The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-018d6721a0 advisory.

    Update to .NET SDK 10.0.107 and Runtime 10.0.7

    Fixes: CVE-2026-40372

    Release Notes:

    - SDK: https://github.com/dotnet/core/blob/main/release-notes/10.0/10.0.7/10.0.107.md
    - Runtime: https://github.com/dotnet/core/blob/main/release-notes/10.0/10.0.7/10.0.7.md

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-2bb2aee489 advisory.

    Update to 1.74.0


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-c66eaae759 advisory.

    **PHP version 8.5.6** (07 May 2026)

    **Core:**

    * Fixed bug [GH-19983](https://github.com/php/php-src/issues/19983) (GC assertion failure with fibers,     generators and destructors). (iliaal)
    * Fixed ZEND_API mismatch on zend_ce_closure forward decl for Windows+Clang. (henderkes)
    * Fixed bug [GH-21504](https://github.com/php/php-src/issues/21504) (Incorrect RC-handling for     ZEND_EXT_STMT op1). (ilutov)
    * Fixed bug [GH-21478](https://github.com/php/php-src/issues/21478) (Forward property operations to real     instance for initialized lazy proxies). (iliaal)
    * Fixed bug [GH-21605](https://github.com/php/php-src/issues/21605) (Missing addref for     Countable::count()). (ilutov)
    * Fixed bug [GH-21699](https://github.com/php/php-src/issues/21699) (Assertion failure in     shutdown_executor when resolving self::/parent::/static:: callables if the error handler throws).
    (macoaure)
    * Fixed bug [GH-21603](https://github.com/php/php-src/issues/21603) (Missing addref for __unset). (ilutov)
    * Fixed bug [GH-21760](https://github.com/php/php-src/issues/21760) (Trait with class constant name     conflict against enum case causes SEGV). (Pratik Bhujel)

    **CLI:**

    * Fixed bug [GH-21754](https://github.com/php/php-src/issues/21754) (`--rf` command line option with a     method triggers ext/reflection deprecation warnings). (DanielEScherzer)

    **Curl:**

    * Add support for brotli and zstd on Windows. (Shivam Mathur)

    **DOM:**

    * Fixed [GHSA-4jhr-8w89-j733](https://github.com/php/php-src/security/advisories/GHSA-4jhr-8w89-j733) and     [GH-21566](https://github.com/php/php-src/issues/21566) (Dom\XMLDocument::C14N() emits duplicate xmlns     declarations after setAttributeNS()). (**CVE-2026-7263**) (David Carlier)

    **FPM:**

    * Fixed [GHSA-7qg2-v9fj-4mwv](https://github.com/php/php-src/security/advisories/GHSA-7qg2-v9fj-4mwv) (XSS     within status endpoint). (**CVE-2026-6735**) (Jakub Zelenka)

    **Iconv:**

    * Fixed bug [GH-17399](https://github.com/php/php-src/issues/17399) (iconv memory leak on bailout).
    (iliaal)

    **Lexbor:**

    * Upgrade to lexbor v2.7.0. (**CVE-2026-29078**, **CVE-2026-29079**) (ndossche, ilutov)

    **MBString:**

    * Fixed [GHSA-wm6j-2649-pv75](https://github.com/php/php-src/security/advisories/GHSA-wm6j-2649-pv75)     (Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()). (**CVE-2026-7259**)     (vi3tL0u1s)
    * Fixed [GHSA-74r9-qxhc-fx53](https://github.com/php/php-src/security/advisories/GHSA-74r9-qxhc-fx53)     (Out-of-bounds access in mbfl_name2encoding_ex()). (**CVE-2026-6104**) (ilutov)

    **Opcache:**

    * Fixed bug [GH-21158](https://github.com/php/php-src/issues/21158) (JIT: Assertion jit->ra[var].flags &     (1<<0) failed in zend_jit_use_reg). (Arnaud)
    * Fixed bug [GH-21593](https://github.com/php/php-src/issues/21593) (Borked function JIT JMPNZ smart     branch). (ilutov)
    * Fixed bug [GH-21460](https://github.com/php/php-src/issues/21460) (COND optimization regression).
    (Dmitry, Arnaud)
    * Fixed faulty returns out of zend_try block in zend_jit_trace(). (ilutov)

