The mongo-go-driver repository contains CGo bindings for GSSAPI (Kerberos) authentication on Linux and macOS. The C wrapper implementation contains a heap out-of-bounds read vulnerability due to incorrect assumptions about string termination in the GSSAPI standard. Since GSSAPI buffers are not guaranteed to be null-terminated or have extra padding, this results in reading one byte past the allocated heap buffer.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22125-1 advisory.

    Changes in grafana:

    Update to version 12.4.10:

      * Security:

        * CVE-2026-17183: Fix exposing data accessible through Grafana's configured datasource credentials     (bsc#1275934)
        * CVE-2026-2303: Drop dependency on vulnerable go.mongodb.org/mongo-driver (bsc#1269841)
        * CVE-2026-17033: Fix stored XSS via external Alertmanager generatorURL (bsc#1276426)
        * CVE-2026-73501: Fix fail-open authentication bypass in github.com/getkin/kin-openapi (bsc#1276973)
        * CVE-2026-19475: Fix DoS in PostgreSQL Datasource (bsc#1278307)
        * CVE-2026-14199: Fix session takeover via Auth Proxy cache key collision (bsc#1278322)

      * Bug fixes:

        * Dashboards: Fix adhoc and groupby variable datasource on UI import
        * Dashboards: Fix version dates and user display names in the legacy version history page

    Update to version 12.4.9:

      * Features and enhancements:

        * Dashboard Import: Labels in v2 schema

      * Bug fixes:

        * Azure Monitor: fix migration for dimension filters

    Update to version 12.4.8:

      * Security:

        * CVE-2026-19197: Fix access control in dashboard snapshots (bsc#1277025)

    Update to version 12.4.7:

      * Security:

        * CVE-2026-56852: Fix infinite loop on truncated/invalid UTF-8 input in golang.org/x/text/unicode/norm     (bsc#1272008)

      * Features and enhancements:

        * Dashboards: Get annotations and dashboard endpoint performance improvements

      * Bug fixes:

        * DashboardDS: Fix Mixed panels with a time override stuck in permanent loading

    Update to version 12.4.6:

      * Security:

        * CVE-2026-41178: Fix opentelemetry-go's baggage parsing (bsc#1276658)

      * Features and enhancements:

        * Alerting: Add protected fields authorization check to provisioning API
        * Alerting: Return 403 instead of 500 on contact point provenance mismatch

      * Bug fixes:

        * Jaeger: Handle gzip, deflate, and brotli compressed API responses
        * Alerting: fix ORM table mapping bug causing SELECT alert_rule columns FROM user on PostgreSQL

    * CVE-2026-39882: Prevent memory exhaustion DoS in OpenTelemetry OTLP HTTP exporters by updating to     v1.43.0.  (bsc#1274217)
    * CVE-2026-42127: Fix DoS through memory exhaustion in grafana'a public dashboard query endpoint     (bsc#1268868)
    * CVE-2026-9029: Fix arbitrary code execution and information disclosure via XSS in geomap panel     (bsc#1272328)
    * CVE-2026-33814: Fix infinite loop in HTTP/2 transport by updating golang.org/x/net (bsc#1265763)
    * CVE-2026-8609: Fix pre-authentication DoS in the OAuth login route (bsc#1271330)
    * CVE-2026-1229: Update github.com/cloudflare/circl to fix producing incorect output for specific inputs     (bsc#1265525) (bsc#1262187)
    * CVE-2026-21723: Fix DoS vulnerability in Templates Test endpoint (bsc#1272427)
    * CVE-2026-41606: Fix potential DoS in Apache Thrift (bsc#1263330)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4606-1 advisory.

    golang-github-prometheus-prometheus was updated to version 3.13.2:

    - Security issues:

