fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions. Encoded path data was treated like real slashes and parent-directory references, so distinct URIs could collapse onto the same normalized path. Applications that normalize or compare attacker-controlled URLs to enforce path-based policy can be bypassed, with a path that appears confined under an allowed prefix normalizing to a different location. Versions <= 3.1.0 are affected. Update to 3.1.1 or later.

According to its self-reported version number, the Atlassian Jira application running on the remote host is prior to 10.3.23 or 10.4.x prior to 11.3.8. It is, therefore, affected by multiple vulnerabilities, including flaws in bundled third-party dependencies :

- A prototype pollution vulnerability in the bundled loader-utils dependency. (CVE-2022-37601)

- A HTTP request smuggling vulnerability in the bundled Netty dependency. (CVE-2026-42581)

- A cryptographic vulnerability in the bundled Bouncy Castle dependency. (CVE-2025-14813)

- A broken authentication and session management vulnerability. (CVE-2026-29145)

- A prototype pollution vulnerability in the bundled axios dependency. (CVE-2026-42044)

- An injection vulnerability in the bundled Immutable.js dependency. (CVE-2026-29063)

- A file inclusion vulnerability in the bundled tmp dependency. (CVE-2026-44705)

- An information disclosure vulnerability in the bundled Apache Tomcat dependency. (CVE-2026-29146)

- Multiple denial of service vulnerabilities in the bundled loader-utils dependency. (CVE-2022-37603, CVE-2022-37599)

- A file inclusion vulnerability in the bundled fast-uri dependency. (CVE-2026-6321)

- An injection vulnerability in the bundled fast-uri dependency. (CVE-2026-6322)

- A denial of service vulnerability in the bundled PostgreSQL JDBC Driver dependency. (CVE-2026-42198)

- A denial of service vulnerability in the bundled ajv dependency. (CVE-2025-69873)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 9.2.22 or 9.3.x prior to 10.2.14. It is, therefore, affected by multiple vulnerabilities, including flaws in bundled third-party dependencies :

- Multiple server-side request forgery (SSRF) vulnerabilities in the bundled axios dependency. (CVE-2026-42043, CVE-2025-62718, CVE-2026-40175, CVE-2026-44492)

- A remote code execution vulnerability in the bundled lodash dependency. (CVE-2026-4800)

- A HTTP request smuggling vulnerability in the bundled Eclipse Jetty dependency. (CVE-2026-2332)

- A prototype pollution vulnerability in the bundled axios dependency. (CVE-2026-42264)

- Multiple injection vulnerabilities in the bundled axios dependency. (CVE-2026-44494, CVE-2026-44490, CVE-2026-42041, CVE-2026-42035, CVE-2026-42033)

- A remote code execution vulnerability in the bundled form-data dependency. (CVE-2026-12143)

- Multiple information disclosure vulnerabilities in the bundled axios dependency. (CVE-2026-44487, CVE-2026-44486)

- A file inclusion vulnerability in the bundled node-tar dependency. (CVE-2026-31802)

- An information disclosure vulnerability in Atlassian Confluence. (CVE-2026-21579)

- A denial of service vulnerability in the bundled serialize-javascript dependency. (CVE-2026-34043)

- Multiple denial of service vulnerabilities in the bundled Netty dependency. (CVE-2026-42583, CVE-2026-42587)

- Multiple denial of service vulnerabilities in the bundled axios dependency. (CVE-2026-44496, CVE-2026-44488)

- A file inclusion vulnerability in the bundled fast-uri dependency. (CVE-2026-6321)

- An injection vulnerability in the bundled fast-uri dependency. (CVE-2026-6322)

- An injection vulnerability in the bundled js-cookie dependency. (CVE-2026-46625)

- A denial of service vulnerability in the bundled picomatch dependency. (CVE-2026-33671)

- A denial of service vulnerability. (CVE-2026-48779)

- A denial of service vulnerability in Atlassian Confluence. (CVE-2026-21577)

- A remote code execution vulnerability in the bundled axios dependency. (CVE-2026-44495)

- An injection vulnerability in the bundled logback dependency. (CVE-2025-11226)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in
    its normalize() and equal() functions. Encoded path data was treated like real slashes and parent-
    directory references, so distinct URIs could collapse onto the same normalized path. Applications that
    normalize or compare attacker-controlled URLs to enforce path-based policy can be bypassed, with a path
    that appears confined under an allowed prefix normalizing to a different location. Versions <= 3.1.0 are
    affected. Update to 3.1.1 or later. (CVE-2026-6321)

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:42078 advisory.

    Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing     IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to     individual teams, while automation developers retain the freedom to write tasks that leverage existing     knowledge without the overhead. Ansible Automation Platform makes it possible for users across an     organization to share, vet, and manage automation content by means of a simple, powerful, and agentless     language.

    Security Fix(es):

    * ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution     (CVE-2026-11332)
    * automation-controller: Path traversal via malicious entry point name in pip wheel installation allows     arbitrary file overwrite (CVE-2026-8643)
    * automation-controller: urllib3: Denial of Service due to excessive HTTP response decompression     (CVE-2026-44432)
    * automation-gateway: Axios: Proxy bypass via IPv4-mapped IPv6 address non-normalization (CVE-2026-44492)
    * automation-gateway: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF     cookie name (CVE-2026-44496)
    * automation-gateway: Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution (CVE-2026-44494)
    * automation-gateway: Axios: Information disclosure of proxy credentials via HTTP redirects     (CVE-2026-44486)
    * automation-gateway: Axios: Information disclosure of proxy credentials via redirect flows     (CVE-2026-44487)
    * automation-gateway: Axios: Denial of Service due to unenforced request and response size limits     (CVE-2026-44488)
    * automation-gateway: Axios: Information disclosure due to prototype pollution vulnerability     (CVE-2026-44495)
    * automation-gateway: fast-uri: URI authority bypass due to improper delimiter handling (CVE-2026-6322)
    * automation-gateway: Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget     (CVE-2026-42044)
    * automation-gateway: fast-uri: Path traversal vulnerability allows bypass of security policies     (CVE-2026-6321)
    * automation-gateway: lodash: Arbitrary code execution via untrusted input in template imports     (CVE-2026-4800)
    * automation-gateway: missing requestHeadersToRemove allows mTLS bypass via Subject header spoofing     (CVE-2026-12382)
    * python3.12-pulpcore: relative_path_validator bypass via directory traversal in FilesystemExport     (CVE-2026-12701)
    * receptor: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681)
    * receptor: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136)
    * receptor: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)
    * receptor: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing     (CVE-2026-39821)
    * receptor: Go crypto/x509: Denial of Service via inefficient certificate chain validation     (CVE-2026-32281)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    For details about this release, refer to the release notes listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:42079 advisory.

    Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing     IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to     individual teams, while automation developers retain the freedom to write tasks that leverage existing     knowledge without the overhead. Ansible Automation Platform makes it possible for users across an     organization to share, vet, and manage automation content by means of a simple, powerful, and agentless     language.

    Security Fix(es):

    * ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution     (CVE-2026-11332)
    * automation-controller: Path traversal via malicious entry point name in pip wheel installation allows     arbitrary file overwrite (CVE-2026-8643)
    * automation-controller: urllib3: Denial of Service due to excessive HTTP response decompression     (CVE-2026-44432)
    * automation-platform-ui: fast-uri: Path traversal vulnerability allows bypass of security policies     (CVE-2026-6321)
    * python3.12-pulpcore: relative_path_validator bypass via directory traversal in FilesystemExport     (CVE-2026-12701)
    * receptor: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136)
    * receptor: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681)
    * receptor: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries     (CVE-2026-27145)
    * receptor: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)
    * receptor: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing     (CVE-2026-39821)
    * receptor: Go crypto/x509: Denial of Service via inefficient certificate chain validation     (CVE-2026-32281)

    For details about this release, refer to the release notes listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21266-1 advisory.