    **OpenSSL:**

    * Fix memory leak regression in openssl_pbkdf2(). (ndossche)
    * Fix a bunch of memory leaks and crashes on edge cases. (ndossche)

    **PDO_Firebird:**

    * Fixed [GHSA-w476-322c-wpvm](https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm) (SQL     injection via NUL bytes in quoted strings). (**CVE-2025-14179**) (SakiTakamachi)

    **PDO_PGSQL:**

    * Fixed bug [GH-21683](https://github.com/php/php-src/issues/21683) (pdo_pgsql throws with ATTR_PREFETCH=0     on empty result set). (thomasschiet)

    **Phar:**

    * Restore is_link handler in phar_intercept_functions_shutdown. (iliaal)
    * Fixed bug [GH-21797](https://github.com/php/php-src/issues/21797) (phar: NULL dereference in     Phar::webPhar() when SCRIPT_NAME is absent from SAPI environment). (iliaal)
    * Fix memory leak in Phar::offsetGet(). (iliaal)
    * Fix memory leak in phar_add_file(). (iliaal)
    * Fixed bug [GH-21799](https://github.com/php/php-src/issues/21799) (phar: propagate phar_stream_flush     return value from phar_stream_close). (iliaal)
    * Fix memory leak in phar_verify_signature() when md_ctx is invalid. (JarneClauw)

    **Random:**

    * Fixed bug [GH-21731](https://github.com/php/php-src/issues/21731)     (Random\Engine\Xoshiro256StarStar::__unserialize() accepts all-zero state). (iliaal)

    **Session:**

    * Fixed memory leak when session GC callback return a refcounted value. (jorgsowa)

    **SOAP:**

    * Fixed [GHSA-85c2-q967-79q5](https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5)     (Stale SOAP_GLOBAL(ref_map) pointer with Apache Map). (**CVE-2026-6722**) (ilutov)
    * Fixed [GHSA-m33r-qmcv-p97q](https://github.com/php/php-src/security/advisories/GHSA-m33r-qmcv-p97q)     (Use-after-free after header parsing failure with SOAP_PERSISTENCE_SESSION). (**CVE-2026-7261**) (ilutov)
    * Fixed [GHSA-hmxp-6pc4-f3vv](https://github.com/php/php-src/security/advisories/GHSA-hmxp-6pc4-f3vv)     (Broken Apache map value NULL check). (**CVE-2026-7262**) (ilutov)

    **SPL:**

    * Fixed bug [GH-21499](https://github.com/php/php-src/issues/21499) (RecursiveArrayIterator getChildren     UAF after parent free). (Girgias)
    * Fix concurrent iteration and deletion issues in SplObjectStorage. (ndossche)

    **Sqlite3:**

    * Fixed wrong free list comparator pointer type. (David Carlier)

    **Standard:**

    * Fixed [GHSA-96wq-48vp-hh57](https://github.com/php/php-src/security/advisories/GHSA-96wq-48vp-hh57)     (Signed integer overflow of char array offset). (**CVE-2026-7568**) (TimWolla)
    * Fixed [GHSA-m8rr-4c36-8gq4](https://github.com/php/php-src/security/advisories/GHSA-m8rr-4c36-8gq4)     (Consistently pass unsigned char to ctype.h functions). (**CVE-2026-7258**) (ilutov)

    **Streams:**

    * Fixed bug [GH-21468](https://github.com/php/php-src/issues/21468) (Segfault in file_get_contents w/ a     https URL and a proxy set). (ndossche)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-6599e30e04 advisory.

    33.0.3 Release

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-0f01e844c3 advisory.

    Update to 3.4.4.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-32952baba5 advisory.

    Update to .NET SDK 10.0.107 and Runtime 10.0.7

    Fixes: CVE-2026-40372

    Release Notes:

    - SDK: https://github.com/dotnet/core/blob/main/release-notes/10.0/10.0.7/10.0.107.md
    - Runtime: https://github.com/dotnet/core/blob/main/release-notes/10.0/10.0.7/10.0.7.md

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-2947986ad6 advisory.

    # Prosody 13.0.5

    Upstream is pleased to announce a new minor release from their stable branch.

    This is a security release for the Prosody 13.0.x stable series. It fixes multiple security issues, some     memory leaks and some smaller bugs and changes which have been implemented since the previous release.

