Versions of the package github.com/yuin/goldmark/renderer/html before 1.7.17 are vulnerable to Cross-site Scripting (XSS) due to improper ordering of URL validation and normalization. The renderer validates link destinations using a prefix-based check (IsDangerousURL) before resolving HTML entities. This allows an attacker to bypass protocol filtering by encoding dangerous schemes using HTML5 named character references. For example, a payload such as javascript&colon;alert(1) is not recognized as dangerous during validation, leading to arbitrary script execution in the context of applications that render the URL.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21480-1 advisory.

    - CVE-2026-5160: github.com/yuin/goldmark/renderer: Cross-site Scripting due to improper URL validation     (bsc#1272488).
    - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for     validation       bypass and privilege escalation (bsc#1266572).
    - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input     (bsc#1272131).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-d36ca2dd19 advisory.

    Update to 3.11.0

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-3a8abe43fb advisory.

    Update to 3.11.0

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-902340971e advisory.

    Update to 1.3.0

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-1c78e384e3 advisory.

    Update to 1.3.0

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-950cac64f2 advisory.

    Security update resolving 17 CVEs across both caddy itself and its vendored libraries.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-3dc324bd9a advisory.

    Security update resolving 22 CVEs across both caddy itself and its vendored libraries.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-905e9afc79 advisory.

    Update to 2.70.5

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-5df889949e advisory.

    Update to 2.92.0 and make telemetry sending opt in.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-94fbf80bec advisory.

    Update vendored goldmark to 1.7.17 to resolve CVE-2026-5160.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-3a2ff381f7 advisory.

    Automatic update for subfinder-2.14.0-1.fc45.

    ##### **Changelog**

    ```
    * Tue Apr 28 2026 Mikel Olasagasti Uranga <mikel@olasagasti.info> - 2.14.0-1
    - Update to 2.14.0 - Closes rhbz#2463149 rhbz#2458997 rhbz#2456046

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-10cf6ce616 advisory.

    Update vendored goldmark to 1.7.17 to resolve CVE-2026-5160.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Versions of the package github.com/yuin/goldmark/renderer/html before 1.7.17 are vulnerable to Cross-site
    Scripting (XSS) due to improper ordering of URL validation and normalization. The renderer validates link
    destinations using a prefix-based check (IsDangerousURL) before resolving HTML entities. This allows an
    attacker to bypass protocol filtering by encoding dangerous schemes using HTML5 named character
    references. For example, a payload such as javascript&colon;alert(1) is not recognized as dangerous during
    validation, leading to arbitrary script execution in the context of applications that render the URL.
    (CVE-2026-5160)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Versions of the package github.com/yuin/goldmark/renderer/html before 1.7.17 are vulnerable to Cross-site     Scripting (XSS) due to improper ordering of URL validation and normalization. The renderer validates link     destinations using a prefix-based check (IsDangerousURL) before resolving HTML entities. This allows an     attacker to bypass protocol filtering by encoding dangerous schemes using HTML5 named character     references. For example, a payload such as javascript:alert(1) is not recognized as dangerous during     validation, leading to arbitrary script execution in the context of applications that render the URL.
    (CVE-2026-5160)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
331569	openSUSE 16: mcphost / mcphost-bash-completion / mcphost-fish-completion / etc (openSUSE-SU-2026:21480-1)	Nessus	SuSE Local Security Checks	Local	medium
328927	Fedora 43 : nuclei (2026-d36ca2dd19)	Nessus	Fedora Local Security Checks	Local	medium
328869	Fedora 44 : nuclei (2026-3a8abe43fb)	Nessus	Fedora Local Security Checks	Local	medium
328438	Fedora 44 : dnsx (2026-902340971e)	Nessus	Fedora Local Security Checks	Local	medium
328432	Fedora 43 : dnsx (2026-1c78e384e3)	Nessus	Fedora Local Security Checks	Local	medium
324621	Fedora 44 : caddy (2026-950cac64f2)	Nessus	Fedora Local Security Checks	Local	critical
324614	Fedora 43 : caddy (2026-3dc324bd9a)	Nessus	Fedora Local Security Checks	Local	critical
320956	Fedora 44 : chezmoi (2026-905e9afc79)	Nessus	Fedora Local Security Checks	Local	medium
313027	Fedora 44 : gh (2026-5df889949e)	Nessus	Fedora Local Security Checks	Local	medium
311380	Fedora 44 : vhs (2026-94fbf80bec)	Nessus	Fedora Local Security Checks	Local	medium
310723	Fedora 45 : subfinder (2026-3a2ff381f7)	Nessus	Fedora Local Security Checks	Local	medium
310594	Fedora 44 : gum (2026-10cf6ce616)	Nessus	Fedora Local Security Checks	Local	medium
440659	SCA: security update for github.com/yuin/goldmark/renderer/html (GHSA-c97m-vxhj-p7j6)	Tenable Cloud Security	SCA Checks	Local	medium
440659	SCA: security update for github.com/yuin/goldmark/renderer/html (GHSA-c97m-vxhj-p7j6)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
306637	Linux Distros Unpatched Vulnerability : CVE-2026-5160	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-5160

medium

Tenable Plugins

medium

medium

medium

medium

medium

critical

critical

medium

medium

medium

medium

medium

medium

medium

medium