Versions of the package github.com/yuin/goldmark/renderer/html before 1.7.17 are vulnerable to Cross-site Scripting (XSS) due to improper ordering of URL validation and normalization. The renderer validates link destinations using a prefix-based check (IsDangerousURL) before resolving HTML entities. This allows an attacker to bypass protocol filtering by encoding dangerous schemes using HTML5 named character references. For example, a payload such as javascript&colon;alert(1) is not recognized as dangerous during validation, leading to arbitrary script execution in the context of applications that render the URL.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-950cac64f2 advisory.

    Security update resolving 17 CVEs across both caddy itself and its vendored libraries.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-3dc324bd9a advisory.

    Security update resolving 22 CVEs across both caddy itself and its vendored libraries.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-905e9afc79 advisory.

    Update to 2.70.5

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-5df889949e advisory.

    Update to 2.92.0 and make telemetry sending opt in.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-94fbf80bec advisory.

    Update vendored goldmark to 1.7.17 to resolve CVE-2026-5160.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-3a2ff381f7 advisory.

    Automatic update for subfinder-2.14.0-1.fc45.

    ##### **Changelog**

    ```
    * Tue Apr 28 2026 Mikel Olasagasti Uranga <mikel@olasagasti.info> - 2.14.0-1
    - Update to 2.14.0 - Closes rhbz#2463149 rhbz#2458997 rhbz#2456046

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-10cf6ce616 advisory.

    Update vendored goldmark to 1.7.17 to resolve CVE-2026-5160.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Versions of the package github.com/yuin/goldmark/renderer/html before 1.7.17 are vulnerable to Cross-site
    Scripting (XSS) due to improper ordering of URL validation and normalization. The renderer validates link
    destinations using a prefix-based check (IsDangerousURL) before resolving HTML entities. This allows an
    attacker to bypass protocol filtering by encoding dangerous schemes using HTML5 named character
    references. For example, a payload such as javascript&colon;alert(1) is not recognized as dangerous during
    validation, leading to arbitrary script execution in the context of applications that render the URL.
    (CVE-2026-5160)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Versions of the package github.com/yuin/goldmark/renderer/html before 1.7.17 are vulnerable to Cross-site     Scripting (XSS) due to improper ordering of URL validation and normalization. The renderer validates link     destinations using a prefix-based check (IsDangerousURL) before resolving HTML entities. This allows an     attacker to bypass protocol filtering by encoding dangerous schemes using HTML5 named character     references. For example, a payload such as javascript:alert(1) is not recognized as dangerous during     validation, leading to arbitrary script execution in the context of applications that render the URL.
    (CVE-2026-5160)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
324621	Fedora 44 : caddy (2026-950cac64f2)	Nessus	Fedora Local Security Checks	critical
324614	Fedora 43 : caddy (2026-3dc324bd9a)	Nessus	Fedora Local Security Checks	critical
320956	Fedora 44 : chezmoi (2026-905e9afc79)	Nessus	Fedora Local Security Checks	medium
313027	Fedora 44 : gh (2026-5df889949e)	Nessus	Fedora Local Security Checks	medium
311380	Fedora 44 : vhs (2026-94fbf80bec)	Nessus	Fedora Local Security Checks	medium
310723	Fedora 45 : subfinder (2026-3a2ff381f7)	Nessus	Fedora Local Security Checks	medium
310594	Fedora 44 : gum (2026-10cf6ce616)	Nessus	Fedora Local Security Checks	medium
440659	SCA: security update for github.com/yuin/goldmark/renderer/html (GHSA-c97m-vxhj-p7j6)	Tenable Cloud Security	SCA Checks	medium
440659	SCA: security update for github.com/yuin/goldmark/renderer/html (GHSA-c97m-vxhj-p7j6)	Tenable Self-Hosted Container Security	SCA Checks	medium
306637	Linux Distros Unpatched Vulnerability : CVE-2026-5160	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-5160

medium

Tenable Plugins

critical

critical

medium

medium

medium

medium

medium

medium

medium

medium