    Full details about the security vulnerabilities can be found in upstream's [security     advisory](https://prosody.im/security/advisory_735dd9d3/). Upstream encourages all Prosody operators on     13.0.4 or earlier to upgrade to 13.0.5 as soon as possible, or to review the advisory and implement     appropriate mitigations.

    A summary of changes in this release:

    ## Security
     - mod_proxy65: Consistently apply authorization checks
     - mod_proxy65: Dont proxy data until after bytestream activation
     - mod_c2s, mod_s2s: Introduce new pre-authentication stanza size limit
     - Add limit for stanza max child elements
     - mod_c2s: Remove timers immediately on disconnection
     - net.server_epoll: Clean up timers after disconnection

    ## Fixes and improvements
     - net.http.parser: Fix handling of chunked request
     - MUC: Advertise hats feature on room JID
     - moduleapi: Use multitable add/remove instead of set (fixes memory leak)
     - mod_cloud_notify: Fix leaking iq response handlers by using `send_iq()`
     - Improve federation with servers using only IP addresses
     - prosody: Prevent loading local code when installed system-wide
     - mod_http_file_share: Improve handling of Range requests
     - mod_carbons: Fix some carbons decision-making bugs

    ## Minor changes
     - net.resolvers: Fix to avoid SRV lookups for IP addresses
     - prosody: Abort earlier on incompatible Lua version
     - mod_turn_external: hand out credentials for type `==` turns too
     - mod_s2s: Fully validate stream addressing
     - prosodyctl check features: Warn if http file sharing enabled on both host and component
     - util.prosodyctl: Dont check for mod_posix being disabled, its deprecated
     - util.startup: Improve error message when failing to load config file
     - util.x509: Add support for iPAddress certs
     - prosodyctl: Trim any trailing newline from password entry
     - mod_admin_shell: Make cert index search path relative to config file
     - mod_admin_shell: Improve multi-host command handling
     - mod_admin_shell: Show help listing when specifying only a section name
     - mod_admin_shell: Ensure password validity when setting passwords for new/existing users
     - mod_account_activity: Handle authentication provider returning no user info
     - config: Use default value when enum option has incorrect value
     - mod_http: Handle streaming requests to avoid invoking redirect handler


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-63341da831 advisory.

    Update to 1.74.0

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-36c53b9ca8 advisory.

    # Prosody 13.0.5

    Upstream is pleased to announce a new minor release from their stable branch.

    This is a security release for the Prosody 13.0.x stable series. It fixes multiple security issues, some     memory leaks and some smaller bugs and changes which have been implemented since the previous release.

    Full details about the security vulnerabilities can be found in upstream's [security     advisory](https://prosody.im/security/advisory_735dd9d3/). Upstream encourages all Prosody operators on     13.0.4 or earlier to upgrade to 13.0.5 as soon as possible, or to review the advisory and implement     appropriate mitigations.

    A summary of changes in this release:

    ## Security
     - mod_proxy65: Consistently apply authorization checks
     - mod_proxy65: Dont proxy data until after bytestream activation
     - mod_c2s, mod_s2s: Introduce new pre-authentication stanza size limit
     - Add limit for stanza max child elements
     - mod_c2s: Remove timers immediately on disconnection
     - net.server_epoll: Clean up timers after disconnection

    ## Fixes and improvements
     - net.http.parser: Fix handling of chunked request
     - MUC: Advertise hats feature on room JID
     - moduleapi: Use multitable add/remove instead of set (fixes memory leak)
     - mod_cloud_notify: Fix leaking iq response handlers by using `send_iq()`
     - Improve federation with servers using only IP addresses
     - prosody: Prevent loading local code when installed system-wide
     - mod_http_file_share: Improve handling of Range requests
     - mod_carbons: Fix some carbons decision-making bugs

    ## Minor changes
     - net.resolvers: Fix to avoid SRV lookups for IP addresses
     - prosody: Abort earlier on incompatible Lua version
     - mod_turn_external: hand out credentials for type `==` turns too
     - mod_s2s: Fully validate stream addressing
     - prosodyctl check features: Warn if http file sharing enabled on both host and component
     - util.prosodyctl: Dont check for mod_posix being disabled, its deprecated
     - util.startup: Improve error message when failing to load config file
     - util.x509: Add support for iPAddress certs
     - prosodyctl: Trim any trailing newline from password entry
     - mod_admin_shell: Make cert index search path relative to config file
     - mod_admin_shell: Improve multi-host command handling
     - mod_admin_shell: Show help listing when specifying only a section name
     - mod_admin_shell: Ensure password validity when setting passwords for new/existing users
     - mod_account_activity: Handle authentication provider returning no user info
     - config: Use default value when enum option has incorrect value
     - mod_http: Handle streaming requests to avoid invoking redirect handler


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-1efa008794 advisory.

