The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-19216 advisory.

    - Security fixes for CVE-2026-4786 and CVE-2026-6100     Resolves: RHEL-167919, RHEL-168161
    - Security fix for CVE-2026-4519     Resolves: RHEL-158117

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_19175 advisory.

    * python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519)

    * python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression     modules (CVE-2026-6100)

    * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API     (CVE-2026-4786)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_19216 advisory.

    * python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519)

    * python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression     modules (CVE-2026-6100)

    * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API     (CVE-2026-4786)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the python3 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    The import hook in CPython that handles legacy *.pyc files (SourcelessFileLoader) is incorrectly handled     in FileLoader (a base class) and so does not use io.open_code() to read the .pyc files. sys.audit handlers     for this audit event therefore do not fire.(CVE-2026-2297)

    CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host.(CVE-2026-1502)

    http.cookies.Morsel.js_output() returns an inline script snippet and only escapes ' for JavaScript     string context. It does not neutralize the HTML parser-sensitive sequence /script inside the     generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie     value.(CVE-2026-6019)

    Mitgation of CVE-2026-4519 was incomplete. If the URL contained '%action' the mitigation could be bypassed     for certain browser types the 'webbrowser.open()' API could have commands injected into the underlying     shell. See CVE-2026-4519 for details.(CVE-2026-4786)

    Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and     `gzip.GzipFile` when a memory allocation fails with a `MemoryError` and the decompression instance is re-     used. This scenario can be triggered if the process is under memory pressure. The fix cleans up the     dangling pointer in this specific error condition.

    The vulnerability is only present if the program re-uses decompressor instances across multiple     decompression calls even after a `MemoryError` is raised during decompression. Using the helper functions     to one-shot decompress data such as `lzma.decompress()`, `bz2.decompress()`, `gzip.decompress()`, and     `zlib.decompress()` are not affected as a new decompressor instance is used per call. If the decompressor     instance is not re-used after an error condition, this usage is similarly not vulnerable.(CVE-2026-6100)

    The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The     Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass     input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to     BaseCookie.output().(CVE-2026-3644)

    When folding a long comment in an email header containing exclusively unfoldable characters, the     parenthesis would not be preserved. This could be used for injecting headers into email messages where     addresses are user-controlled and not sanitized.(CVE-2025-11468)

    DISPUTED: The project has clarified that the documentation was incorrect, and that pkgutil.get_data() has     the same security model as open(). The documentation has been updated to clarify this point. There is no     vulnerability in the function if following the intended security model.

    pkgutil.get_data() did not validate the resource argument as documented, allowing path     traversals.(CVE-2026-3479)

    When an Expat parser with a registered ElementDeclHandler parses an inline     document type definition containing a deeply nested content model a C stack     overflow occurs.(CVE-2026-4224)

    User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in     the data URL mediatype.(CVE-2025-15282)

    The webbrowser.open() API would accept leading dashes in the URL which     could be handled as command line options for certain web browsers. New     behavior rejects leading dashes. Users are recommended to sanitize URLs     prior to passing to webbrowser.open().(CVE-2026-4519)

    The 'tarfile' module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while     processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a     crafted tar archive being misinterpreted by the tarfile module compared to other     implementations.(CVE-2025-13462)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization python3 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:10950 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small     document that is submitted for parsing (CVE-2025-59375)

    * python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075)

    * cpython: Out-of-memory when loading Plist (CVE-2025-13837)

    * cpython: Header injection via newlines in data URL mediatype in Python (CVE-2025-15282)

    * cpython: Header injection in http.cookies.Morsel in Python (CVE-2026-0672)

    * cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297)

    * cpython: Incomplete control character validation in http.cookies (CVE-2026-3644)

    * cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224)

    * python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502)

    * python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression     modules (CVE-2026-6100)

    * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API     (CVE-2026-4786)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1818-1 advisory.

    Security issues fixed:

    - CVE-2026-1502: HTTP client proxy tunnel headers not validated for CR/LF (bsc#1261969).
    - CVE-2026-3446: base64 decoding stops at first padded quad by default and ignores other information that     could be       processed (bsc#1261970).
    - CVE-2026-3479: improper resource argument validation in `pkgutil.get_data()` can lead to path traversal     (bsc#1259989).
    - CVE-2026-4786: URLs prefixed with `%action` can pass the dash-prefix safety check and allow for command     injection       (bsc#1262319).
    - CVE-2026-6019: `BaseCookie.js_output()` does not neutralize characters in cookie values embedded in JS     (bsc#1262654).
    - CVE-2026-6100: use-after-free in `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile`     when process is       under memory pressure(bsc#1262098).

    Other updates and bugfixes:

    - Rewrite structure of Python interpreter packages. `python3*` symbols should be now provided by real     python3 packages       and its subpackages instead of the virtual provides (bsc#1258364).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_10950 advisory.

    * expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small     document that is submitted for parsing (CVE-2025-59375)

    * python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075)

    * cpython: Out-of-memory when loading Plist (CVE-2025-13837)

    * cpython: Header injection via newlines in data URL mediatype in Python (CVE-2025-15282)

    * cpython: Header injection in http.cookies.Morsel in Python (CVE-2026-0672)

    * cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297)

    * cpython: Incomplete control character validation in http.cookies (CVE-2026-3644)

    * cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224)

    * python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502)

    * python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression     modules (CVE-2026-6100)

    * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API     (CVE-2026-4786)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-dfc9182263 advisory.

    New Python version including bugfixes and security fixes.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
322205	Oracle Linux 9 : python3.9 (ELSA-2026-19216)	Nessus	Oracle Linux Local Security Checks	6/23/2026	6/23/2026	critical
354902	Rocky Linux 9 [CIQ] Security Update: python3.11 / python3.11-debug / python3.11-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_19175)	Nessus	Rocky Linux Local Security Checks	10/1/2026	10/1/2026	critical
356878	Rocky Linux 9 [CIQ] Security Update: python-unversioned-command / python3 / python3-debug / etc Multiple Vulnerabilities (crlsa-2026_19216)	Nessus	Rocky Linux Local Security Checks	10/1/2026	10/1/2026	critical
377435	EulerOS Virtualization 2.15.0 : python3 (EulerOS-SA-2026-4728)	Nessus	Huawei Local Security Checks	11/7/2026	11/7/2026	critical
310559	RHEL 8 : python3.12 (RHSA-2026:10950)	Nessus	Red Hat Local Security Checks	4/27/2026	4/27/2026	critical
315056	SUSE SLES15 Security Update : python39 (SUSE-SU-2026:1818-1)	Nessus	SuSE Local Security Checks	5/16/2026	5/19/2026	critical
356291	Rocky Linux 8 [CIQ] Security Update: python3.12 / python3.12-debug / python3.12-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_10950)	Nessus	Rocky Linux Local Security Checks	10/1/2026	10/2/2026	critical
321848	Fedora 44 : python3.13 (2026-dfc9182263)	Nessus	Fedora Local Security Checks	6/21/2026	6/21/2026	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical

critical