      * CVE-2026-39821: Fixed validation bypass and privilege escalation in Punycode label handling     (bsc#1266608)
      * CVE-2026-56852: Fixed infinite loop on truncated or invalid UTF-8 input in unicode/norm handling     (bsc#1272102)
      * CVE-2026-44990: Fixed stored XSS in the new React UI by sanitizing disallowed xmp elements     (bsc#1275205)
      * CVE-2026-53606: Fixed incomplete URI scheme validation in sanitize-html that could enable XSS     (bsc#1269966)
      * CVE-2026-2303: Fixed heap out-of-bounds read in GSSAPI error handling in mongo-driver (bsc#1269856)
      * CVE-2025-4673: Fixed credential leaks by stopping HTTP client header forwarding on redirects     (bsc#1275206)
      * CVE-2023-45289: Fixed credential leaks by stopping header and cookie forwarding on HTTP redirects     (bsc#1275207)
      * CVE-2025-61686: Fixed unauthorized file access and path traversal in react-router storage     (bsc#1270711)
      * CVE-2026-40181: Fixed open redirect risks to external domains via relative paths in react-router     (bsc#1267528)
      * CVE-2026-42342: Fixed DoS risks via unbounded path expansion in the manifest endpoint (bsc#1267538)
      * CVE-2026-42211: Fixed remote code execution risks from prototype pollution in react-router     (bsc#1267534)
      * CVE-2026-39882: Fixed memory exhaustion via uncapped HTTP response reading in OpenTelemetry     (bsc#1274221)
      * Fixed potential denial-of-service vulnerabilities by updating the gRPC dependency
      * Fixed memory exhaustion and DoS by rejecting snappy-compressed requests exceeding 32MB limit

    - Bug fixes and changes:

      * Fixed scrape manager failing to reload properly when SD configuration changes rapidly.
      * Prevent memory leak in remote-write path when the receiving endpoint is unavailable.
      * Native Histograms are no longer experimental. They are fully supported for production workloads.
      * Added support for OpenTelemetry traces within the Prometheus UI to correlate metrics and traces.
      * TSDB compaction speed optimized by improving the block merging algorithm.
      * Allow scraping of multiple targets using a single HTTP/2 connection to reduce overhead.
      * Added new metrics to monitor the health of the rule evaluation engine.
      * Incompatible: This affects scraping, remote read and write, alerting, and SD. Network paths might need     adjustments         to avoid redirects.
      * Incompatible: Rule group pagination tokens now use SHA-256 instead of MD5. Custom API consumers must     adapt to the         new longer token format.
      * Added 'group_limit' parameter to PromQL aggregations to restrict the number of results.
      * Incompatible: promtool relative paths in config files now resolve relative to the config directory     itself, instead         of the current working directory.
      * Support exporting TSDB blocks directly to cloud storage via the admin API.
      * Incompatible: Deprecated remote-write metrics like prometheus_remote_storage_samples_total are removed     in favor of         prometheus_wal_watcher_records_read_total.
      * Significant query performance boost for high-cardinality regex matchers.
      * Introduce a new UI interface for safely deleting specific time series data directly.
      * Added dynamic relabeling actions to extract substrings using regex capture groups.
      * Fixed UI displaying incorrect time ranges after a timezone change.
      * Bumped firewalld-prometheus-config to version 0.2 bumping OpenTelemetry to 1.43.0

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4600-1 advisory.

    - Update to version 12.4.10:
      * Security:
        CVE-2026-17183: Fix exposing data accessible through Grafana's                         configured datasource credentials (bsc#1275934)         CVE-2026-2303: Drop dependency on vulnerable                        go.mongodb.org/mongo-driver (bsc#1269841)         CVE-2026-17033: Fix stored XSS via external Alertmanager                         generatorURL (bsc#1276426)         CVE-2026-73501: Fix fail-open authentication bypass in                         github.com/getkin/kin-openapi (bsc#1276973)         CVE-2026-19475: Fix DoS in PostgreSQL Datasource (bsc#1278307)         CVE-2026-14199: Fix session takeover via Auth Proxy cache key                         collision (bsc#1278322)
      * Bug fixes:
        Dashboards: Fix adhoc and groupby variable datasource on UI                     import         Dashboards: Fix version dates and user display names in the                     legacy version history page
    - Update to version 12.4.9:
      * Features and enhancements:
        Dashboard Import: Labels in v2 schema
      * Bug fixes:
        Azure Monitor: fix migration for dimension filters
    - Update to version 12.4.8:
      * Security:
        CVE-2026-19197: Fix access control in dashboard snapshots                         (bsc#1277025)
    - Update to version 12.4.7:
      * Security:
        CVE-2026-56852: Fix infinite loop on truncated/invalid UTF-8                         input in golang.org/x/text/unicode/norm                         (bsc#1272008)
      * Features and enhancements:
        Dashboards: Get annotations and dashboard endpoint performance                     improvements
      * Bug fixes:
        DashboardDS: Fix Mixed panels with a time override stuck in                      permanent loading
    - Update to version 12.4.6:
      * Security:
        CVE-2026-41178: Fix opentelemetry-go's baggage parsing                         (bsc#1276658)
      * Features and enhancements:
        Alerting: Add protected fields authorization check to                   provisioning API         Alerting: Return 403 instead of 500 on contact point provenance                   mismatch
      * Bug fixes:
        Jaeger: Handle gzip, deflate, and brotli compressed API                 responses         Alerting: fix ORM table mapping bug causing SELECT alert_rule                   columns FROM user on PostgreSQL
    - Drop 0005-Bump-edwards25519.patch

