`Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag siblings. `Element.find()` is only affected when the first match is near the end of the sibling list, such as with `[last()]` or `[last()-N]`; `.//item[1]` short-circuits after the first match.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4744-1 advisory.

    Security issues fixed:

    - CVE-2026-6879: quadratic behavior in `xml.etree.ElementPath` index predicates can lead to a denial of     service via high       CPU usage (bsc#1273148).
    - CVE-2026-9669: crafted input can cause a stack buffer overflow (bsc#1267974).
    - CVE-2026-15310: memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression (bsc#1277111).
    - CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme     (bsc#1276223).
    - CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0     (bsc#1276226).
    - CVE-2026-18503: attacker-controlled CSV samples can trigger super-linear regular-expression work during     dialect       sniffing and consume significant CPU (bsc#1274683).
    - CVE-2026-19672: tarfile extraction filter bypass allows creation of directories outside the destination     (bsc#1276227).
    - CVE-2026-82049: tarfile extraction filters mishandle archives containing a hard link to a symbolic link,     allowing file       modification and content disclosure (bsc#1280459).

    Changes for python3:

    - Update bundled setuptools wheels to setuptools-40.6.2 (bsc#1276903).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4743-1 advisory.

    Security issues fixed:

    - CVE-2026-1703: files may be extracted outside the installation directory when installing and extracting     maliciously       crafted wheel archives (bsc#1274743).
    - CVE-2026-3219: pip doesn't reject concatenated ZIP (bsc#1262429).
    - CVE-2026-3446: Base64 decoding stops at first padded quad by default (bsc#1261970).
    - CVE-2026-3479: python: improper resource argument validation can allow path traversal (bsc#1259989).
    - CVE-2026-4224: C stack overflow when parsing XML with deeply nested DTD content models (bsc#1259735).
    - CVE-2026-6879: quadratic behavior in `xml.etree.ElementPath` index predicates can lead to a denial of     service via high       CPU usage (bsc#1273148).
    - CVE-2026-9669: crafted input can cause a stack buffer overflow (bsc#1267974).
    - CVE-2026-13346: Arbitrary file installation via malicious package indexes (bsc#1273090 bsc#1273091     bsc#1273094).
    - CVE-2026-15310: memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression (bsc#1277111).
    - CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme     (bsc#1276223).
    - CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0     (bsc#1276226).
    - CVE-2026-18503: attacker-controlled CSV samples can trigger super-linear regular-expression work during     dialect       sniffing and consume significant CPU (bsc#1274683).
    - CVE-2026-19672: tarfile extraction filter bypass allows creation of directories outside the destination     (bsc#1276227).
    - CVE-2026-82049: tarfile extraction filters mishandle archives containing a hard link to a symbolic link,     allowing file       modification and content disclosure (bsc#1280459).

    Non security issue fixed:

    - Update bundled setuptools wheels to      setuptools-44.1.1-py2.py3-none-any.whl (bsc#1277271)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4633-1 advisory.

    - CVE-2026-6879: quadratic behavior in `xml.etree.ElementPath` index predicates can lead to a denial of     service via high       CPU usage (bsc#1273148).
    - CVE-2026-9669: crafted input can cause a stack buffer overflow (bsc#1267974).
    - CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme     (bsc#1276223).
    - CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0     (bsc#1276226).
    - CVE-2026-18503: attacker-controlled CSV samples can trigger super-linear regular-expression work during     dialect       sniffing and consume significant CPU (bsc#1274683).
    - CVE-2026-19672: The tarfile module's tar and data extraction filters created directories outside the     destination for       members whose name leaves the destination and retu (bsc#1276227).

    Changes for python:

    - Update bundled setuptools wheels to setuptools-40.6.2-py2.py3-none-any.whl (bsc#1276903)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1791921187 advisory.

  - Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing     and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff().
    (CVE-2026-18503)

  - `Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using     XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag     siblings. `Element.find()` is only affected when the first match is near the end of the sibling list, such     as with `[last()]` or `[last()-N]`; `.//item[1]` short-circuits after the first match. (CVE-2026-6879)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the python3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    unicodedata.normalize() can take excessive CPU time when processing     specially crafted Unicode input containing long runs of combining characters     with alternating Canonical Combining Class values.
    This affects all normalization forms.(CVE-2026-3276)

    tarfile.extractall() with the 'data' or 'tar'      filter could be bypassed by a crafted archive where a hardlink     references a symlink stored at a deeper name than the hardlink itself.
    The extraction fallback validated the symlink at it's archived location     but recreated it at the hardlink's shallower     path, letting a relative      target the filter judged contained escape the destination directory.
    This allowed a malicious tar archive to create a symlink pointing     outside the destination, enabling out-of-destination file reads or     writes. This was an incomplete fix of CVE-2025-4330.(CVE-2026-11940)