    # Prosody 13.0.5

    Upstream is pleased to announce a new minor release from their stable branch.

    This is a security release for the Prosody 13.0.x stable series. It fixes multiple security issues, some     memory leaks and some smaller bugs and changes which have been implemented since the previous release.

    Full details about the security vulnerabilities can be found in upstream's [security     advisory](https://prosody.im/security/advisory_735dd9d3/). Upstream encourages all Prosody operators on     13.0.4 or earlier to upgrade to 13.0.5 as soon as possible, or to review the advisory and implement     appropriate mitigations.

    A summary of changes in this release:

    ## Security
     - mod_proxy65: Consistently apply authorization checks
     - mod_proxy65: Dont proxy data until after bytestream activation
     - mod_c2s, mod_s2s: Introduce new pre-authentication stanza size limit
     - Add limit for stanza max child elements
     - mod_c2s: Remove timers immediately on disconnection
     - net.server_epoll: Clean up timers after disconnection

    ## Fixes and improvements
     - net.http.parser: Fix handling of chunked request
     - MUC: Advertise hats feature on room JID
     - moduleapi: Use multitable add/remove instead of set (fixes memory leak)
     - mod_cloud_notify: Fix leaking iq response handlers by using `send_iq()`
     - Improve federation with servers using only IP addresses
     - prosody: Prevent loading local code when installed system-wide
     - mod_http_file_share: Improve handling of Range requests
     - mod_carbons: Fix some carbons decision-making bugs

    ## Minor changes
     - net.resolvers: Fix to avoid SRV lookups for IP addresses
     - prosody: Abort earlier on incompatible Lua version
     - mod_turn_external: hand out credentials for type `==` turns too
     - mod_s2s: Fully validate stream addressing
     - prosodyctl check features: Warn if http file sharing enabled on both host and component
     - util.prosodyctl: Dont check for mod_posix being disabled, its deprecated
     - util.startup: Improve error message when failing to load config file
     - util.x509: Add support for iPAddress certs
     - prosodyctl: Trim any trailing newline from password entry
     - mod_admin_shell: Make cert index search path relative to config file
     - mod_admin_shell: Improve multi-host command handling
     - mod_admin_shell: Show help listing when specifying only a section name
     - mod_admin_shell: Ensure password validity when setting passwords for new/existing users
     - mod_account_activity: Handle authentication provider returning no user info
     - config: Use default value when enum option has incorrect value
     - mod_http: Handle streaming requests to avoid invoking redirect handler


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-c23e1d19d2 advisory.

    This is new version of exim fixing some security bugs.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-fff37fe569 advisory.

    This is new version of exim fixing some security bugs.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-7f7b8d957f advisory.

    This is new version of exim fixing some security bugs.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-be6ea464d0 advisory.

    Update to .NET SDK 10.0.107 and Runtime 10.0.7

    Fixes: CVE-2026-40372

    Release Notes:

    - SDK: https://github.com/dotnet/core/blob/main/release-notes/10.0/10.0.7/10.0.107.md
    - Runtime: https://github.com/dotnet/core/blob/main/release-notes/10.0/10.0.7/10.0.7.md

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-44919b3d9f advisory.

    2.33.1 (2026-03-30)
    -------------------

    **Bugfixes**
    - Fixed test cleanup for CVE-2026-25645 to avoid leaving unnecessary       files in the tmp directory.
    - Fixed Content-Type header parsing for malformed values.
    - Improved error consistency for malformed header values.

    2.33.0 (2026-03-25)
    -------------------

    **Announcements**
    -  Requests is adding inline types. If you have a typed code base that     uses Requests, please take a look at     [#7271](https://github.com/psf/requests/issues/7271).
    Give it a try, and report any gaps or feedback you may have in the issue. 

