The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:7467 advisory.

    The skopeo command lets you inspect images from container image registries, get images and image layers,     and use signatures to create and verify files.

    Security Fix(es):

    * go-jose: Go JOSE's Parsing Vulnerable to Denial of Service (CVE-2025-27144)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:7462 advisory.

    The podman tool manages pods, container images, and containers. It is part of the libpod library, which is     for applications that use container pods. Container pods is a concept in Kubernetes.

    Security Fix(es):

    * go-jose: Go JOSE's Parsing Vulnerable to Denial of Service (CVE-2025-27144)

    * golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh     (CVE-2025-22869)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:8047 advisory.

    The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

    Security Fix(es):

    * unbound: Unbounded name compression could lead to Denial of Service (CVE-2024-8508)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:7509 advisory.

    Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can     contain strings, hashes, lists, sets and sorted sets.  You can run atomic operations on these types, like     appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection,     union and difference; or getting the member with highest ranking in a sorted set.  In order to achieve its     outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can     persist it either by dumping the dataset to disk every once in a while, or by appending each command to a     log.  Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first     synchronization, auto-reconnection on net split and so forth.  Other features include Transactions,     Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave     like a cache.  You can use Valkey from most programming languages also.

    Security Fix(es):

    * redis: Redis DoS Vulnerability due to unlimited growth of output buffers abused by unauthenticated     client (CVE-2025-21605)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:7503 advisory.

    A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild     under the hood. Besides building images for local usage, it can also upload images directly to cloud.  It     is compatible with composer-cli and cockpit-composer clients.

    Security Fix(es):

    * golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing (CVE-2025-30204)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:7457 advisory.

    Exiv2 is a C++ library to access image metadata, supporting read and write access to the Exif, IPTC and     XMP metadata, Exif MakerNote support, extract and delete methods for Exif thumbnails, classes to access     Ifd, and support for various image formats.

    Security Fix(es):

    * exiv2: Use After Free in Exiv2 (CVE-2025-26623)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:8319 advisory.

    The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

    Security Fix(es):

    * rubygem-rack: Unbounded-Parameter DoS in Rack::QueryParser (CVE-2025-46727)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:7505 advisory.

    Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access     Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate     packages.  libsoup uses the Glib main loop and is designed to work well with GTK applications. This     enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion,     very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who     want it), but the SOAP parts were removed long ago.

    Security Fix(es):

    * libsoup: Heap buffer over-read in `skip_insignificant_space` when sniffing content (CVE-2025-2784)

    * libsoup: Out of bounds reads in soup_headers_parse_request() (CVE-2025-32906)

    * libsoup: Denial of service on libsoup through HTTP/2 server (CVE-2025-32908)

    * libsoup: NULL pointer dereference in client when server  omits the nonce parameter in an Unauthorized     response with Digest  authentication (CVE-2025-32912)

    * libsoup: OOB Read on libsoup through function  soup_multipart_new_from_message in soup-multipart.c     leads to crash or  exit of process (CVE-2025-32914)

    * libsoup: Information disclosure may leads libsoup client sends Authorization header to a different host     when being redirected by a server (CVE-2025-46421)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:7466 advisory.

    Delve is a debugger for the Go programming language. The goal of the project is to provide a simple, full     featured debugging tool for Go. Delve should be easy to invoke and easy to use. Chances are if you're     using a debugger, things aren't going your way. With that in mind, Delve should stay out of your way as     much as possible.

    Security Fix(es):

    * golang: crypto/x509: crypto/x509: usage of IPv6 zone IDs can bypass URI name constraints     (CVE-2024-45341)

    * golang: net/http: net/http: sensitive headers incorrectly sent after cross-domain redirect     (CVE-2024-45336)

    * crypto/internal/nistec: golang: Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec     (CVE-2025-22866)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:7475 advisory.

    Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &     OpenTSDB.

    Security Fix(es):

    * golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing (CVE-2025-30204)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:7476 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * jinja2: Jinja sandbox breakout through attr filter selecting format method (CVE-2025-27516)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:7512 advisory.

    Expat is a C library for parsing XML documents.

