The version of firefox installed on the remote host is prior to 140.7.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2FIREFOX-2026-051 advisory.

    HarfBuzz is a text shaping engine. Prior to version 12.3.0, a null pointer dereference vulnerability     exists in the SubtableUnicodesCache::create function located in src/hb-ot-cmap-table.hh. The function     fails to check if hb_malloc returns NULL before using placement new to construct an object at the returned     pointer address. When hb_malloc fails to allocate memory (which can occur in low-memory conditions or when     using custom allocators that simulate allocation failures), it returns NULL. The code then attempts to     call the constructor on this null pointer using placement new syntax, resulting in undefined behavior and     a Segmentation Fault. This issue has been patched in version 12.3.0. (CVE-2026-22693)

    LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable     Network Graphics) raster image files. From 1.6.51 to 1.6.53, there is a heap buffer over-read in the     libpng simplified API function png_image_finish_read when processing interlaced 16-bit PNGs with 8-bit     output format and non-minimal row stride. This is a regression introduced by the fix for CVE-2025-65018.
    This vulnerability is fixed in 1.6.54. (CVE-2026-22695)

    LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable     Network Graphics) raster image files. From 1.6.26 to 1.6.53, there is an integer truncation in the libpng     simplified write API functions png_write_image_16bit and png_write_image_8bit causes heap buffer over-read     when the caller provides a negative row stride (for bottom-up image layouts) or a stride exceeding 65535     bytes. The bug was introduced in libpng 1.6.26 (October 2016) by casts added to silence compiler warnings     on 16-bit systems. This vulnerability is fixed in 1.6.54. (CVE-2026-22801)

    In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize     because there is no integer overflow check for tag buffer reallocation. (CVE-2026-25210)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:4728 advisory.

    * libpng: libpng: Information disclosure and denial of service via integer truncation in simplified write     API (CVE-2026-22801)

    * libpng: libpng: Denial of service and information disclosure via heap buffer over-read in     png_image_finish_read (CVE-2026-22695)

    * libpng: LIBPNG has a heap buffer overflow in png_set_quantize (CVE-2026-25646)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-342:07 advisory.

    * libpng: libpng: Information disclosure and denial of service via integer truncation in simplified write     API (CVE-2026-22801)
      * libpng: libpng: Denial of service and information disclosure via heap buffer over-read in     png_image_finish_read (CVE-2026-22695)
      * libpng: LIBPNG has a heap buffer overflow in png_set_quantize (CVE-2026-25646)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AHV installed on the remote host is prior to AHV-11.0.1.1. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-11.0.1.1 advisory.

  - LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable     Network Graphics) raster image files. Prior to 1.6.55, an out-of-bounds read vulnerability exists in the     png_set_quantize() API function. When the function is called with no histogram and the number of colors in     the palette is more than twice the maximum supported by the user's display, certain palettes will cause     the function to enter into an infinite loop that reads past the end of an internal heap-allocated buffer.
    The images that trigger this vulnerability are valid per the PNG specification. This vulnerability is     fixed in 1.6.55. (CVE-2026-25646)

  - In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is     intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are     fixed versions.) (CVE-2025-68973)

  - In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to     operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated     data. There is no benefit in operating in-place in algif_aead since the source and destination come from     different mappings. Get rid of all the complexity added for in-place operation and just copy the AD     directly. (CVE-2026-31431)

  - A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in     the g_escape_uri_string() function. If the string to escape contains a very large number of unacceptable     characters (which would need escaping), the calculation of the length of the escaped string could     overflow, leading to a potential write off the end of the newly allocated string. (CVE-2025-13601)

  - When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency     on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively     nested documents. (CVE-2025-12084)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:3405 advisory.

    The libpng packages contain a library of functions for creating and manipulating Portable Network Graphics     (PNG) image format files.

    Security Fix(es):

    * libpng: libpng: Information disclosure and denial of service via integer truncation in simplified write     API (CVE-2026-22801)

    * libpng: libpng: Denial of service and information disclosure via heap buffer over-read in     png_image_finish_read (CVE-2026-22695)

    * libpng: LIBPNG has a heap buffer overflow in png_set_quantize (CVE-2026-25646)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-3405 advisory.