        CVE-2026-39882: Prevent memory exhaustion DoS in OpenTelemetry                         OTLP HTTP exporters by updating to v1.43.0.
                        (bsc#1274217)         CVE-2026-8595: Fix stored XSS in the table panel (bsc#1271557)         CVE-2026-42127: Fix DoS through memory exhaustion in grafana'a                         public dashboard query endpoint (bsc#1268868)         CVE-2026-9029: Fix arbitrary code execution and information                        disclosure via XSS in geomap panel (bsc#1272328)         CVE-2026-33814: Fix infinite loop in HTTP/2 transport by                         updating golang.org/x/net (bsc#1265763)         CVE-2026-8609: Fix pre-authentication DoS in the OAuth login                        route (bsc#1271330)
      * CVE-2026-1229: Update github.com/cloudflare/circl to fix                        producing incorect output for specific inputs                        (bsc#1265525)                         (bsc#1262187)
      * CVE-2026-21723: Fix DoS vulnerability in Templates Test                         endpoint (bsc#1272427)
    - CVE-2026-41606: Fix potential DoS in Apache Thrift (bsc#1263330)
    - Build only for SUSE distributions

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22032-1 advisory.

    - CVE-2026-2303: go.mongodb.org/mongo-driver: mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error     Handling       (bsc#1269861).
    - CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method     of a POST       request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277996).
    - CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing     allows for DoS       via oversized inputs (bsc#1276742).
    - CVE-2026-45679: go.opentelemetry.io/obi: Redis error text is exported in span status messages and can     lead to       exfiltration of sensitive data (bsc#1267482).
    - CVE-2026-45680: go.opentelemetry.io/obi: unbounded BPF internal metrics replay can exhaust CPU and cause     a DoS       (bsc#1267483).
    - CVE-2026-45681: go.opentelemetry.io/obi: CPU-mismatch fallback uses 256-byte buffer with 8KB size and     can cause OBI       out-of-bounds reads to leak memory into telemetry (bsc#1267484).
    - CVE-2026-45683: go.opentelemetry.io/obi: Java TLS ioctl kprobe allows a user to point OBI at kernel     memory and cause       that memory to be copied into telemetry (bsc#1267486).
    - CVE-2026-45684: go.opentelemetry.io/obi: log enricher mishandled `writev` buffers and allows multi-     segment calls to       read and overwrite memory beyond the first segment (bsc#1267487).
    - CVE-2026-46600: golang.org/x/net/dns/dnsmessage: Parsing an invalid SVCB or HTTPS RR can panic when the     size of a       parameter value overflows the message buffer (bsc#1272418).
    - CVE-2026-48496: opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the     ebpf-profiler       agent (bsc#1268982).
    - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input     (bsc#1272028).
    - CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and     deadlocks in the       crypto/ssh library (bsc#1278671).
    - CVE-2026-71556: github.com/go-git/go-git/v5: Arbitrary file read/write via symbolic link resolution     (bsc#1276982).
    - CVE-2026-71557: github.com/go-git/go-git/v5: Malicious reference names may modify files outside the     reference storage       (bsc#1276992).
    - CVE-2026-75889: arbitrary file reads due to the `prometheus.operator.servicemonitors` component allowing     users who can       modify `ServiceMonitor` resources in a watched namespace to specify an arbitrary local file through     `bearerTokenFile`       (bsc#1277429).
    - CVE-2026-81521: go.mongodb.org/mongo-driver: MongoDB Go Driver: Write redirection via unvalidated     database name in       Client.BulkWrite (bsc#1278693).
    - CVE-2026-89090: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream: malformed EventStream response     frames       containing a crafted header value type byte outside the valid range can cause the host process to     terminate       (bsc#1280671).

    Changes for alloy:

    Update to version 1.19.2:

     * Remove withdrawn lib/pq CVEs from govulncheck
     * Add backticks to component name in generated doc output
     * BREAKING CHANGE: prometheus.operator.servicemonitors now      rejects endpoints that reference local files by default. Set      allow_arbitrary_file_access = true to preserve previous      behavior.
     * prometheus.enrich: Support multi-label matching
     * prometheus.relabel: Add opt-in TTL cache mode
     * telemetry: Add new metrics for graph connections and      pyroscope forwarded entries
     * database_observability: Exclude system schemas from MySQL      health checks and redact query text in explain_plans
     * Add nop receiver to OTel Engine
     * Backport dependency upgrades to address GO-2026-6061

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22027-1 advisory.

