Ubuntu Linux - [updated libpng in Oracle Java]

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_9686 advisory.

    * JDK: Enhance crypto algorithm support (CVE-2026-22007)

    * JDK: Improve Kerberos credentialing (CVE-2026-22013)

    * JDK: Enhance Path Factories Redux (CVE-2026-22016)

    * JDK: Enhance Zip file reading (CVE-2026-22018)

    * JDK: Enhance certificate chain validation (CVE-2026-22021)

    * JDK: Updating FreeType 2.14.1 (CVE-2026-23865)

    * JDK: Enhance TLS connection handling (CVE-2026-34282)

    * JDK: Enhance key generation (CVE-2026-34268)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a109a9ac2c advisory.

    * updated to 1.6.58
    * 1.6.58 is released with a fix for a simple correctness bug (not a security issue) this time:
    png_get_PLTE() returns stale palette data when either gamma correction or alpha-compositing is the only     transform applied. Like the issues addressed in the previous release, this bug was a regression introduced     in the fix for CVE-2026-33416 in 1.6.56.
    * 1.6.57 is released with fixes for the following security vulnerability:
    - CVE-2026-34757 (medium severity): Use-after-free memory bug in the chunk setter API. The hIST variant     has existed since version 1.0.9, but the PLTE and tRNS ones are regressions introduced in the fix for     CVE-2026-33416 in 1.6.56 (oops).

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-67c1138ed2 advisory.

    * updated to 1.6.58
    * 1.6.58 is released with a fix for a simple correctness bug (not a security issue) this time:
    png_get_PLTE() returns stale palette data when either gamma correction or alpha-compositing is the only     transform applied. Like the issues addressed in the previous release, this bug was a regression introduced     in the fix for CVE-2026-33416 in 1.6.56.
    * 1.6.57 is released with fixes for the following security vulnerability:
    - CVE-2026-34757 (medium severity): Use-after-free memory bug in the chunk setter API. The hIST variant     has existed since version 1.0.9, but the PLTE and tRNS ones are regressions introduced in the fix for     CVE-2026-33416 in 1.6.56 (oops).

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2026 CPU advisory.

  - Security-in-Depth issue in the Spatial and Graph (SQLite) component of Oracle Database Server. This     vulnerability cannot be exploited in the context of this product. (CVE-2025-6965)

  - Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are     19.3-19.30 and 21.3-21.21. Easily exploitable vulnerability allows unauthenticated attacker with network     access via Oracle Net to compromise Java VM. Successful attacks of this vulnerability can result in     unauthorized access to critical data or complete access to all Java VM accessible data. (CVE-2026-35229)

  - Vulnerability in the Clusterware (Micronaut) component of Oracle Database Server. Supported versions that     are affected are 19.3-19.30 and 23.4.0-23.26.1. Easily exploitable vulnerability allows unauthenticated     attacker with network access via HTTP to compromise Clusterware (Micronaut). Successful attacks of this     vulnerability can result in unauthorized creation, deletion or modification access to critical data or all     Clusterware (Micronaut) accessible data. (CVE-2026-33013, CVE-2026-33870)

  - Vulnerability in the RDBMS (OpenSSL) component of Oracle Database Server. Supported versions that are     affected are 19.3-19.30 and 23.4.0-23.26.1. Easily exploitable vulnerability allows high privileged     attacker having None privilege with network access via multiple protocols to compromise RDBMS (OpenSSL).
    Successful attacks of this vulnerability can result in takeover of RDBMS (OpenSSL). (CVE-2026-31790)

  - Vulnerability in the RDBMS (Python) component of Oracle Database Server. Supported versions that are     affected are 21.3-21.21 and 23.4.0-23.26.1. Easily exploitable vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise RDBMS (Python). Successful attacks     require human interaction from a person other than the attacker. Successful attacks of this vulnerability     can result in unauthorized access to critical data or complete access to all RDBMS (Python) accessible     data. (CVE-2026-26007)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - OpenJDK: Update LibPNG (Oracle CPU 2026-04) [fedora-all] (CVE-2026-22020)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
355311	Rocky Linux 8 [CIQ] Security Update: java-17-openjdk / java-17-openjdk-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_9686)	Nessus	Rocky Linux Local Security Checks	Local	high
318196	Fedora 43 : libpng (2026-a109a9ac2c)	Nessus	Fedora Local Security Checks	Local	medium
317514	Fedora 44 : libpng (2026-67c1138ed2)	Nessus	Fedora Local Security Checks	Local	medium
310136	Oracle Database Server (April 2026 CPU)	Nessus	Databases	Local	high
309733	Linux Distros Unpatched Vulnerability : CVE-2026-22020	Nessus	Misc.	Local	critical

Detections

Analytics

CVE-2026-22020

high

Tenable Plugins

high

medium

medium

high

critical