    - fix CVE-2026-25646: heap buffer overflow in png_set_quantize (RHEL-148970)
    - fix CVE-2026-22695: heap buffer over-read in png_image_finish_read (RHEL-148403)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the libpng package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable     Network Graphics) raster image files. From 1.6.26 to 1.6.53, there is an integer truncation in the libpng     simplified write API functions png_write_image_16bit and png_write_image_8bit causes heap buffer over-read     when the caller provides a negative row stride (for bottom-up image layouts) or a stride exceeding 65535     bytes. The bug was introduced in libpng 1.6.26 (October 2016) by casts added to silence compiler warnings     on 16-bit systems. This vulnerability is fixed in 1.6.54.(CVE-2026-22801)

    LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable     Network Graphics) raster image files. From 1.6.51 to 1.6.53, there is a heap buffer over-read in the     libpng simplified API function png_image_finish_read when processing interlaced 16-bit PNGs with 8-bit     output format and non-minimal row stride. This is a regression introduced by the fix for CVE-2025-65018.
    This vulnerability is fixed in 1.6.54.(CVE-2026-22695)

    LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable     Network Graphics) raster image files. Prior to 1.6.52, an out-of-bounds read vulnerability in libpng's     simplified API allows reading up to 1012 bytes beyond the png_sRGB_base[512] array when processing valid     palette PNG images with partial transparency and gamma correction. The PNG files that trigger this     vulnerability are valid per the PNG specification; the bug is in libpng's internal state management.
    Upgrade to libpng 1.6.52 or later.(CVE-2025-66293)

Tenable has extracted the preceding description block directly from the EulerOS libpng security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:4306 advisory.

    * libpng: libpng: Information disclosure and denial of service via integer truncation in simplified write     API (CVE-2026-22801)

    * libpng: libpng: Denial of service and information disclosure via heap buffer over-read in     png_image_finish_read (CVE-2026-22695)

    * libpng: LIBPNG has a heap buffer overflow in png_set_quantize (CVE-2026-25646)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-307:02 advisory.

    * libpng: libpng: Information disclosure and denial of service via integer truncation in simplified write     API (CVE-2026-22801)
      * libpng: libpng: Denial of service and information disclosure via heap buffer over-read in     png_image_finish_read (CVE-2026-22695)
      * libpng: LIBPNG has a heap buffer overflow in png_set_quantize (CVE-2026-25646)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:4732 advisory.

    The libpng packages contain a library of functions for creating and manipulating Portable Network Graphics     (PNG) image format files.

    Security Fix(es):

    * libpng: libpng: Information disclosure and denial of service via integer truncation in simplified write     API (CVE-2026-22801)

    * libpng: libpng: Denial of service and information disclosure via heap buffer over-read in     png_image_finish_read (CVE-2026-22695)

    * libpng: LIBPNG has a heap buffer overflow in png_set_quantize (CVE-2026-25646)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-4728 advisory.

    - fix CVE-2026-25646: heap buffer overflow in png_set_quantize (RHEL-148338)
    - fix CVE-2026-22695: heap buffer over-read in png_image_finish_read (RHEL-148852)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
299553	Amazon Linux 2 : firefox, --advisory ALAS2FIREFOX-2026-051 (ALASFIREFOX-2026-051)	Nessus	Amazon Linux Local Security Checks	2/19/2026	3/16/2026	high
302877	RockyLinux 8 : libpng (RLSA-2026:4728)	Nessus	Rocky Linux Local Security Checks	3/18/2026	3/18/2026	high
303252	MiracleLinux 8 : libpng-1.6.34-10.el8_10 (AXSA:2026-342:07)	Nessus	Miracle Linux Local Security Checks	3/21/2026	3/21/2026	high
314327	Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-11.0.1.1)	Nessus	Misc.	5/12/2026	5/13/2026	high
300252	RHEL 9 : libpng (RHSA-2026:3405)	Nessus	Red Hat Local Security Checks	3/2/2026	3/2/2026	high
300471	Oracle Linux 9 : libpng (ELSA-2026-3405)	Nessus	Oracle Linux Local Security Checks	3/3/2026	4/30/2026	high
301612	EulerOS 2.0 SP13 : libpng (EulerOS-SA-2026-1283)	Nessus	Huawei Local Security Checks	3/10/2026	3/10/2026	high
301926	RockyLinux 8 : mingw-libpng (RLSA-2026:4306)	Nessus	Rocky Linux Local Security Checks	3/12/2026	3/12/2026	high
302487	MiracleLinux 8 : mingw-libpng-1.6.34-2.el8_10 (AXSA:2026-307:02)	Nessus	Miracle Linux Local Security Checks	3/16/2026	3/16/2026	high
302792	RHEL 8 : libpng (RHSA-2026:4732)	Nessus	Red Hat Local Security Checks	3/17/2026	3/17/2026	high
302808	Oracle Linux 8 : libpng (ELSA-2026-4728)	Nessus	Oracle Linux Local Security Checks	3/17/2026	4/30/2026	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high

high

high