HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets. When the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and `_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request, without checking whether the redirect target shares an origin with the original URL. Caller-supplied `Authorization`, `Cookie` and `Proxy-Authorization` headers are therefore re-sent to whatever host the redirect names, across scheme, host or port boundaries, and including `https` to `http` downgrades that expose them in plaintext on the wire. The HTTP::Tiny POD note that "Authorization headers will not be included in a redirected request" applied only to the URL-userinfo Basic-auth path, not to headers passed explicitly by the caller.

The remote Ubuntu 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8684-1 advisory.

    It was discovered that Perl incorrectly handled certain arguments to Socket and pack/unpack functions. An     attacker could possibly use this issue to read sensitive information from memory. (CVE-2026-12087,     CVE-2026-57432)

    It was discovered that Perl incorrectly handled regular expressions with a large number of alternation     branches. An attacker could possibly use this issue to cause incorrect matching results. (CVE-2026-13221)

    It was discovered that Perl incorrectly handled certain files. An attacker could possibly use this issue     to cause a denial of service. (CVE-2026-57433, CVE-2025-15649, CVE-2026-48959, CVE-2026-9538)

    It was discovered that Perl incorrectly handled certain inputs. An attacker could possibly use this issue     to execute arbitrary code. (CVE-2026-48962)

    It was discovered that Perl incorrectly handled credential headers during cross-origin redirects in     HTTP::Tiny. An attacker could possibly use this issue to expose sensitive information. (CVE-2026-7017)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3194 advisory.

    HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets.

    When the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and     `_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request, without checking     whether the redirect target shares an origin with the original URL. Caller-supplied `Authorization`,     `Cookie` and `Proxy-Authorization` headers are therefore re-sent to whatever host the redirect names,     across scheme, host or port boundaries, and including `https` to `http` downgrades that expose them in     plaintext on the wire.

    The HTTP::Tiny POD note that Authorization headers will not be included in a redirected request applied     only to the URL-userinfo Basic-auth path, not to headers passed explicitly by the caller. (CVE-2026-7017)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of perl-HTTP-Tiny installed on the remote host is prior to 0.033-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3986 advisory.

    HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets.

    When the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and     `_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request, without checking     whether the redirect target shares an origin with the original URL. Caller-supplied `Authorization`,     `Cookie` and `Proxy-Authorization` headers are therefore re-sent to whatever host the redirect names,     across scheme, host or port boundaries, and including `https` to `http` downgrades that expose them in     plaintext on the wire.

    The HTTP::Tiny POD note that Authorization headers will not be included in a redirected request applied     only to the URL-userinfo Basic-auth path, not to headers passed explicitly by the caller. (CVE-2026-7017)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the perl-HTTP-Tiny packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets.

    When the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and     `_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request, without checking     whether the redirect target shares an origin with the original URL. Caller-supplied `Authorization`,     `Cookie` and `Proxy-Authorization` headers are therefore re-sent to whatever host the redirect names,     across scheme, host or port boundaries, and including `https` to `http` downgrades that expose them in     plaintext on the wire.

    The HTTP::Tiny POD note that 'Authorization headers will not be included in a redirected request' applied     only to the URL-userinfo Basic-auth path, not to headers passed explicitly by the caller.(CVE-2026-7017)

Tenable has extracted the preceding description block directly from the EulerOS perl-HTTP-Tiny security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the perl-HTTP-Tiny packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect     targets._x000D_
    _x000D_     When the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and     `_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request, without checking     whether the redirect target shares an origin with the original URL. Caller-supplied `Authorization`,     `Cookie` and `Proxy-Authorization` headers are therefore re-sent to whatever host the redirect names,     across scheme, host or port boundaries, and including `https` to `http` downgrades that expose them in     plaintext on the wire._x000D_
    _x000D_     The HTTP::Tiny POD note that 'Authorization headers will not be included in a redirected request' applied     only to the URL-userinfo Basic-auth path, not to headers passed explicitly by the caller.(CVE-2026-7017)

