)
      * fix(deps): bump go.opentelemetry.io/otel/sdk from 1.39.0 to 1.40.0 [backport: release/v0.69] (#10267)
      * fix(deps): bump github.com/cloudflare/circl from 1.6.1 to 1.6.3 [backport: release/v0.69] (#10264)
      * ci: remove apidiff workflow
      * release: v0.69.1 [release/v0.69] (#10145)
      * ci: add composite action for Go setup [backport: release/v0.69] (#10150)
      * fix(misconf): apply check aliases when filtering results via .trivyignore [backport: release/v0.69]     (#10143)
      * chore(deps): bump to alpine:3.23.3 and go-1.25.6 to fix CVEs [backport: release/v0.69] (#10135)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-094b7621cf advisory.

    Remove incus dependency from incus-agent.

    ----

    Update to [6.23](https://github.com/lxc/incus/releases/tag/v6.23.0)




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-4481307278 advisory.

    Remove incus dependency from incus-agent.

    ----

    Update to [6.23](https://github.com/lxc/incus/releases/tag/v6.23.0)



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-868e266938 advisory.

    Update to 0.69.3

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-de52e7caa1 advisory.

    Update to 2.87.3

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An Open Redirect vulnerability in the go-chi/chi >=5.2.2 RedirectSlashes function allows remote attackers     to redirect victim users to malicious websites using the legitimate website domain. (CVE-2025-69725)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - An Open Redirect vulnerability in the go-chi/chi >=5.2.2 RedirectSlashes function allows remote attackers
    to redirect victim users to malicious websites using the legitimate website domain. (CVE-2025-69725)

ID	Name	Product	Family	Severity
326327	SUSE SLES15: warewulf4 / warewulf4-dracut / warewulf4-man / warewulf4-overlay / etc (SUSE-SU-2026:2830-1)	Nessus	SuSE Local Security Checks	high
324621	Fedora 44 : caddy (2026-950cac64f2)	Nessus	Fedora Local Security Checks	critical
324614	Fedora 43 : caddy (2026-3dc324bd9a)	Nessus	Fedora Local Security Checks	critical
313735	Fedora 43 : rclone (2026-2bb2aee489)	Nessus	Fedora Local Security Checks	critical
313632	openSUSE 16 Security Update : trivy (openSUSE-SU-2026:20702-1)	Nessus	SuSE Local Security Checks	high
307511	Fedora 43 : incus (2026-094b7621cf)	Nessus	Fedora Local Security Checks	high
307510	Fedora 42 : incus (2026-4481307278)	Nessus	Fedora Local Security Checks	high
306074	Fedora 43 : trivy (2026-868e266938)	Nessus	Fedora Local Security Checks	high
301422	Fedora 42 : gh (2026-de52e7caa1)	Nessus	Fedora Local Security Checks	high
299650	Linux Distros Unpatched Vulnerability : CVE-2025-69725	Nessus	Misc.	medium
436769	SCA: security update for github.com/go-chi/chi/v5 (GHSA-mqqf-5wvp-8fh8)	Tenable Cloud Security	SCA Checks	medium
436769	SCA: security update for github.com/go-chi/chi/v5 (GHSA-mqqf-5wvp-8fh8)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2025-69725

medium

Tenable Plugins

high

critical

critical

critical

high

high

high

high

high

medium

medium

medium