An update of the curl package has been released.

According to its self-reported version, the Nessus Network Monitor running on the remote host is prior to 6.5.3. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2026-02 advisory.

  - A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects     the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make alltest     Handler. The manipulation leads to heap-based buffer overflow. It is recommended to apply a patch to fix     this issue. The associated identifier of this vulnerability is VDB-248999. (CVE-2023-7104)

  - A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under     certain circumstances when the XML schematron has the <sch:name path=.../> schema elements. This flaw     allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the     program's crash using libxml or other possible undefined behaviors. (CVE-2025-49794)

  - A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can     trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that     can lead libxml to crash, resulting in a denial of service or other possible undefined behavior due to     sensitive data being corrupted in memory. (CVE-2025-49796)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of HTTP Server installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2026 CPU advisory.

  - Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Core). Supported     versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server. While the     vulnerability is in Oracle HTTP Server, attacks may significantly impact additional products (scope     change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or     modification access to critical data or all Oracle HTTP Server accessible data as well as unauthorized     access to critical data or complete access to all Oracle HTTP Server accessible data. (CVE-2026-34291)

  - Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi)     passes the shell-escaped query string to #exec cmd=... directives. This issue affects Apache HTTP Server     before 2.4.66. Users are recommended to upgrade to version 2.4.66, which fixes the issue. (CVE-2025-58098)

  - Server-Side Request Forgery (SSRF) in Apache HTTP Server on Windows allows to potentially leak NTLM hashes     to a malicious server via mod_rewrite or apache expressions that pass unvalidated request input. This issue     affects Apache HTTP Server: from 2.4.0 through 2.4.63. Note: The Apache HTTP Server Project will be setting     a higher bar for accepting vulnerability reports regarding SSRF via UNC paths. The server offers limited     protection against administrators directing the server to open UNC paths. Windows servers should limit the     hosts they will connect over via SMB based on the nature of NTLM authentication. (CVE-2024-43394)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - curl's WebSocket code did not update the 32-bit mask pattern for each new outgoing frame as the     specification says. Instead it used a fixed mask that persisted and was used throughout the entire     connection. A predictable mask pattern allows for a malicious server to induce traffic between the two     communicating parties that could be interpreted by an involved proxy (configured or transparent) as     genuine, real, HTTP traffic with content and thereby poison its cache. That cached poisoned content could     then be served to all users of that proxy. (CVE-2025-10148)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03268-1 advisory.

    Security issues fixed:

    - CVE-2025-9086: bug in patch comparison logic when processing cookies can lead to out-of-bounds read in     heap buffer       (bsc#1249191).
    - CVE-2025-10148: predictable websocket mask can lead to proxy cache poisoning by malicious server     (bsc#1249348).

    Other issues fixed:

    - Fix the --ftp-pasv option in curl v8.14.1 (bsc#1246197).
      * tool_getparam: fix --ftp-pasv [5f805ee]

    - Update to version 8.14.1 (jsc#PED-13055, jsc#PED-13056).
      * TLS: add CURLOPT_SSL_SIGNATURE_ALGORITHMS and --sigalgs.
      * websocket: add option to disable auto-pong reply.
      * huge number of bugfixes.

      Please see https://curl.se/ch/ for full changelogs.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2025-20090-1 advisory.

    - CVE-2025-9086: Fixed Out of bounds read for cookie path (bsc#1249191)
    - CVE-2025-11563: Fixed wcurl path traversal with percent-encoded slashes (bsc#1253757)
    - CVE-2025-10148: Fixed predictable WebSocket mask (bsc#1249348)

    Other fixes:
    - tool_operate: fix return code when --retry is used but not       triggered (bsc#1249367)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
275306	Photon OS 4.0: Curl PHSA-2025-4.0-0903	Nessus	PhotonOS Local Security Checks	11/13/2025	11/13/2025	medium
297102	Nessus Network Monitor < 6.5.3 Multiple Vulnerabilities (TNS-2026-02)	Nessus	Misc.	1/29/2026	2/3/2026	high
309968	Oracle HTTP Server (April 2026 CPU)	Nessus	Web Servers	4/23/2026	4/27/2026	high
309969	Oracle HTTP Server (April 2026 CPU)	Nessus	Web Servers	4/23/2026	4/27/2026	high
264805	Linux Distros Unpatched Vulnerability : CVE-2025-10148	Nessus	Misc.	9/15/2025	9/24/2026	medium
265421	SUSE SLED15: brotli / curl / libbrotli-devel / libbrotlicommon1 / etc (SUSE-SU-2025:03268-1)	Nessus	SuSE Local Security Checks	9/19/2025	6/26/2026	medium
333765	Photon OS 5.0: Curl PHSA-2025-5.0-91-0660	Nessus	PhotonOS Local Security Checks	8/10/2026	8/10/2026	medium
277017	openSUSE 16 Security Update : curl (openSUSE-SU-2025-20090-1)	Nessus	SuSE Local Security Checks	12/2/2025	3/3/2026	medium

Detections

Analytics

Plugins Search

medium

high

high

high

medium

medium

medium

medium