    When an Expat parser with a registered ElementDeclHandler parses an inline     document type definition containing a deeply nested content model a C stack     overflow occurs.(CVE-2026-4224)

    `Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using     XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag     siblings. `Element.find()` is only affected when the first match is near the end  of the sibling list,     such as with `[last()]` or `[last()-N]`;  `.//item[1]` short-circuits after the first     match.(CVE-2026-6879)

    tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or     directory-like names, to redirect later archive members outside the intended extraction directory. This     allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination     directory, subject to the permissions of the extracting process.(CVE-2026-7774)

    `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding     protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this     vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.(CVE-2026-7210)

    http.cookies.Morsel.js_output() returns an inline script snippet and only escapes ' for JavaScript     string context. It does not neutralize the HTML parser-sensitive sequence /script inside the     generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie     value.(CVE-2026-6019)

    In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks.
    An affected system that extracts content from untrusted tar files could end up writing files with an     unexpected uid/gid despite the user passing filter='data' to the extract() function.(CVE-2026-4360)

    When using the 'tarfile' module with a file opened in 'streaming mode' (mode='r|') the tarfile module did     not properly handle EOF, making archive parsing take exponentially longer.(CVE-2026-11972)

    When using the 'configparser' module to write configuration files     containing multi-line text values with carriage return characters (\r) the     resulting file could be injected with unexpected keys and values if the     attacker controls the written value.(CVE-2026-0864)

    The ftpcp() function in Lib/ftplib.py was not updated when     CVE-2021-4189 was fixed. While makepasv() was patched to replace     server-supplied PASV host addresses with the actual peer address     (getpeername()[0]), ftpcp() still calls parse227() directly and passes     the raw attacker-controllable IP address and port to target.sendport(). This patch is related to     CVE-2021-4189.(CVE-2026-8328)

    The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The     Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass     input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to     BaseCookie.output().(CVE-2026-3644)

    bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the     resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to     resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash     the process when processing untrusted data.(CVE-2026-9669)

    The import hook in CPython that handles legacy *.pyc files (SourcelessFileLoader) is incorrectly handled     in FileLoader (a base class) and so does not use io.open_code() to read the .pyc files. sys.audit handlers     for this audit event therefore do not fire.(CVE-2026-2297)

    Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and     `gzip.GzipFile` when a memory allocation fails with a `MemoryError` and the decompression instance is re-     used. This scenario can be triggered if the process is under memory pressure. The fix cleans up the     dangling pointer in this specific error condition.

    The vulnerability is only present if the program re-uses decompressor instances across multiple     decompression calls even after a `MemoryError` is raised during decompression. Using the helper functions     to one-shot decompress data such as `lzma.decompress()`, `bz2.decompress()`, `gzip.decompress()`, and     `zlib.decompress()` are not affected as a new decompressor instance is used per call. If the decompressor     instance is not re-used after an error condition, this usage is similarly not vulnerable.(CVE-2026-6100)

    The webbrowser.open() API would accept leading dashes in the URL which     could be handled as command line options for certain web browsers. New     behavior rejects leading dashes. Users are recommended to sanitize URLs     prior to passing to webbrowser.open().(CVE-2026-4519)

Tenable has extracted the preceding description block directly from the EulerOS python3 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the python3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    `Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using     XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag     siblings. `Element.find()` is only affected when the first match is near the end of the sibling list, such     as with `[last()]` or `[last()-N]`; `.//item[1]` short-circuits after the first match.(CVE-2026-6879)

    In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks.
    An affected system that extracts content from untrusted tar files could end up writing files with an     unexpected uid/gid despite the user passing filter='data' to the extract() function.(CVE-2026-4360)

    `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding     protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this     vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.(CVE-2026-7210)

    The ftpcp() function in Lib/ftplib.py was not updated when     CVE-2021-4189 was fixed. While makepasv() was patched to replace     server-supplied PASV host addresses with the actual peer address     (getpeername()[0]), ftpcp() still calls parse227() directly and passes     the raw attacker-controllable IP address and port to target.sendport(). This patch is related to     CVE-2021-4189.(CVE-2026-8328)

    unicodedata.normalize() can take excessive CPU time when processing     specially crafted Unicode input containing long runs of combining characters     with alternating Canonical Combining Class values.
    This affects all normalization forms.(CVE-2026-3276)

    When using the 'configparser' module to write configuration files     containing multi-line text values with carriage return characters (\r) the     resulting file could be injected with unexpected keys and values if the     attacker controls the written value.(CVE-2026-0864)

