Solution

Update the affected python-pyasn1 packages.

EulerOS 2.0 SP10 : sqlite (EulerOS-SA-2026-2672)

Tue, 14 Jul 2026 00:00:00 GMT

Nessus Plugin ID 326634 with High Severity

Synopsis

The remote EulerOS host is missing a security update.

Update the affected dnsmasq packages.

EulerOS 2.0 SP10 : mesa (EulerOS-SA-2026-2662)

Tue, 14 Jul 2026 00:00:00 GMT

Nessus Plugin ID 326620 with Critical Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

Solution

Update the affected mesa packages.

EulerOS 2.0 SP10 : shim (EulerOS-SA-2026-2671)

Tue, 14 Jul 2026 00:00:00 GMT

Nessus Plugin ID 326619 with High Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the shim package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

Issue summary: When a delta CRL that contains a Delta CRL Indicator extension is processed a NULL pointer dereference might happen if the required CRL Number extension is missing.

Impact summary: A NULL pointer dereference can trigger a crash which leads to a Denial of Service for an application.

When CRL processing and delta CRL processing is enabled during X.509 certificate verification, the delta CRL processing does not check whether the CRL Number extension is NULL before dereferencing it.
When a malformed delta CRL file is being processed, this parameter can be NULL, causing a NULL pointer dereference.

Exploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in the verification context, the certificate being verified to contain a freshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and an attacker to provide a malformed CRL to an application that processes it.

The vulnerability is limited to Denial of Service and cannot be escalated to achieve code execution or memory disclosure. For that reason the issue was assessed as Low severity according to our Security Policy.

The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-28388)

Tenable has extracted the preceding description block directly from the EulerOS shim security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected shim packages.

EulerOS 2.0 SP10 : perl (EulerOS-SA-2026-2666)

Tue, 14 Jul 2026 00:00:00 GMT

Nessus Plugin ID 326618 with Critical Severity

Synopsis

The remote EulerOS host is missing a security update.

Solution

Update the affected cups packages.

EulerOS 2.0 SP10 : shim (EulerOS-SA-2026-2712)

Tue, 14 Jul 2026 00:00:00 GMT

Nessus Plugin ID 326614 with High Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the shim packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

Issue summary: When a delta CRL that contains a Delta CRL Indicator extension is processed a NULL pointer dereference might happen if the required CRL Number extension is missing.

Impact summary: A NULL pointer dereference can trigger a crash which leads to a Denial of Service for an application.

When CRL processing and delta CRL processing is enabled during X.509 certificate verification, the delta CRL processing does not check whether the CRL Number extension is NULL before dereferencing it.
When a malformed delta CRL file is being processed, this parameter can be NULL, causing a NULL pointer dereference.

Exploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in the verification context, the certificate being verified to contain a freshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and an attacker to provide a malformed CRL to an application that processes it.

The vulnerability is limited to Denial of Service and cannot be escalated to achieve code execution or memory disclosure. For that reason the issue was assessed as Low severity according to our Security Policy.

The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-28388)

Tenable has extracted the preceding description block directly from the EulerOS shim security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected shim packages.

EulerOS 2.0 SP10 : python-lxml (EulerOS-SA-2026-2667)

Tue, 14 Jul 2026 00:00:00 GMT

Nessus Plugin ID 326613 with High Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

Solution

Update the affected python-lxml packages.

EulerOS 2.0 SP10 : libsoup (EulerOS-SA-2026-2658)

Tue, 14 Jul 2026 00:00:00 GMT

Nessus Plugin ID 326612 with High Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the libsoup packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

A flaw was found in libsoup. When establishing HTTPS tunnels through a configured HTTP proxy, sensitive session cookies are transmitted in cleartext within the initial HTTP CONNECT request. A network-positioned attacker or a malicious HTTP proxy can intercept these cookies, leading to potential session hijacking or user impersonation.(CVE-2026-5119)

Tenable has extracted the preceding description block directly from the EulerOS libsoup security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected libsoup packages.

EulerOS 2.0 SP10 : vim (EulerOS-SA-2026-2718)

Tue, 14 Jul 2026 00:00:00 GMT

Nessus Plugin ID 326611 with High Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

Solution

Update the affected vim packages.

EulerOS 2.0 SP10 : openssh (EulerOS-SA-2026-2664)

Tue, 14 Jul 2026 00:00:00 GMT

Nessus Plugin ID 326610 with Medium Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the openssh packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions.(CVE-2026-35388)

In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario where the username on the command line is untrusted, and also requires a non-default configurations of % in ssh_config.(CVE-2026-35386)

OpenSSH before 10.3 can use unintended ECDSA algorithms. Listing of any ECDSA algorithm in PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms is misinterpreted to mean all ECDSA algorithms.(CVE-2026-35387)

Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions. This vulnerability affects the GSSAPI patches added by various Linux distributions and does not affect the OpenSSH upstream project itself. The usage of sshpkt_disconnect() on an error, which does not terminate the process, allows an attacker to send an unexpected GSSAPI message type during the GSSAPI key exchange to the server, which will call the underlying function and continue the execution of the program without setting the related connection variables. As the variables are not initialized to NULL the code later accesses those uninitialized variables, accessing random memory, which could lead to undefined behavior. The recommended workaround is to use ssh_packet_disconnect() instead, which does terminate the process. The impact of the vulnerability depends heavily on the compiler flag hardening configuration.(CVE-2026-3497)

In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without
-p (preserve mode).(CVE-2026-35385)

OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with a Certificate Authority that makes certain use of comma characters.(CVE-2026-35414)

Tenable has extracted the preceding description block directly from the EulerOS openssh security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected openssh packages.