Tenable has extracted the preceding description block directly from the EulerOS perl-HTTP-Tiny security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4821 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4821-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                     Arnaud Rebillout     October 05, 2026                              https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : perl     Version        : 5.36.0-7+deb12u4     CVE ID         : CVE-2025-15649 CVE-2026-7010 CVE-2026-7017 CVE-2026-8376                      CVE-2026-12087 CVE-2026-13221 CVE-2026-19487 CVE-2026-42496                      CVE-2026-42497 CVE-2026-48959 CVE-2026-48962 CVE-2026-57432                      CVE-2026-57433     Debian Bug     : 1137345 1138854 1138856 1138858 1138859 1138860 1138863                      1138905 1138906 1140152 1141639 1142037 1144668

    Multiple vulnerabilities were discovered in the Perl programming language.

    CVE-2025-15649

        header parsing in IO::Uncompress::Unzip

        IO::Uncompress::Unzip versions before 2.215 for Perl propagate         uncaught exception when parsing zip header with malformed DOS date.
        _dosToUnixTime() decodes the local-file-header last-modification date         field and calls Time::Local::timelocal() without an eval guard. A         header whose date field decodes to an out-of-range month, day, or         hour causes timelocal() to die. The exception propagates out of         IO::Uncompress::Unzip->new($file) where callers expect undef plus         $UnzipError.

    CVE-2026-7010

        CRLF-validation in HTTP::Tiny

        HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in         HTTP request lines or control field header values. The unvalidated         inputs are the method and URI in the request line, the URL host that         becomes the `Host:` header, and HTTP/1.1 control data field values.
        An attacker who controls one of these inputs, for example a user         supplied URL passed to a webhook or URL fetch endpoint, can inject         additional headers and smuggle requests to the upstream server.

    CVE-2026-7017

        HTTP::Tiny credential forwarding on redirects

        HTTP::Tiny versions before 0.095 for Perl forward credential headers         to cross-origin redirect targets. When the server returns a 3xx         redirect, `_maybe_redirect` follows the `Location:` header and         `_prepare_headers_and_cb` re-merges the caller's `headers` argument         into the new request, without checking whether the redirect target         shares an origin with the original URL. Caller-supplied         `Authorization`, `Cookie` and `Proxy-Authorization` headers are         therefore re-sent to whatever host the redirect names, across scheme,         host or port boundaries, and including `https` to `http` downgrades         that expose them in plaintext on the wire. The HTTP::Tiny POD note         that Authorization headers will not be included in a redirected         request applied only to the URL-userinfo Basic-auth path, not to         headers passed explicitly by the caller.

    CVE-2026-8376

        Buffer overflow in Perl_study_chunk

        Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from         5.43.0 before 5.43.11 have a heap buffer overflow when compiling         regular expressions with a repeated fixed string on 32-bit builds.
        Perl_study_chunk in regcomp_study.c checked the size of the joined         substring buffer in characters rather than bytes. For a quantified         fixed substring with a large minimum count, the byte length mincount
        * l could overflow SSize_t, producing an undersized SvGROW         allocation; the subsequent copy writes past the end of the buffer. A         caller that compiles an attacker-controlled regular expression on a         32-bit perl build triggers a heap buffer overflow at compile time.

    CVE-2026-12087

        Socket: pack_ip_mreq_source() out-of-bounds heap read

        Socket versions before 2.041 for Perl have an out-of-bounds heap         read. In Socket.xs, pack_ip_mreq_source() checks the length of its         source argument before the argument is read, so the check tests the         byte length carried over from the preceding multiaddr argument         instead. Both addresses occupy a 4-byte field, so a valid multiaddr         lets a source of any length pass the check, and the source is then         copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A         source shorter than 4 bytes is not rejected, and the copy reads up to         3 bytes past the end of its buffer. Calling pack_ip_mreq_source()         with a source value shorter than 4 bytes copies adjacent heap memory         into the returned packed structure.