    **Security**
    - [CVE-2026-25645](https://www.cve.org/CVERecord?id=CVE-2026-25645)       `requests.utils.extract_zipped_paths` now extracts       contents to a non-deterministic location to prevent malicious file       replacement. This does not affect default usage of Requests, only       applications calling the utility function directly.

    **Improvements**
    - Migrated to a PEP 517 build system using setuptools.

    **Bugfixes**
    - Fixed an issue where an empty netrc entry could cause       malformed authentication to be applied to Requests on       Python 3.11+.

    **Deprecations**
    - Dropped support for Python 3.9 following its end of support.

    **Documentation**
    - Various typo fixes and doc improvements.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-cb5661d883 advisory.

    33.0.3 Release

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-2fed8dd674 advisory.

    33.0.3 Release

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-7af660d639 advisory.

    Validate RSA_public_encrypt() result in RSASVE

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-8cffa03dad advisory.

    The 7.0.4 stable kernel rebase contains additional hardware support, new features, and a number of     important fixes across the tree. It also contains a fix for the dirtyfrag vulnerability. This covers     CVE-2026-43284 and CVE-2026-43500. For users who experience a problem with the 7.0.4 rebase, a build of     6.19.14 with just the dirtyfrag fixes should be available in koji shortly.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-87dc12705e advisory.

    The 6.19.14-101 stable update contains a fix for the dirtyfrag vulnerability.  This covers CVE-2026-43284     and CVE-2026-43500

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-bdb9342c72 advisory.

    Cumulative bug-fix release from upstream. Includes fix for a possible SQL-injection issue via `mod_sql`     (CVE-2026-42167). Note that `mod_sql` is not enabled by default.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-549ee32ea1 advisory.

    Cumulative bug-fix release from upstream. Includes fix for a possible SQL-injection issue via `mod_sql`     (CVE-2026-42167). Note that `mod_sql` is not enabled by default.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-739d341ab8 advisory.

    Cumulative bug-fix release from upstream. Includes fix for a possible SQL-injection issue via `mod_sql`     (CVE-2026-42167). Note that `mod_sql` is not enabled by default.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-e3f870229a advisory.

    Update to version 22.22.2

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-992a75bea6 advisory.

    Update to 3.4.4.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-abc00fb4e8 advisory.

    The 7.0.4 stable kernel rebase contains additional hardware support, new features, and a number of     important fixes across the tree.  It also contains a fix for the dirtyfrag vulnerability. This covers     CVE-2026-43284 and CVE-2026-43500.  For users who experience a problem with the 7.0.4 rebase, a build of     6.19.14 with just the dirtyfrag fixes should be available in koji shortly.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-668d2793e8 advisory.

    Update to 3.8.13, fixes, like 13 CVEs.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-3b76d8047d advisory.

    Update to version 22.22.2

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-b58cd376d6 advisory.

    Automatic update for pypy-7.3.22-2.fc45.

    ##### **Changelog**

    ```
    * Tue May  5 2026 Charalampos Stratakis <cstratak@redhat.com> - 7.3.22-2
    - Security fix for CVE-2026-3219 in the bundled pip wheel
    - Fixes: rhbz#2461288
    * Tue May  5 2026 Charalampos Stratakis <cstratak@redhat.com> - 7.3.22-1
    - Update to 7.3.22
    - Fixes: rhbz#2463475

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-4cca750484 advisory.

    Starman versions before 0.4018 for Perl allows HTTP Request Smuggling via Improper Header Precedence.
    Starman incorrectly prioritizes Content-Length over Transfer-Encoding: chunked when both headers are     present in an HTTP request. Per RFC 7230 3.3.3, Transfer-Encoding must take precedence. An attacker could     exploit this to smuggle malicious HTTP requests via a front-end reverse proxy.

    This package updates Starman to 0.4018 where Transfer-Encoding now takes precedence over Content-Length.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-b94aad33a5 advisory.

    Starman versions before 0.4018 for Perl allows HTTP Request Smuggling via Improper Header Precedence.
    Starman incorrectly prioritizes Content-Length over Transfer-Encoding: chunked when both headers are     present in an HTTP request. Per RFC 7230 3.3.3, Transfer-Encoding must take precedence. An attacker could     exploit this to smuggle malicious HTTP requests via a front-end reverse proxy.