    Changes in openQA:

    - Update to version 5.1783076943.6691832d:
      * test: Stabilize `t/05-scheduler-full.t`

    - Clarify resolution of three CVEs
      * The following CVEs have been fixed (see previous changelog         entries that mentioned only the according Bugzilla tickets):
        - bsc#1259005 - CVE-2026-27904
        - bsc#1264376 - CVE-2026-6321
        - bsc#1258632 - CVE-2026-26996

    - Update to version 5.1782995932.ffeb09be:
      * feat: throw 404 for nonexistent groups in overview
      * feat: Avoid logwarn notifications for non-critical auth error
      * chore(deps): Dependency cron 2026-07-02
      * git subrepo pull (merge) external/os-autoinst-common
      * fix: Check also hidden files in checklist plugin
      * test: Enable faster re-connects in full scheduler test consistently
      * test: Avoid silent daemons in verbose mode
      * test: Allow running `t/43--scalability.t` in parallel
      * test: Allow running `t/05-scheduler-full.t` in parallel
      * test: Avoid race condition when generating ports in `25-cache.t`
      * test: Avoid wasting seconds in `40-script_load_dump_templates.t`
      * refactor: Remove disabled code in `openqa-load-templates`
      * test: Avoid race condition when generating ports in many tests
      * chore(deps): Dependency cron 2026-07-01
      * fix(ci): format inline comments in workflows to pass yamllint
      * test: Avoid running into Address already in use in fullstack test
      * feat(ci): pin GitHub Actions by commit hash

    Changes in os-autoinst:

    - Update to version 5.1783082953.c3cb41d:
      * test: Disable unstable `t/28-signalblocker.t` on ppc64le OBS builds
      * fix: Check also hidden files in checklist plugin
      * feat(ci): disable Mergify interactive queue controls in PR comments
      * test: assert pipe size adjustment dynamically
      * test: assert terminal session boundary safety
      * refactor: support pretty markers in script_sudo and become_root
      * fix: mmapi test failures and infinite loop hangs
      * test: simplify Level 3 pretty marker detection
      * fix: exclude virt-firmware on all older Leap archs

    - Update to version 5.1782917048.dcc97e9:
      * fix: Check also hidden files in checklist plugin
      * feat(ci): disable Mergify interactive queue controls in PR comments
      * fix(ci): format inline comments in workflows to pass yamllint
      * feat(ci): pin GitHub Actions by commit hash
      * test: assert pipe size adjustment dynamically
      * test: assert terminal session boundary safety
      * refactor: support pretty markers in script_sudo and become_root
      * fix: mmapi test failures and infinite loop hangs
      * test: simplify Level 3 pretty marker detection
      * fix: exclude virt-firmware on all older Leap archs

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:37385 advisory.

    Red Hat build of Podman Desktop is a graphical tool for managing containers using Podman. It allows users     to run, manage, and configure containers and container images using a desktop GUI.

    Most notable CVE and Bug Fix(es) and Enhancement(s):

    * Issues for CVE fix 1.1.1 (JIRA:RHDESK-595)
    * Fix for RHDESK-529, RHDESK-530, RHDESK-531 - fast-uri: Path traversal vulnerability allows bypass of     security policies (CVE-2026-6321)
    * Fix for RHDESK-611 - protobufjs: Arbitrary code execution due to unsafe expression generation from     crafted protobuf descriptors (CVE-2026-44293)
     * Fix for RHDESK-640 - fast-uri: URI authority bypass due to improper delimiter handling     (CVE-2026-6322)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21173-1 advisory.

    Changes in python-pydata-sphinx-theme:

    - Refresh js dependencies:
      * ws to 7.5.11 (bsc#1268957, CVE-2026-48779)

    - Refresh vendored tarball (CVE-2026-6321, bsc#1264374)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-301cbbe347 advisory.