    When using the 'tarfile' module with a file opened in 'streaming mode' (mode='r|') the tarfile module did     not properly handle EOF, making archive parsing take exponentially longer.(CVE-2026-11972)

    tarfile.extractall() with the 'data' or 'tar'      filter could be bypassed by a crafted archive where a hardlink     references a symlink stored at a deeper name than the hardlink itself.
    The extraction fallback validated the symlink at it's archived location     but recreated it at the hardlink's shallower     path, letting a relative      target the filter judged contained escape the destination directory.
    This allowed a malicious tar archive to create a symlink pointing     outside the destination, enabling out-of-destination file reads or     writes. This was an incomplete fix of CVE-2025-4330.(CVE-2026-11940)

    http.cookies.Morsel.js_output() returns an inline script snippet and only escapes ' for JavaScript     string context. It does not neutralize the HTML parser-sensitive sequence /script inside the     generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie     value.(CVE-2026-6019)

    Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and     `gzip.GzipFile` when a memory allocation fails with a `MemoryError` and the decompression instance is re-     used. This scenario can be triggered if the process is under memory pressure. The fix cleans up the     dangling pointer in this specific error condition.

    The vulnerability is only present if the program re-uses decompressor instances across multiple     decompression calls even after a `MemoryError` is raised during decompression. Using the helper functions     to one-shot decompress data such as `lzma.decompress()`, `bz2.decompress()`, `gzip.decompress()`, and     `zlib.decompress()` are not affected as a new decompressor instance is used per call. If the decompressor     instance is not re-used after an error condition, this usage is similarly not vulnerable.(CVE-2026-6100)

    bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the     resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to     resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash     the process when processing untrusted data.(CVE-2026-9669)

    tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or     directory-like names, to redirect later archive members outside the intended extraction directory. This     allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination     directory, subject to the permissions of the extracting process.(CVE-2026-7774)

    The webbrowser.open() API would accept leading dashes in the URL which     could be handled as command line options for certain web browsers. New     behavior rejects leading dashes. Users are recommended to sanitize URLs     prior to passing to webbrowser.open().(CVE-2026-4519)

    The import hook in CPython that handles legacy *.pyc files (SourcelessFileLoader) is incorrectly handled     in FileLoader (a base class) and so does not use io.open_code() to read the .pyc files. sys.audit handlers     for this audit event therefore do not fire.(CVE-2026-2297)

    The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The     Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass     input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to     BaseCookie.output().(CVE-2026-3644)

    When an Expat parser with a registered ElementDeclHandler parses an inline     document type definition containing a deeply nested content model a C stack     overflow occurs.(CVE-2026-4224)

Tenable has extracted the preceding description block directly from the EulerOS python3 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - `Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using
    XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag
    siblings. `Element.find()` is only affected when the first match is near the end of the sibling list, such
    as with `[last()]` or `[last()-N]`; `.//item[1]` short-circuits after the first match. (CVE-2026-6879)

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4411-1 advisory.

    - CVE-2026-6879: quadratic behavior in `xml.etree.ElementPath` index predicates can lead to a denial of     service via high       CPU usage (bsc#1273148).
    - CVE-2026-9669: crafted input can cause a stack buffer overflow (bsc#1267974).
    - CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme     (bsc#1276223).
    - CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0     (bsc#1276226).
    - CVE-2026-18503: attacker-controlled CSV samples can trigger super-linear regular-expression work during     dialect       sniffing and consume significant CPU (bsc#1274683).
    - CVE-2026-19672: The tarfile module's tar and data extraction filters created directories outside the     destination for       members whose name leaves the destination and retu (bsc#1276227).

    Changes for python:

    - Update bundled setuptools wheels to setuptools-40.6.2-py2.py3-none-any.whl (bsc#1276903)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4401-1 advisory.

    Security issues fixed:

    - CVE-2026-6879: quadratic behavior in `xml.etree.ElementPath` index predicates can lead to a denial of     service via high       CPU usage (bsc#1273148).
    - CVE-2026-9669: crafted input can cause a stack buffer overflow (bsc#1267974).
    - CVE-2026-17084: [Security-announce][] StringPrep algorithm considered (bsc#1276226).
    - CVE-2026-18503: attacker-controlled CSV samples can trigger super-linear regular-expression work during     dialect       sniffing and consume significant CPU (bsc#1274683).

    Non security issue fixed:

    - Conflicts between different versions of Python (bsc#1258364).
    - Updated to version 3.13.15

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-109800 advisory.

    `Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using     XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag     siblings. `Element.find()` is only affected when the first match is near the end of the sibling list,     such as with `[last()]` or `[last()-N]`; `.//item[1]` short-circuits after the first match.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2122 advisory.

    Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing     and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff().
    (CVE-2026-18503)

    `Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using     XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag     siblings. `Element.find()` is only affected when the first match is near the end  of the sibling list,     such as with `[last()]` or `[last()-N]`;  `.//item[1]` short-circuits after the first match.
    (CVE-2026-6879)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2123 advisory.

    Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing     and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff().
    (CVE-2026-18503)

    `Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using     XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag     siblings. `Element.find()` is only affected when the first match is near the end  of the sibling list,     such as with `[last()]` or `[last()-N]`;  `.//item[1]` short-circuits after the first match.
    (CVE-2026-6879)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2124 advisory.

    Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing     and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff().
    (CVE-2026-18503)

    `Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using     XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag     siblings. `Element.find()` is only affected when the first match is near the end  of the sibling list,     such as with `[last()]` or `[last()-N]`;  `.//item[1]` short-circuits after the first match.
    (CVE-2026-6879)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2125 advisory.

    Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing     and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff().
    (CVE-2026-18503)

    `Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using     XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag     siblings. `Element.find()` is only affected when the first match is near the end  of the sibling list,     such as with `[last()]` or `[last()-N]`;  `.//item[1]` short-circuits after the first match.
    (CVE-2026-6879)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - `Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using     XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag     siblings. `Element.find()` is only affected when the first match is near the end of the sibling list, such     as with `[last()]` or `[last()-N]`; `.//item[1]` short-circuits after the first match. (CVE-2026-6879)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
367741	SUSE SLES12: libpython3_4m1_0 / libpython3_4m1_0-32bit / python3 / python3-base / etc (SUSE-SU-2026:4744-1)	Nessus	SuSE Local Security Checks	Local	high
367738	SUSE SLES12: libpython3_6m1_0 / libpython3_6m1_0-32bit / python36 / etc (SUSE-SU-2026:4743-1)	Nessus	SuSE Local Security Checks	Local	high
365550	SUSE SLES12: libpython2_7-1_0 / libpython2_7-1_0-32bit / python / python-32bit / etc (SUSE-SU-2026:4633-1)	Nessus	SuSE Local Security Checks	Local	high
365491	AlmaLinux 9.2 [TuxCare] Security Update: python3.11 / python3.11-debug / python3.11-devel / python3.11-idle / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1791921187)	Nessus	Alma Linux Local Security Checks	Local	low
365006	EulerOS 2.0 SP13 : python3 (EulerOS-SA-2026-4192)	Nessus	Huawei Local Security Checks	Local	critical
364947	EulerOS 2.0 SP11 : python3 (EulerOS-SA-2026-4283)	Nessus	Huawei Local Security Checks	Local	critical
364930	EulerOS 2.0 SP11 : python3 (EulerOS-SA-2026-4373)	Nessus	Huawei Local Security Checks	Local	critical
364834	EulerOS 2.0 SP13 : python3 (EulerOS-SA-2026-4101)	Nessus	Huawei Local Security Checks	Local	critical
459922	Echo: python3.13: security update to 3.13.5-2+e37	Tenable Cloud Security	Echo Local Security Checks	Local	low
459922	Echo: python3.13: security update to 3.13.5-2+e37	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	low
362580	SUSE SLES15: libpython2_7-1_0 / python / python-base / python-curses / etc (SUSE-SU-2026:4411-1)	Nessus	SuSE Local Security Checks	Local	high
362493	SUSE SLED15: libpython3_13-1_0 / python313 / python313-base / python313-curses / etc (SUSE-SU-2026:4401-1)	Nessus	SuSE Local Security Checks	Local	high
347024	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python3 (UTSA-2026-109800)	Nessus	Unity Linux Local Security Checks	Local	low
342050	Amazon Linux 2023 : python3.14, python3.14-devel, python3.14-freethreading (ALAS2023-2026-2122)	Nessus	Amazon Linux Local Security Checks	Local	low
342049	Amazon Linux 2023 : python3.13, python3.13-devel, python3.13-freethreading (ALAS2023-2026-2123)	Nessus	Amazon Linux Local Security Checks	Local	low
342048	Amazon Linux 2023 : python3.12, python3.12-devel, python3.12-idle (ALAS2023-2026-2124)	Nessus	Amazon Linux Local Security Checks	Local	low
341864	Amazon Linux 2023 : python3.11, python3.11-devel, python3.11-idle (ALAS2023-2026-2125)	Nessus	Amazon Linux Local Security Checks	Local	low
330636	Linux Distros Unpatched Vulnerability : CVE-2026-6879	Nessus	Misc.	Local	low

Detections

Analytics

CVE-2026-6879

low

Tenable Plugins

high

high

high

low

critical

critical

critical

critical

low

low

high

high

low

low

low

low

low

low