There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Babel is a compiler for writing next generation JavaScript. Prior to 8.0.0-rc.6 and 7.29.6, @babel/core
    affected by an arbitrary file read via a sourceMappingURL comment. Using @babel/core to compile
    maliciously crafted code can allow an attacker to read any source map from the system that is running
    Babel, if the attacker controls the input source code, can read the output source code, and knows the path
    of the source map file that they want to read. This vulnerability is fixed in 8.0.0-rc.6 and 7.29.6.
    (CVE-2026-49356)

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - Babel 是用于编写下一代 JavaScript 的编译器。低于 8.0.0-rc.6 的 7.29.6@babel/core 受到通过 sourceMappingURL 注释读取的任意文件的影响。如果攻击者控制输入源代码、能够读取输出源代码并知道自己要读取的源映射文件的路径，则使用 @babel/core 编译恶意构建的代码，可允许攻击者从运行 Babel 的系统读取任何源映射。已在 8.0.0-rc.6 和 7.29.6中修复此漏洞。
    (CVE-2026-49356)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - Babel 是一個用於編寫下一代 JavaScript 的編譯器。在 8.0.0-rc.6 和 7.29.6之前，@babel/core 會受到透過 sourceMappingURL 註解讀取的任意檔案的影響。如果攻擊者控制輸入原始程式碼、可以讀取輸出原始程式碼並知道他們想要讀取的原始程式碼對應檔案的路徑，則使用 @babel/core 編譯惡意製作的程式碼可讓攻擊者從執行 Babel 的系統讀取任何原始程式碼對應。此弱點已在 8.0.0-rc.6 和 7.29.6中修正。
    (CVE-2026-49356)

請注意，Nessus 依賴供應商報告的套件存在。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - Babel は、次世代 JavaScript を書くためのコンパイラです。8.0.0-rc.6 および 7.29.6 より前の @babel/core は、sourceMappingURL コメントを通じた任意のファイルの読み取りによる影響を受けます。@babel/core を使用して、悪意を持って細工されたコードをコンパイルすると、攻撃者が入力ソースコードを制御し、出力ソースコードを読み取ることができ、読み取ろうとするソースマップファイルのパスを知っている場合、攻撃者は Babel を実行しているシステムから任意のソースマップを読み取る可能性があります。この脆弱性は、8.0.0-rc.6 および 7.29.6 で修正されています。
    (CVE-2026-49356)

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Babel is a compiler for writing next generation JavaScript. Prior to 8.0.0-rc.6 and 7.29.6, @babel/core     affected by an arbitrary file read via a sourceMappingURL comment. Using @babel/core to compile     maliciously crafted code can allow an attacker to read any source map from the system that is running     Babel, if the attacker controls the input source code, can read the output source code, and knows the path     of the source map file that they want to read. This vulnerability is fixed in 8.0.0-rc.6 and 7.29.6.
    (CVE-2026-49356)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21448-1 advisory.

    - CVE-2025-7783: form-data: unsafe `Math.random()` function is used to select a boundary value for     multipart       form-encoded data (bsc#1246822).
    - CVE-2026-12143: form-data: CRLF injection via unescaped multipart field names and filenames     (bsc#1272310).
    - CVE-2026-13149: brace-expansion: `expand()` function exhibits exponential-time complexity when     processing       non-expanding `{}` brace groups (bsc#1269927).
    - CVE-2026-13311: shell-quote: quadratic complexity in `parse()` function when processing specially     crafted strings       (bsc#1269359).
    - CVE-2026-13676: fast-uri: host-based policy bypass due to failure to canonicalize Unicode/IDN hostnames     for       HTTP-family URLs (bsc#1269595).
    - CVE-2026-27601: underscore: DoS via stack overflow due to missing depth limits in `_.flatten` and     `_.isEqual`       functions (bsc#1259169).
    - CVE-2026-40181: react-router: open redirect to an external domain due to path values starting with `//`     being       reinterpreted as protocol-relative URLs (bsc#1272311).
    - CVE-2026-49356: @babel/core: arbitrary file read via `sourceMappingURL` comment (bsc#1272317).
    - CVE-2026-53550: js-yaml: quadratic complexity in merge-key processing when processing a crafted YAML     document       (bsc#1268851).
    - CVE-2026-53632: launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows (bsc#1272319).
    - CVE-2026-54466: websocket-driver: message corruption via abuse of protocol length headers (bsc#1272312).
    - CVE-2026-54490: websocket-driver: resource limit bypass via message compression (bsc#1272313).
    - CVE-2026-55602: http-proxy-middleware: Host-header-driven backend routing bypass via `router` host+path     substring       matching (bsc#1272318).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
443203	SCA: security update for @babel/core (GHSA-4x5r-pxfx-6jf8)	Tenable Self-Hosted Container Security	SCA Checks	6/15/2026	7/2/2026	low
443203	SCA: security update for @babel/core (GHSA-4x5r-pxfx-6jf8)	Tenable Cloud Security	SCA Checks	6/15/2026	7/2/2026	low
322252	Linux Distros 未修补的漏洞：CVE-2026-49356	Nessus	Misc.	6/23/2026	9/28/2026	low
322252	Linux Distros 未修補弱點：CVE-2026-49356	Nessus	Misc.	6/23/2026	9/28/2026	low
322252	Linux Distros のパッチ未適用の脆弱性: CVE-2026-49356	Nessus	Misc.	6/23/2026	9/28/2026	low
322252	Linux Distros Unpatched Vulnerability : CVE-2026-49356	Nessus	Misc.	6/23/2026	9/28/2026	low
330583	openSUSE 16 Security Update : agama-web-ui (openSUSE-SU-2026:21448-1)	Nessus	SuSE Local Security Checks	7/29/2026	7/29/2026	critical

Detections

Analytics

Plugins Search

low

low

low

low

low

low

critical