EulerOS 2.0 SP10 : bind (EulerOS-SA-2026-2640)

Tue, 14 Jul 2026 00:00:00 GMT

Nessus Plugin ID 326609 with High Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

Solution

Update the affected bind packages.

EulerOS 2.0 SP10 : expat (EulerOS-SA-2026-2647)

Tue, 14 Jul 2026 00:00:00 GMT

Nessus Plugin ID 326608 with High Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the expat packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.(CVE-2026-45186)

libexpat before 2.7.5 allows an infinite loop while parsing DTD content.(CVE-2026-32777)

libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content.(CVE-2026-32776)

Tenable has extracted the preceding description block directly from the EulerOS expat security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected expat packages.

EulerOS 2.0 SP10 : libpng (EulerOS-SA-2026-2657)

Tue, 14 Jul 2026 00:00:00 GMT

Nessus Plugin ID 326607 with High Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

Description

Description

According to the versions of the haveged packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

In `src/havegecmd.c`, the `socket_handler` function performs a credential check on the abstract UNIX socket (`\0/sys/entropy/haveged`). However, while it detects if the connecting user is not root (`cred.uid != 0`) and prepares a negative acknowledgement (`ASCII_NAK`), it **fails to stop execution**. The code proceeds to the `switch` statement, allowing any local unprivileged user to execute privileged commands such as `MAGIC_CHROOT`.(CVE-2026-41054)

Tenable has extracted the preceding description block directly from the EulerOS haveged security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected haveged packages.

EulerOS 2.0 SP10 : libtheora (EulerOS-SA-2026-2660)

Tue, 14 Jul 2026 00:00:00 GMT

Nessus Plugin ID 326600 with High Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

Solution

Update the affected libtheora packages.

EulerOS 2.0 SP10 : ruby (EulerOS-SA-2026-2711)

Tue, 14 Jul 2026 00:00:00 GMT

Nessus Plugin ID 326599 with High Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

Description

Description

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

net: skbuff: propagate shared-frag marker through frag-transfer helpers(CVE-2026-43503)

mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()(CVE-2026-43281)

ptrace: slightly saner #39;get_dumpable()#39; logic(CVE-2026-46333)

crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption(CVE-2026-43033)

usb: ulpi: fix double free in ulpi_register_interface() error path(CVE-2026-31759)

openvswitch: defer tunnel netdev_put to RCU release(CVE-2026-31678)

KVM: x86: Use scratch field in MMIO fragment to hold small write values(CVE-2026-31588)

af_unix: read UNIX_DIAG_VFS data under unix_state_lock(CVE-2026-31673)

mm: blk-cgroup: fix use-after-free in cgwb_release_workfn()(CVE-2026-31586)

ext4: publish jinode after initialization(CVE-2026-31450)

ext4: validate p_idx bounds in ext4_ext_correct_indexes(CVE-2026-31449)

net: fix fanout UAF in packet_release() via NETDEV_UP race(CVE-2026-31504)

netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check()(CVE-2026-31674)

RDMA/umad: Reject negative data_len in ib_umad_write(CVE-2026-23243)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected kernel packages.

EulerOS 2.0 SP10 : libsoup (EulerOS-SA-2026-2699)

Tue, 14 Jul 2026 00:00:00 GMT

Nessus Plugin ID 326589 with High Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

Solution

Update the affected libsoup packages.

EulerOS 2.0 SP10 : libcap (EulerOS-SA-2026-2697)

Tue, 14 Jul 2026 00:00:00 GMT

Nessus Plugin ID 326588 with High Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

Description

According to the versions of the tigervnc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

In TigerVNC before 1.16.2, Image.cxx in x0vncserver allows other users to observe or manipulate the screen contents, or cause an application crash, because of incorrect permissions.(CVE-2026-34352)

Tenable has extracted the preceding description block directly from the EulerOS tigervnc security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected tigervnc packages.

EulerOS 2.0 SP10 : uboot-tools (EulerOS-SA-2026-2716)

Tue, 14 Jul 2026 00:00:00 GMT

Nessus Plugin ID 326582 with High Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the uboot-tools packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

barebox is a bootloader. In barebox from version 2016.03.0 to before version 2026.03.1 (and the corresponding backport to 2025.09.3), an attacker could exploit a FIT signature verification vulnerability to trick the bootloader into booting different images than those that were verified as part of a signed configuration. mkimage(1) sets the hashed-nodes property of the FIT signature node to list which nodes of the FIT were hashed as part of the signing process as these will need to be verified later on by the bootloader. However, hashed-nodes itself is not part of the hash and could therefore be modified to allow booting different images than those that have been verified. This issue has been patched in barebox versions 2026.03.1 and backported to 2025.09.3.(CVE-2026-33243)

Tenable has extracted the preceding description block directly from the EulerOS uboot-tools security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected uboot-tools packages.

EulerOS 2.0 SP10 : libtiff (EulerOS-SA-2026-2702)

Tue, 14 Jul 2026 00:00:00 GMT

Nessus Plugin ID 326581 with High Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

Solution

Update the affected libtiff packages.

EulerOS 2.0 SP10 : uboot-tools (EulerOS-SA-2026-2675)

Tue, 14 Jul 2026 00:00:00 GMT

Nessus Plugin ID 326580 with High Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-a457bf78b4 advisory.

This package provides the Perl module HTML::Gumbo. Versions before 0.19 disclose heap memory via type confusion.

Support for the