    Changes in golang-github-prometheus-alertmanager:

    - CVE-2026-39821: Fix validation bypass and privilege escalation by       updating golang.org/x/net to version 0.57.0 (bsc#1266615)

    - Update to version 0.33.1 (jsc#PED-16708):
      * [BUGFIX] silences: fix silences snapshot missing legacy         matchers field. This caused a bug that prevented older         alertmanager versions from reading newer snapshots         unnecessarily.
      * [BUGFIX] silence with no matchers should populate an empty         array in API response

    - Update to version 0.33.0:
      * The '--enable-feature=auto-gomaxprocs' option has been         removed.
      * Add a new Microsoft Teams integration that supports adaptive         cards.
      * Add support for AWS Signature V4 to call AWS services that         require authentication.
      * Add support for Google Chat as a notification channel.
      * Add support for custom payloads in webhooks.

    - Update to version 0.32.2:
      * [BUGFIX] Fix dispatcher goroutine leaks on destroyed alertgroup         swap.

    - Update to version 0.32.1:
      * [BUGFIX] dispatcher: Fix issue with dispatching to a contended         route.

    - Update to version 0.32.0:
      * Reduce memory allocations through pre-sizing collections and         batch allocation.
      * CVE-2026-2303: Removed indirect dep on vulnerable mongodb                        driver (bsc#1269834)

    - Update to version 0.31.1:
      * No user-visible changes

    - Update to version 0.31.0:
      * Add full payload templating support for webhook notifier.
      * Add support for UTF-8 label names in UI matchers.
      * Fix escaping for matcher values with quotes in the UI.

    - Update to version 0.30.1:
      * [BUGFIX] Fix memory leak in tracing client.

    - Update to version 0.30.0:
      * Add Mattermost integration.
      * Add support for Slack apps.
      * Add distributed tracing support.
      * Add names to inhibition rules.
      * Add templating functions for working with URLs and JSON.
      * Allow persistent peer names in a cluster.

    - Update to version 0.29.0:
      * Add incident.io notifier.
      * Add monospace message formatting.
      * Update Jira notifier to support both Jira cloud API v3 and         Jira datacenter API v2.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The mongo-go-driver repository contains CGo bindings for GSSAPI (Kerberos) authentication on Linux and
    macOS. The C wrapper implementation contains a heap out-of-bounds read vulnerability due to incorrect
    assumptions about string termination in the GSSAPI standard. Since GSSAPI buffers are not guaranteed to be
    null-terminated or have extra padding, this results in reading one byte past the allocated heap buffer.
    (CVE-2026-2303)

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4408-1 advisory.

    - CVE-2026-2303: go.mongodb.org/mongo-driver: mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error     Handling       (bsc#1269861).
    - CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method     of a POST       request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277996).
    - CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing     allows for DoS       via oversized inputs (bsc#1276742).
    - CVE-2026-45679: go.opentelemetry.io/obi: Redis error text is exported in span status messages and can     lead to       exfiltration of sensitive data (bsc#1267482).
    - CVE-2026-45680: go.opentelemetry.io/obi: unbounded BPF internal metrics replay can exhaust CPU and cause     a DoS       (bsc#1267483).
    - CVE-2026-45681: go.opentelemetry.io/obi: CPU-mismatch fallback uses 256-byte buffer with 8KB size and     can cause OBI       out-of-bounds reads to leak memory into telemetry (bsc#1267484).
    - CVE-2026-45683: go.opentelemetry.io/obi: Java TLS ioctl kprobe allows a user to point OBI at kernel     memory and cause       that memory to be copied into telemetry (bsc#1267486).
    - CVE-2026-45684: go.opentelemetry.io/obi: log enricher mishandled `writev` buffers and allows multi-     segment calls to       read and overwrite memory beyond the first segment (bsc#1267487).
    - CVE-2026-46600: golang.org/x/net/dns/dnsmessage: Parsing an invalid SVCB or HTTPS RR can panic when the     size of a       parameter value overflows the message buffer (bsc#1272418).
    - CVE-2026-48496: opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the     ebpf-profiler       agent (bsc#1268982).
    - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input     (bsc#1272028).
    - CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and     deadlocks in the       crypto/ssh library (bsc#1278671).
    - CVE-2026-71556: github.com/go-git/go-git/v5: Arbitrary file read/write via symbolic link resolution     (bsc#1276982).
    - CVE-2026-71557: github.com/go-git/go-git/v5: Malicious reference names may modify files outside the     reference storage       (bsc#1276992).
    - CVE-2026-75889: arbitrary file reads due to the `prometheus.operator.servicemonitors` component allowing     users who can       modify `ServiceMonitor` resources in a watched namespace to specify an arbitrary local file through     `bearerTokenFile`       (bsc#1277429).
    - CVE-2026-81521: go.mongodb.org/mongo-driver: MongoDB Go Driver: Write redirection via unvalidated     database name in       Client.BulkWrite (bsc#1278693).
    - CVE-2026-89090: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream: malformed EventStream response     frames       containing a crafted header value type byte outside the valid range can cause the host process to     terminate       (bsc#1280671).