    This update contains upgrades to various npm packages used during the build to address CVEs, namely:

    - CVE-2025-69873 (ajv)
    - CVE-2026-0540 (DOMPurify)
    - CVE-2026-3449 (@tootallnate/once)
    - CVE-2026-4800 (lodash)
    - CVE-2026-6321 (fast-uri)
    - CVE-2026-41240 (DOMPurify)

    This is probably unimportant since these packages are used at build-time only.  They are not shipped with     python3-jupytext and therefore do not affect runtime.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-793b55138d advisory.

    This update contains upgrades to various npm packages used during the build to address CVEs, namely:

    - CVE-2025-69873 (ajv)
    - CVE-2026-0540 (DOMPurify)
    - CVE-2026-3449 (@tootallnate/once)
    - CVE-2026-4800 (lodash)
    - CVE-2026-6321 (fast-uri)
    - CVE-2026-41240 (DOMPurify)

    This is probably unimportant since these packages are used at build-time only.  They are not shipped with     python3-jupytext and therefore do not affect runtime.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-85b819b928 advisory.

    This update contains upgrades to various npm packages used during the build to address CVEs, namely:

    - CVE-2025-69873 (ajv)
    - CVE-2026-0540 (DOMPurify)
    - CVE-2026-3449 (@tootallnate/once)
    - CVE-2026-4800 (lodash)
    - CVE-2026-6321 (fast-uri)
    - CVE-2026-41240 (DOMPurify)

    This is probably unimportant since these packages are used at build-time only.  They are not shipped with     python3-jupytext and therefore do not affect runtime.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in     its normalize() and equal() functions. Encoded path data was treated like real slashes and parent-     directory references, so distinct URIs could collapse onto the same normalized path. Applications that     normalize or compare attacker-controlled URLs to enforce path-based policy can be bypassed, with a path     that appears confined under an allowed prefix normalizing to a different location. Versions <= 3.1.0 are     affected. Update to 3.1.1 or later. (CVE-2026-6321)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
115702	Atlassian Jira 10.4.x < 11.3.8 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	critical
115701	Atlassian Jira < 10.3.23 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	critical
115694	Atlassian Confluence 9.3.x < 10.2.14 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
115693	Atlassian Confluence < 9.2.22 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
462686	Echo: fast-uri: security update to 2.4.1	Tenable Cloud Security	Echo Local Security Checks	Local	high
462686	Echo: fast-uri: security update to 2.4.1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
328365	RHEL 8 / 9 : Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update (Important) (RHSA-2026:42078)	Nessus	Red Hat Local Security Checks	Local	high
328359	RHEL 10 / 9 : Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update (Important) (RHSA-2026:42079)	Nessus	Red Hat Local Security Checks	Local	high
326030	openSUSE 16: openQA / openQA-auto-update / openQA-bootstrap / openQA-client / etc (openSUSE-SU-2026:21266-1)	Nessus	SuSE Local Security Checks	Local	high
325977	RHEL 10 : rh-podman-desktop (RHSA-2026:37385)	Nessus	Red Hat Local Security Checks	Local	high
324058	openSUSE 16 Security Update : python-pydata-sphinx-theme (openSUSE-SU-2026:21173-1)	Nessus	SuSE Local Security Checks	Local	high
315095	Fedora 44 : python-jupytext (2026-301cbbe347)	Nessus	Fedora Local Security Checks	Local	medium
315089	Fedora 42 : python-jupytext (2026-793b55138d)	Nessus	Fedora Local Security Checks	Local	medium
315087	Fedora 43 : python-jupytext (2026-85b819b928)	Nessus	Fedora Local Security Checks	Local	medium
441531	SCA: security update for fast-uri (GHSA-q3j6-qgpj-74h6)	Tenable Cloud Security	SCA Checks	Local	high
441531	SCA: security update for fast-uri (GHSA-q3j6-qgpj-74h6)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
312267	Linux Distros Unpatched Vulnerability : CVE-2026-6321	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-6321

high

Tenable Plugins

critical

critical

high

high

high

high

high

high

high

high

high

medium

medium

medium

high

high

high