    This package updates Starman to 0.4018 where Transfer-Encoding now takes precedence over Content-Length.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-5bb108e1b7 advisory.

    Starman versions before 0.4018 for Perl allows HTTP Request Smuggling via Improper Header Precedence.
    Starman incorrectly prioritizes Content-Length over Transfer-Encoding: chunked when both headers are     present in an HTTP request. Per RFC 7230 3.3.3, Transfer-Encoding must take precedence. An attacker could     exploit this to smuggle malicious HTTP requests via a front-end reverse proxy.

    This package updates Starman to 0.4018 where Transfer-Encoding now takes precedence over Content-Length.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-51dba40a65 advisory.

    updated to 2.4.3 which includes several security fixes

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-d5f140eb90 advisory.

    Update to 3.8.13, fixes, like 13 CVEs.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-0174d1953a advisory.

    Update to xwayland 24.1.11

    ----

    Update to xwayland 24.1.10, CVE fix for: CVE-2026-33999, CVE-2026-34000, CVE-2026-34001,     CVE-2026-34002, CVE-2026-34003

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-11d7d4d8f3 advisory.

    Security fix for CVE-2026-39881

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-4349d04c20 advisory.

    updated to 2.4.3 which includes several security fixes

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-5df889949e advisory.

    Update to 2.92.0 and make telemetry sending opt in.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-d0a0f1c3d2 advisory.

    * fix CVE-2026-6842 and CVE-29026-6843

    Resolves: CVE-2026-6842     Resolves: CVE-2026-6843     Resolves: rhbz#2455127     Resolves: rhbz#2455314


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-b47d3e7e16 advisory.

    - Update to 5.0.4

    Release notes: https://doc.powerdns.com/authoritative/changelog/5.0.html#change-5.0.4     Security advisory: https://docs.powerdns.com/authoritative/security-advisories/powerdns-     advisory-2026-05.html

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-edc32576bb advisory.

    - Update to 5.0.4

    Release notes: https://doc.powerdns.com/authoritative/changelog/5.0.html#change-5.0.4     Security advisory: https://docs.powerdns.com/authoritative/security-advisories/powerdns-     advisory-2026-05.html

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-684396998a advisory.

    - Fix NegoEx parsing vulnerabilities (CVE-2026-40355, CVE-2026-40356)
    - Add upstream patches to build against openssl 4.0
    - Make configure.ac work with autoconf 2.73

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-cf660bc96a advisory.

    Update vendor dependencies to fix:
    * CVE-2026-33762
    * CVE-2026-33817
    * CVE-2026-34165

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-e6a4814a4d advisory.

    - new version 7.5
    - security update

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-bc62ef0a6a advisory.

    Update to pyOpenSSL 26.1.0

    This update adds support for cryptography v47 and fixes a single security issue:

    - Fixed X509Name field setters to correctly pass the value length to OpenSSL. Previously, values     containing NUL bytes would be silently truncated, causing a divergence between the stored ASN.1 value and     the value visible from Python. Credit to BudongJW for reporting the issue. CVE-2026-40475

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-c0590bd498 advisory.

    - new version 7.5
    - security update

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-f416c4ba87 advisory.

    - Update to 5.0.4

    Release notes: https://doc.powerdns.com/authoritative/changelog/5.0.html#change-5.0.4     Security advisory: https://docs.powerdns.com/authoritative/security-advisories/powerdns-     advisory-2026-05.html

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-05d463c932 advisory.

    Update to pyOpenSSL 26.1.0

    This update adds support for cryptography v47 and fixes a single security issue:

    - Fixed X509Name field setters to correctly pass the value length to OpenSSL. Previously, values     containing NUL bytes would be silently truncated, causing a divergence between the stored ASN.1 value and     the value visible from Python. Credit to BudongJW for reporting the issue. CVE-2026-40475

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-d63e3968e8 advisory.

    Automatic update for opencryptoki-3.26.0-3.fc45.

    ##### **Changelog**

    ```
    * Tue May  5 2026 Than Ngo <than@redhat.com> - 3.26.0-3
    - Fix rhbz#2432016: CVE-2026-23893, Privilege Escalation or Data Exposure via Symlink Following

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-9dc3a61ad8 advisory.