    CVE-2026-13221

        silently incorrect regular expression matches

        Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from         5.43.0 before 5.43.10 produce silently incorrect regular expression         matches when an alternation of more than 65535 fixed string branches         is compiled into a trie in Perl_study_chunk. When such branches are         combined into a trie, the delta between the first branch and the         shared tail is stored in a 16-bit field. A branch count above 65535         overflows the field, and the trie's match decision table is truncated         with no warning or error. A pattern of this shape produces false         positive matches (matching strings it should not) and false negative         matches (failing to match strings it should). When such a pattern         gates an access or filtering decision, the result is wrong.

    CVE-2026-19487

        incorrect regular expression match results

        Perl versions from 5.9.4 before 5.41.9 produce incorrect regular         expression match results when a stale failure flag ends the         Aho-Corasick prescan early in S_find_byclass. The prescan walks the         subject for positions where the full pattern could match, and the         engine tries it from the leftmost one recorded. A failing transition         sets the failed flag, and a later successful transition does not         clear it, so the prescan reads the stale flag as a failure and stops         before it can record a candidate that starts earlier. It takes a         subject where one candidate is recorded and a later character then         forces a fallback through a fail link that succeeds. Example: ABCDE         =~ m/ABCF|BCDE|C/; # matches C at offset 2, not BCDE ABCDE =~         m/ABCF|BCDE|C(G)/; # no match, BCDE missed An alternation like this         can miss input it should match, or match it on the wrong branch, so         an access or filtering decision made from the result can be wrong.

    CVE-2026-42496

        Archive::Tar symlink extraction

        Archive::Tar versions before 3.08 for Perl extract symlinks with         attacker controlled targets outside the extraction directory.
        _make_special_file() passes the tar header's linkname to symlink()         without validating it against absolute paths or .. segments. The         secure-extract mode check that guards regular file extraction does         not cover the symlink target. A subsequent open through the extracted         name reads or writes the attacker chosen path.

    CVE-2026-42497

        Archive::Tar hardlink extraction

        Archive::Tar versions before 3.08 for Perl extract hardlinks to         attacker controlled paths outside the extraction directory.
        _make_special_file() passes the tar header's linkname to link()         without validating it against absolute paths or .. segments, creating         a hardlink that shares the victim file's inode. A subsequent write         through the extracted name modifies the victim file, and the         post-extraction chmod, chown, and utime block in _extract_file()         (guarded only against symlinks via -l) applies the tar header's mode,         owner, and timestamps to the shared inode during extraction alone.

    CVE-2026-48959

        CPU exhaustion in IO::Uncompress::Unzip

        IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU         exhaustion via per-byte read loop in fastForward. fastForward()         compares length $offset (the digit count of the offset, 1 to 19)         against the chunk size $c instead of $offset itself, so $c shrinks         from 16 KiB to 1-19 bytes per iteration. Extracting a named entry         from an attacker supplied zip via IO::Uncompress::Unzip->new($zip,         Name => $target) drives a per-byte read loop scaling with the entry's         compressed size, up to the non-Zip64 4 GiB cap.

    CVE-2026-48962

        code execution in IO-Compress via output globs

        IO::Compress versions before 2.220 for Perl can execute arbitrary         code in File::GlobMapper via an attacker-controlled output glob.
        _parseOutputGlob() wraps the caller-supplied output glob string in         double quotes and stores it in the parser state; _getFiles() then         runs the stored expression through eval STRING. A literal double         quote in the output glob closes the dquote wrapper, and the         characters that follow are evaluated as Perl. Arbitrary Perl in the         output glob executes at the calling process's privilege.

    CVE-2026-57432

        out of bound heap reads in pack() and unpack()

        Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from         5.43.0 before 5.43.11 have an integer overflow in S_measure_struct         leading to an out-of-bounds heap read in pack and unpack.
        S_measure_struct adds each item's size times its repeat count to a         running total with no overflow check, so a large repeat count in a         pack or unpack template wraps the signed SSize_t total negative. The         @, X, and x position codes then guard their moves with a signed         length comparison that passes when the length is negative, advancing         the buffer pointer out of bounds. A template derived from untrusted         input can read heap memory past the buffer and return it to the         caller.