    Changes for alloy:

    - Update to version 1.19.2.
    - Update to version 1.19.1.
    - Update to version 1.19.0:
     * BREAKING CHANGE: prometheus.operator.servicemonitors now      rejects endpoints that reference local files by default. Set      allow_arbitrary_file_access = true to preserve previous      behavior.
     * prometheus.enrich: Support multi-label matching
     * prometheus.relabel: Add opt-in TTL cache mode
     * telemetry: Add new metrics for graph connections and      pyroscope forwarded entries
     * database_observability: Exclude system schemas from MySQL      health checks and redact query text in explain_plans
    - Update to version 1.18.1:
     * Add nop receiver to OTel Engine

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21276-1 advisory.

    Changes in apptainer:

    - Enable building of SUID starter for SLES 15 (jsc#PED-16347).
      * Security fix for CVE-2026-2303 (bsc#1270529):
        Heap Out-of-Bounds Read in GSSAPI Error Handling in         go.mongodb.org/mongo-driver. The dependency on mongo-driver         has been removed with this version of apptainer.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- RU-2026:2815-1 advisory.

    Security fixes included on this update:

    - CVE-2026-2303: go.mongodb.org/mongo-driver: Heap Out-of-Bounds Read in GSSAPI Error Handling     (bsc#1270529).

    Other fixes:

    - Enable building of SUID starter for SLES 15 (jsc#PED-16347).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
370424	openSUSE 16 Security Update : grafana (openSUSE-SU-2026:22125-1)	Nessus	SuSE Local Security Checks	Local	medium
369278	SUSE SLES15 Security Update : golang-github-prometheus-prometheus (SUSE-SU-2026:4606-1)	Nessus	SuSE Local Security Checks	Local	high
369265	SUSE SLES15 Security Update : grafana, system-user-grafana (SUSE-SU-2026:4600-1)	Nessus	SuSE Local Security Checks	Local	medium
364343	openSUSE 16 Security Update : alloy (openSUSE-SU-2026:22032-1)	Nessus	SuSE Local Security Checks	Local	high
364115	openSUSE 16 Security Update : golang-github-prometheus-alertmanager (openSUSE-SU-2026:22027-1)	Nessus	SuSE Local Security Checks	Local	medium
458117	Echo: multiple go.mongodb.org/mongo-driver packages: security update to 1.17.7	Tenable Cloud Security	Echo Local Security Checks	Local	medium
458117	Echo: multiple go.mongodb.org/mongo-driver packages: security update to 1.17.7	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
362571	SUSE SLED15 / SLES15 Security Update : alloy (SUSE-SU-2026:4408-1)	Nessus	SuSE Local Security Checks	Local	high
326417	openSUSE 16 Security Update : apptainer (openSUSE-SU-2026:21276-1)	Nessus	SuSE Local Security Checks	Local	medium
326323	SUSE SLES15: Multiple Vulnerabilities (SUSE-RU-2026:2815-1)	Nessus	SuSE Local Security Checks	Local	medium
443526	SCA: security update for go.mongodb.org/mongo-driver, go.mongodb.org/mongo-driver/v2 (GHSA-cp6g-7hqx-qxhp)	Tenable Cloud Security	SCA Checks	Local	medium
443526	SCA: security update for go.mongodb.org/mongo-driver, go.mongodb.org/mongo-driver/v2 (GHSA-cp6g-7hqx-qxhp)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-2303

medium

Tenable Plugins

medium

high

medium

high

medium

medium

medium

high

medium

medium

medium

medium