    Security Fix(es):

    * libexpat: expat: Improper Restriction of XML Entity Expansion Depth in libexpat (CVE-2024-8176)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:7506 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    Security Fix(es):

    * firefox: thunderbird: Privilege escalation in Firefox Updater (CVE-2025-2817)

    * firefox: thunderbird: Unsafe attribute access during XPath parsing (CVE-2025-4087)

    * firefox: thunderbird: Process isolation bypass using javascript: URI links in cross-origin frames     (CVE-2025-4083)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and     Thunderbird 128.10 (CVE-2025-4091)

    * firefox: thunderbird: Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird 128.10     (CVE-2025-4093)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:3828 advisory.

    The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard     math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system.
    Without these libraries, the Linux system cannot function correctly.

    Security Fix(es):

    * glibc: buffer overflow in the GNU C Library's assert() (CVE-2025-0395)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:7502 advisory.

    Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network     applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and     efficient, perfect for data-intensive \ real-time applications that run across distributed devices.

    Security Fix(es):

    * c-ares: c-ares has a use-after-free in read_answers() (CVE-2025-31498)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:7458 advisory.

    Xwayland is an X server for running X clients under Wayland.

    Security Fix(es):

    * xorg-x11-server: tigervnc: heap-based buffer overflow privilege escalation vulnerability (CVE-2024-9632)

    * X.Org: Xwayland: Use-after-free of the root cursor (CVE-2025-26594)

    * xorg: xwayland: Use-after-free in SyncInitTrigger() (CVE-2025-26601)

    * xorg: xwayland: Use-after-free in PlayReleasedEvents() (CVE-2025-26600)

    * xorg: xwayland: Use of uninitialized pointer in compRedirectWindow() (CVE-2025-26599)

    * xorg: xwayland: Out-of-bounds write in CreatePointerBarrierClient() (CVE-2025-26598)

    * xorg: xwayland: Buffer overflow in XkbChangeTypesOfKey() (CVE-2025-26597)

    * xorg: xwayland: Heap overflow in XkbWriteKeySyms() (CVE-2025-26596)

    * Xorg: xwayland: Buffer overflow in XkbVModMaskText() (CVE-2025-26595)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:7592 advisory.

    yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on     the topics to an appropriate child worker process, exchanging data with its worker processes through a     D-Bus message broker.

    Security Fix(es):

    * yggdrasil: Local privilege escalation in yggdrasil (CVE-2025-3931)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:7892 advisory.

    Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &     OpenTSDB.

    Security Fix(es):

    * grafana: Cross-site Scripting (XSS) in Grafana via Custom Frontend Plugins and Open Redirect     (CVE-2025-4123)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:8184 advisory.

    GStreamer is a streaming media framework based on graphs of filters which operate on media data. The     gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.

    Security Fix(es):

    * GStreamer: GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability     (CVE-2025-3887)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:8550 advisory.

    Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't     have to create the same web page over and over again, giving the website a significant speed up.

    Security Fix(es):

    * varnish: request smuggling attacks (CVE-2025-47905)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:7479 advisory.

    Collector with the supported components for a Red Hat build of OpenTelemetry

    Security Fix(es):

    * go-jose: Go JOSE's Parsing Vulnerable to Denial of Service (CVE-2025-27144)

    * golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws     (CVE-2025-22868)

    * github.com/expr-lang/expr: Memory Exhaustion in Expr Parser with Unrestricted Input (CVE-2025-29786)

    * golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing (CVE-2025-30204)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:7493 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    Security Fix(es):

    * firefox: thunderbird: URL Bar Spoofing via non-BMP Unicode characters (CVE-2025-3029)

    * firefox: thunderbird: Use-after-free triggered by XSLTProcessor (CVE-2025-3028)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox 137, Thunderbird 137, Firefox ESR 128.9, and     Thunderbird 128.9 (CVE-2025-3030)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:7491 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    Security Fix(es):

    * firefox: thunderbird: URL Bar Spoofing via non-BMP Unicode characters (CVE-2025-3029)

    * firefox: thunderbird: Use-after-free triggered by XSLTProcessor (CVE-2025-3028)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox 137, Thunderbird 137, Firefox ESR 128.9, and     Thunderbird 128.9 (CVE-2025-3030)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:8137 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format     (CVE-2024-53104)

    * kernel: vsock: Keep the binding until socket destruction (CVE-2025-21756)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:7593 advisory.

    The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript     translates PostScript code to common bitmap formats so that the code can be displayed or printed.