    CVE-2026-57433

        signed integer overflow in Storable

        Storable versions before 3.41 for Perl have a signed integer overflow         when deserializing a crafted SX_HOOK record. retrieve_hook_common         reads a signed 32-bit item count from an SX_HOOK record and calls         av_extend with that count plus one. A count of I32_MAX wraps the         addition to a negative value. A crafted blob passed to thaw or         retrieve triggers the overflow; av_extend receives the negative count         and dies with a panic, terminating the deserialization.

    For Debian 12 bookworm, these problems have been fixed in version     5.36.0-7+deb12u4.

    We recommend that you upgrade your perl packages.

    For the detailed security status of perl please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/perl

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets.
    When the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and
    `_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request, without checking
    whether the redirect target shares an origin with the original URL. Caller-supplied `Authorization`,
    `Cookie` and `Proxy-Authorization` headers are therefore re-sent to whatever host the redirect names,
    across scheme, host or port boundaries, and including `https` to `http` downgrades that expose them in
    plaintext on the wire. The HTTP::Tiny POD note that "Authorization headers will not be included in a
    redirected request" applied only to the URL-userinfo Basic-auth path, not to headers passed explicitly by
    the caller. (CVE-2026-7017)

According to the versions of the perl-HTTP-Tiny package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets.When     the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and     `_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request, without checking     whether the redirect target shares an origin with the original URL. Caller-supplied `Authorization`,     `Cookie` and `Proxy-Authorization` headers are therefore re-sent to whatever host the redirect names,     across scheme, host or port boundaries, and including `https` to `http` downgrades that expose them in     plaintext on the wire.The HTTP::Tiny POD note that 'Authorization headers will not be included in a     redirected request' applied only to the URL-userinfo Basic-auth path, not to headers passed explicitly by     the caller.(CVE-2026-7017)

    HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP request lines or control field     header values.The unvalidated inputs are the method and URI in the request line, the URL host that becomes     the `Host:` header, and HTTP/1.1 control data field values.An attacker who controls one of these inputs,     for example a user supplied URL passed to a webhook or URL fetch endpoint, can inject additional headers     and smuggle requests to the upstream server.(CVE-2026-7010)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization perl-HTTP-Tiny security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the perl-HTTP-Tiny packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets.

    When the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and     `_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request, without checking     whether the redirect target shares an origin with the original URL. Caller-supplied `Authorization`,     `Cookie` and `Proxy-Authorization` headers are therefore re-sent to whatever host the redirect names,     across scheme, host or port boundaries, and including `https` to `http` downgrades that expose them in     plaintext on the wire.

    The HTTP::Tiny POD note that 'Authorization headers will not be included in a redirected request' applied     only to the URL-userinfo Basic-auth path, not to headers passed explicitly by the caller.(CVE-2026-7017)

    HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP request lines or control field     header values.

    The unvalidated inputs are the method and URI in the request line, the URL host that becomes the `Host:`     header, and HTTP/1.1 control data field values.

    An attacker who controls one of these inputs, for example a user supplied URL passed to a webhook or URL     fetch endpoint, can inject additional headers and smuggle requests to the upstream server.(CVE-2026-7010)

Tenable has extracted the preceding description block directly from the EulerOS perl-HTTP-Tiny security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21529-1 advisory.

    Changes in perl-HTTP-Tiny:

