The remote openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0592-1 advisory.

    - Update to version 0.4.1+git78.f951e3a:
    - CVE-2025-22868: Unexpected memory consumption during token parsing in golang.org/x/oauth2. (bsc#1239186)
    - CVE-2024-45337: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in     golang.org/x/crypto. (bsc#1234486)
    - CVE-2025-27144: Go JOSE's Parsing Vulnerable to Denial of Service. (bsc#1237611)
    - CVE-2025-22870: proxy bypass using IPv6 zone IDs. (bsc#1238683)
    - CVE-2025-22869: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh. (bsc#1239323)
    - CVE-2025-30204: jwt-go allows excessive memory allocation during header parsing. (bsc#1240444)
    - CVE-2025-58181: invalidated number of mechanisms can cause unbounded memory consumption. (bsc#1253802)
    - CVE-2026-22772: MetaIssuer URL validation bypass can trigger SSRF to arbitrary internal services.
    (bsc#1256535)
    - CVE-2026-24137: legacy TUF client allows for arbitrary file writes with target cache path traversal.
    (bsc#1257138)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

openSUSE 15 Security Update : vexctl (SUSE-SU-2026:0592-1)

high Nessus Plugin ID 299709

Version 1.2

Version 1.1

Version 1.2 Mar 17, 2026, 4:16 PM CVSS metrics ("CVSSv3 score" set to 5.3) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N") CVSSv3 score source (set to "CVE-2026-22772") CVSSv3 severity (based on CVE-2026-22772, severity decreased from "High" to "Medium") Plugin Feed: 202603171616
Version 1.1 Feb 21, 2026, 2:21 PM New Plugin Feed: 202602211421