    Update to version 20.20.2



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Severity
313736	Fedora 43 : dotnet10.0 (2026-018d6721a0)	critical
313735	Fedora 43 : rclone (2026-2bb2aee489)	critical
313734	Fedora 44 : php (2026-c66eaae759)	critical
313733	Fedora 43 : nextcloud (2026-6599e30e04)	medium
313732	Fedora 43 : SDL3_image (2026-0f01e844c3)	medium
313722	Fedora 44 : dotnet10.0 (2026-32952baba5)	critical
313721	Fedora 44 : prosody (2026-2947986ad6)	high
313720	Fedora 44 : rclone (2026-63341da831)	critical
313719	Fedora 43 : prosody (2026-36c53b9ca8)	high
313718	Fedora 42 : prosody (2026-1efa008794)	high
313717	Fedora 43 : exim (2026-c23e1d19d2)	high
313716	Fedora 42 : exim (2026-fff37fe569)	high
313715	Fedora 44 : exim (2026-7f7b8d957f)	high
313714	Fedora 42 : dotnet10.0 (2026-be6ea464d0)	critical
313663	Fedora 44 : python-pulp-glue / python-requests (2026-44919b3d9f)	medium
313662	Fedora 44 : nextcloud (2026-cb5661d883)	medium
313661	Fedora 42 : nextcloud (2026-2fed8dd674)	medium
313621	Fedora 42 : openssl (2026-7af660d639)	high
313415	Fedora 44 : kernel (2026-8cffa03dad)	high
313414	Fedora 42 : kernel (2026-87dc12705e)	high
313413	Fedora 43 : proftpd (2026-bdb9342c72)	high
313412	Fedora 44 : proftpd (2026-549ee32ea1)	high
313411	Fedora 42 : proftpd (2026-739d341ab8)	high
313410	Fedora 43 : nodejs22 (2026-e3f870229a)	critical
313409	Fedora 44 : SDL3_image (2026-992a75bea6)	medium
313408	Fedora 43 : kernel (2026-abc00fb4e8)	high
313407	Fedora 44 : gnutls (2026-668d2793e8)	high
313406	Fedora 44 : nodejs22 (2026-3b76d8047d)	critical
313282	Fedora 45 : pypy (2026-b58cd376d6)	medium
313199	Fedora 42 : perl-Starman (2026-4cca750484)	high
313198	Fedora 43 : perl-Starman (2026-b94aad33a5)	high
313176	Fedora 44 : perl-Starman (2026-5bb108e1b7)	high
313033	Fedora 43 : dovecot (2026-51dba40a65)	high
313032	Fedora 43 : gnutls (2026-d5f140eb90)	high
313031	Fedora 42 : xorg-x11-server-Xwayland (2026-0174d1953a)	critical
313029	Fedora 42 : vim (2026-11d7d4d8f3)	high
313028	Fedora 44 : dovecot (2026-4349d04c20)	high
313027	Fedora 44 : gh (2026-5df889949e)	medium
313026	Fedora 43 : nano (2026-d0a0f1c3d2)	low
313008	Fedora 43 : pdns (2026-b47d3e7e16)	medium
313007	Fedora 42 : pdns (2026-edc32576bb)	medium
312670	Fedora 43 : krb5 (2026-684396998a)	medium
312669	Fedora 43 : forgejo-runner (2026-cf660bc96a)	medium
312668	Fedora 43 : squid (2026-e6a4814a4d)	critical
312667	Fedora 43 : pyOpenSSL (2026-bc62ef0a6a)	critical
312321	Fedora 44 : squid (2026-c0590bd498)	critical
312320	Fedora 44 : pdns (2026-f416c4ba87)	medium
312319	Fedora 44 : pyOpenSSL (2026-05d463c932)	critical
312281	Fedora 45 : opencryptoki (2026-d63e3968e8)	medium
312280	Fedora 43 : nodejs20 (2026-9dc3a61ad8)	critical

Detections

Analytics

Fedora Local Security Checks Family for Nessus

critical

critical

critical

medium

medium

critical

high

critical

high

high

high

high

high

critical

medium

medium

medium

high

high

high

high

high

high

critical

medium

high

high

critical

medium

high

high

high

high

high

critical

high

high

medium

low

medium

medium

medium

medium

critical

critical

critical

medium

critical

medium

critical