    Security Fix(es):

    * Ghostscript: NPDL device: Compression buffer overflow (CVE-2025-27832)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:7517 advisory.

    SQLite is a C library that implements an SQL database engine. A large subset of SQL92 is supported. A     complete database is stored in a single disk file. The API is designed for convenience and ease of use.
    Applications that link against SQLite can enjoy the power and flexibility of an SQL database without the     administrative hassles of supporting a separate database server.

    Security Fix(es):

    * SQLite: integer overflow in SQLite (CVE-2025-3277)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:7496 advisory.

    libxslt is a library for transforming XML files into other textual formats (including HTML, plain text,     and other XML representations of the underlying data) using the standard XSLT stylesheet transformation     mechanism.

    Security Fix(es):

    * libxslt: Use-After-Free in libxslt numbers.c (CVE-2025-24855)

    * libxslt: Use-After-Free in libxslt (xsltGetInheritedNsList) (CVE-2024-55549)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:7510 advisory.

    The libarchive programming library can create and read several different streaming archive formats,     including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility,     scripting language bindings such as python-libarchive, and several popular desktop file managers.

    Security Fix(es):

    * libarchive: heap buffer over-read in header_gnu_longlink (CVE-2024-57970)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:7956 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: dm-flakey: Fix memory corruption in optional corrupt_bio_byte feature (CVE-2025-21966)

    * kernel: iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic() (CVE-2025-21993)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:8131 advisory.

    Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text     files and to perform system management tasks.

    Security Fix(es):

    * net-imap: Net::IMAP vulnerable to possible DoS by memory exhaustion (CVE-2025-25186)

    * CGI: Denial of Service in CGI::Cookie.parse (CVE-2025-27219)

    * uri: userinfo leakage in URI#join, URI#merge and URI#+ (CVE-2025-27221)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:8196 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    Security Fix(es):

    * thunderbird: JavaScript Execution via Spoofed PDF Attachment and file:/// Link (CVE-2025-3909)

    * thunderbird: Sender Spoofing via Malformed From Header in Thunderbird (CVE-2025-3875)

    * thunderbird: Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:///     Links (CVE-2025-3877)

    * thunderbird: Tracking Links in Attachments Bypassed Remote Content Blocking (CVE-2025-3932)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:8063 advisory.

    The IBM Semeru Runtime Certified Edition 21 runtime environment.

    Bug Fix(es) and Enhancement(s):

    * CVE-2025-21587 CVE-2025-30698 CVE-2025-2900 java-21-ibm-semeru-certified-jdk: various flaws     (JIRA:RHEL-92092)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:7459 advisory.

    The buildah package provides a tool for facilitating building OCI container images. Among other things,     buildah enables you to: Create a working container, either from scratch or using an image as a starting     point; Create an image, either from a working container or using the instructions in a Dockerfile; Build     both Docker and OCI images.

    Security Fix(es):

    * go-jose: Go JOSE's Parsing Vulnerable to Denial of Service (CVE-2025-27144)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:8128 advisory.

    Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access     Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate     packages.  libsoup uses the Glib main loop and is designed to work well with GTK applications. This     enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion,     very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who     want it), but the SOAP parts were removed long ago.

    Security Fix(es):

    * libsoup: Denial of Service attack to websocket server (CVE-2025-32049)

    * libsoup: Denial of service in server when client requests a large amount of  overlapping ranges with     Range header (CVE-2025-32907)

    * libsoup: Cookie domain validation bypass via uppercase characters in libsoup (CVE-2025-4035)

    * libsoup: Integer Underflow in soup_multipart_new_from_message() Leading to Denial of Service in libsoup     (CVE-2025-4948)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:7484 advisory.

    A replacement for libslirp and VPNKit, written in pure Go. It is based on the network stack of gVisor.
    Compared to libslirp, gvisor-tap-vsock brings a configurable DNS server and dynamic port forwarding.

    Security Fix(es):

    * golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh     (CVE-2025-22869)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:8135 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * tornado: Tornado Multipart Form-Data Denial of Service (CVE-2025-47287)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:7489 advisory.

    PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

    Security Fix(es):

    * php: Header parser of http stream wrapper does not handle folded headers (CVE-2025-1217)

    * php: Stream HTTP wrapper header check might omit basic auth header (CVE-2025-1736)

    * php: Streams HTTP wrapper does not fail for headers with invalid name and no colon (CVE-2025-1734)

    * php: libxml streams use wrong content-type header when requesting a redirected resource (CVE-2025-1219)

    * php: Stream HTTP wrapper truncates redirect location to 1024 bytes (CVE-2025-1861)

    * php: Reference counting in php_request_shutdown causes Use-After-Free (CVE-2024-11235)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:7524 advisory.

    XZ Utils is an integrated collection of user-space file compression utilities based on the Lempel-Ziv-     Markov chain algorithm (LZMA), which performs lossless data compression. The algorithm provides a high     compression ratio while keeping the decompression time short.

    Security Fix(es):

    * xz: XZ has a heap-use-after-free bug in threaded .xz decoder (CVE-2025-31115)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:8125 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    Security Fix(es):

    * firefox: Out-of-bounds access when resolving Promise objects (CVE-2025-4918)

    * firefox: Out-of-bounds access when optimizing linear sums (CVE-2025-4919)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:8477 advisory.

    The golang packages provide the Go programming language compiler.

    Security Fix(es):

    * net/http: Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:7490 advisory.

    The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an     Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.

    Security Fix(es):

    * mod_auth_openidc: mod_auth_openidc allows OIDCProviderAuthRequestMethod POSTs to leak protected data     (CVE-2025-31492)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:3837 advisory.

    OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating     systems. It includes the core files necessary for both the OpenSSH client and server.

    Security Fix(es):

    * openssh: Machine-in-the-middle attack if VerifyHostKeyDNS is enabled (CVE-2025-26465)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:7494 advisory.

    Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet     and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by     Sun under the Java Community Process.  Tomcat is developed in an open and participatory environment and     released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the     best-of-breed developers from around the world.

    Security Fix(es):

    * tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT     (CVE-2025-24813)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:7508 advisory.

    The OpenJDK 21 runtime environment.

    Security Fix(es):

    * openjdk: Enhance Buffered Image handling (Oracle CPU 2025-04) (CVE-2025-30698)

    * openjdk: Improve compiler transformations (Oracle CPU 2025-04) (CVE-2025-30691)

    * openjdk: Better TLS connection support (Oracle CPU 2025-04) (CVE-2025-21587)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:7501 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (CVE-2025-21927)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:0914 advisory.

    MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is     a client/server implementation consisting of a server daemon (mariadbd) and many different client programs     and libraries. The base package contains the standard MariaDB/MySQL client programs and utilities.

    Security Fix(es):

    * mysql: InnoDB unspecified vulnerability (CPU Oct 2023) (CVE-2023-22084)

    * mysql: Client: mysqldump unspecified vulnerability (CPU Apr 2024) (CVE-2024-21096)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:7499 advisory.

    The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript     translates PostScript code to common bitmap formats so that the code can be displayed or printed.

    Security Fix(es):

    * ghostscript: Buffer Overflow in Ghostscript PDF XRef Stream Handling (CVE-2024-46952)

    * ghostscript: Arbitrary Code Execution in Artifex Ghostscript Pattern Color Space (CVE-2024-46951)

    * ghostscript: Directory Traversal in Ghostscript via Overlong UTF-8 Encoding (CVE-2024-46954)

    * ghostscript: Path Traversal and Code Execution via Integer Overflow in Ghostscript (CVE-2024-46953)

    * ghostscript: Out-of-Bounds Data Access in Ghostscript Leads to Arbitrary Code Execution (CVE-2024-46956)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:7601 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 9.0.106 and .NET Runtime 9.0.5.Security Fix(es):

    * dotnet: .NET and Visual Studio Spoofing Vulnerability (CVE-2025-26646)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:7497 advisory.

    Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

    Security Fix(es):

    * tomcat: Apache Tomcat: Authentication bypass when using Jakarta Authentication API (CVE-2024-52316)

    * tomcat: Apache Tomcat: DoS in examples web application (CVE-2024-54677)

    * tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT     (CVE-2025-24813)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:8374 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (CVE-2025-21919)

    * kernel: cifs: Fix integer overflow while processing acregmax mount option (CVE-2025-21964)

    * kernel: ext4: fix OOB read when checking dotdot dir (CVE-2025-37785)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Severity
237863	RHEL 10 : skopeo (RHSA-2025:7467)	high
237862	RHEL 10 : podman (RHSA-2025:7462)	high
237861	RHEL 10 : unbound (RHSA-2025:8047)	medium
237860	RHEL 10 : valkey (RHSA-2025:7509)	high
237859	RHEL 10 : osbuild-composer (RHSA-2025:7503)	high
237858	RHEL 10 : exiv2 (RHSA-2025:7457)	medium
237857	RHEL 10 : pcs (RHSA-2025:8319)	high
237856	RHEL 10 : libsoup3 (RHSA-2025:7505)	high
237855	RHEL 10 : delve and golang (RHSA-2025:7466)	medium
237854	RHEL 10 : grafana (RHSA-2025:7475)	high
237853	RHEL 10 : python-jinja2 (RHSA-2025:7476)	medium
237852	RHEL 10 : expat (RHSA-2025:7512)	high
237851	RHEL 10 : firefox (RHSA-2025:7506)	critical
237850	RHEL 8 : glibc (RHSA-2025:3828)	high
237849	RHEL 10 : nodejs22 (RHSA-2025:7502)	high
237848	RHEL 10 : xorg-x11-server-Xwayland (RHSA-2025:7458)	high
237847	RHEL 10 : yggdrasil (RHSA-2025:7592)	high
237846	RHEL 10 : grafana (RHSA-2025:7892)	high
237845	RHEL 10 : gstreamer1-plugins-bad-free (RHSA-2025:8184)	high
237844	RHEL 10 : varnish (RHSA-2025:8550)	medium
237843	RHEL 10 : opentelemetry-collector (RHSA-2025:7479)	high
237842	RHEL 10 : thunderbird (RHSA-2025:7493)	high
237841	RHEL 10 : firefox (RHSA-2025:7491)	high
237840	RHEL 10 : kernel (RHSA-2025:8137)	high
237839	RHEL 10 : ghostscript (RHSA-2025:7593)	critical
237838	RHEL 10 : sqlite (RHSA-2025:7517)	medium
237837	RHEL 10 : libxslt (RHSA-2025:7496)	high
237836	RHEL 10 : libarchive (RHSA-2025:7510)	medium
237835	RHEL 10 : kernel (RHSA-2025:7956)	high
237834	RHEL 10 : ruby (RHSA-2025:8131)	medium
237833	RHEL 10 : thunderbird (RHSA-2025:8196)	high
237832	RHEL 10 : java-21-ibm-semeru-certified-jdk update (Moderate) (RHSA-2025:8063)	high
237831	RHEL 10 : buildah (RHSA-2025:7459)	high
237830	RHEL 10 : libsoup3 (RHSA-2025:8128)	medium
237828	RHEL 10 : gvisor-tap-vsock (RHSA-2025:7484)	high
237827	RHEL 10 : python-tornado (RHSA-2025:8135)	high
237826	RHEL 10 : php (RHSA-2025:7489)	critical
237825	RHEL 10 : xz (RHSA-2025:7524)	high
237824	RHEL 10 : firefox (RHSA-2025:8125)	critical
237823	RHEL 10 : golang (RHSA-2025:8477)	critical
237822	RHEL 10 : mod_auth_openidc (RHSA-2025:7490)	high
237821	RHEL 9 : openssh (RHSA-2025:3837)	medium
237820	RHEL 10 : tomcat9 (RHSA-2025:7494)	critical
237819	RHEL 10 : java-21-openjdk (RHSA-2025:7508)	high
237818	RHEL 10 : kernel (RHSA-2025:7501)	high
237817	RHEL 9 : galera and mariadb (RHSA-2025:0914)	medium
237816	RHEL 10 : ghostscript (RHSA-2025:7499)	high
237815	RHEL 10 : .NET 9.0 (RHSA-2025:7601)	high
237814	RHEL 10 : tomcat (RHSA-2025:7497)	critical
237813	RHEL 10 : kernel (RHSA-2025:8374)	high

Detections

Analytics

Red Hat Local Security Checks Family for Nessus

high

high

medium

high

high

medium

high

high

medium

high

medium

high

critical

high

high

high

high

high

high

medium

high

high

high

high

critical

medium

high

medium

high

medium

high

high

high

medium

high

high

critical

high

critical

critical

high

medium

critical

high

high

medium

high

high

critical

high