    - updated to 0.096
    - CVE-2026-7017: Fixed forwarded credential headers to cross-origin redirect targets (bsc#1271020)
    - Caller-supplied Authorization, Cookie, and Proxy-Authorization       headers are now stripped on cross-origin redirects by default. Use       allow_credentialed_redirects to opt out.
    - Redirects are no longer automatically followed when going from https to http.
      Use allow_downgrade to revert to the original behaviour.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0610 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-7017:
    HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets.
    When the server returns a 3xx redirect, _maybe_redirect follows the Location: header and
    _prepare_headers_and_cb re-merges the caller's headers argument into the new request, without checking     whether the redirect target shares an origin with the original URL. Caller-supplied Authorization, Cookie     and Proxy-Authorization headers are therefore re-sent to whatever host the redirect names, across scheme,     host or port boundaries, and including https to http downgrades that expose them in plaintext on the wire.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets.
    When the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and     `_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request, without checking     whether the redirect target shares an origin with the original URL. Caller-supplied `Authorization`,     `Cookie` and `Proxy-Authorization` headers are therefore re-sent to whatever host the redirect names,     across scheme, host or port boundaries, and including `https` to `http` downgrades that expose them in     plaintext on the wire. The HTTP::Tiny POD note that Authorization headers will not be included in a     redirected request applied only to the URL-userinfo Basic-auth path, not to headers passed explicitly by     the caller. (CVE-2026-7017)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
365405	Ubuntu 24.04 LTS : Perl vulnerabilities (USN-8684-1)	Nessus	Ubuntu Local Security Checks	Local	critical
365201	Amazon Linux 2023 : perl-HTTP-Tiny, perl-HTTP-Tiny-tests (ALAS2023-2026-3194)	Nessus	Amazon Linux Local Security Checks	Local	high
365180	Amazon Linux 2 : perl-HTTP-Tiny (ALAS-2026-3986)	Nessus	Amazon Linux Local Security Checks	Local	high
365022	EulerOS 2.0 SP11 : perl-HTTP-Tiny (EulerOS-SA-2026-4360)	Nessus	Huawei Local Security Checks	Local	high
364900	EulerOS 2.0 SP11 : perl-HTTP-Tiny (EulerOS-SA-2026-4270)	Nessus	Huawei Local Security Checks	Local	high
364798	EulerOS 2.0 SP13 : perl-HTTP-Tiny (EulerOS-SA-2026-4086)	Nessus	Huawei Local Security Checks	Local	high
364765	EulerOS 2.0 SP13 : perl-HTTP-Tiny (EulerOS-SA-2026-4177)	Nessus	Huawei Local Security Checks	Local	high
364028	EulerOS 2.0 SP15 : perl-HTTP-Tiny (EulerOS-SA-2026-3938)	Nessus	Huawei Local Security Checks	Local	high
363992	EulerOS 2.0 SP15 : perl-HTTP-Tiny (EulerOS-SA-2026-4004)	Nessus	Huawei Local Security Checks	Local	high
362949	Debian dla-4821 : libperl-dev - security update	Nessus	Debian Local Security Checks	Local	critical
461840	Echo: perl: security update to 5.40.1-6+e18	Tenable Cloud Security	Echo Local Security Checks	Local	high
461840	Echo: perl: security update to 5.40.1-6+e18	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
348041	EulerOS Virtualization 2.12.1 : perl-HTTP-Tiny (EulerOS-SA-2026-3606)	Nessus	Huawei Local Security Checks	Local	high
347274	EulerOS Virtualization 2.12.0 : perl-HTTP-Tiny (EulerOS-SA-2026-3660)	Nessus	Huawei Local Security Checks	Local	high
343687	EulerOS 2.0 SP12 : perl-HTTP-Tiny (EulerOS-SA-2026-3294)	Nessus	Huawei Local Security Checks	Local	high
343674	EulerOS 2.0 SP12 : perl-HTTP-Tiny (EulerOS-SA-2026-3369)	Nessus	Huawei Local Security Checks	Local	high
333006	openSUSE 16 Security Update : perl-HTTP-Tiny (openSUSE-SU-2026:21529-1)	Nessus	SuSE Local Security Checks	Local	high
328387	TencentOS Server 4: perl-HTTP-Tiny (TSSA-2026:0610)	Nessus	Tencent Local Security Checks	Local	high
325549	Linux Distros Unpatched Vulnerability : CVE-2026-7017	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-7017

high

Tenable Plugins

critical

high

high

high

high

high

high

high

high

critical

high

high

high

high

high

high

high

high

high