The remote Oracle Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-0927 advisory.

    [1:17.0.18.0.8-1.0.1]
    - Add Oracle vendor bug URL [Orabug: 34340155]

    [1:17.0.18.0.8-1]
    - Update to jdk-17.0.18+8 (GA)
    - Add to .gitignore openjdk-17.0.18+8.tar.xz
    - Sync java-17-openjdk-portable.specfile from openjdk-portable-rhel-8
    - Set buildver to 8
    - Set is_ga to 1
    - Update sources to openjdk-17.0.18+8.tar.xz
    - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. **

    [1:17.0.18.0.7-0.1.ea]
    - Update to jdk-17.0.18+7 (EA)
    - Add to .gitignore openjdk-17.0.18+7-ea.tar.xz
    - Set updatever to 18
    - Set buildver to 7
    - Set is_ga to 0
    - Update sources to openjdk-17.0.18+7-ea.tar.xz
    - Set bundled libpng version to 1.6.51
    - Sync java-17-openjdk-portable.specfile from openjdk-portable-rhel-8

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-123:03 advisory.

    JDK: Improve JMX connections (CVE-2026-21925)         JDK: Improve HttpServer Request handling (CVE-2026-21933)         JDK: Enhance Certificate Checking (CVE-2026-21945)         libpng: LIBPNG buffer overflow (CVE-2025-64720)         libpng: LIBPNG heap buffer overflow (CVE-2025-65018)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AHV installed on the remote host is prior to AHV-11.0.1. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-11.0.1 advisory.

  - A flaw was found in libssh when using the ChaCha20 cipher with the OpenSSL library. If an attacker manages     to exhaust the heap space, this error is not detected and may lead to libssh using a partially initialized     cipher context. This occurs because the OpenSSL error code returned aliases with the SSH_OK code,     resulting in libssh not properly detecting the error returned by the OpenSSL library. This issue can lead     to undefined behavior, including compromised data confidentiality and integrity or crashes.
    (CVE-2025-5987)

  - A vulnerability has been found in GNU Binutils 2.45. The affected element is the function elf_swap_shdr in     the library bfd/elfcode.h of the component Linker. The manipulation leads to heap-based buffer overflow.
    The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The     identifier of the patch is 9ca499644a21ceb3f946d1c179c38a83be084490. To fix this issue, it is recommended     to deploy a patch. The code maintainer replied with [f]ixed for 2.46. (CVE-2025-11083)

  - 1. A cookie is set using the `secure` keyword for `https://target` 2. curl is redirected to or otherwise     made to speak with `http://target` (same hostname, but using clear text HTTP) using the same cookie set 3.
    The same cookie name is set - but with just a slash as path (`path=\/\,`). Since this site is not     secure, the cookie *should* just be ignored. 4. A bug in the path comparison logic makes curl read outside     a heap buffer boundary The bug either causes a crash or it potentially makes the comparison come to the     wrong conclusion and lets the clear-text site override the contents of the secure cookie, contrary to     expectations and depending on the memory contents immediately following the single-byte allocation that     holds the path. The presumed and correct behavior would be to plainly ignore the second set of the cookie     since it was already set as secure on a secure host so overriding it on an insecure host should not be     okay. (CVE-2025-9086)

  - Vim is an open source, command line text editor. Prior to version 9.1.1552, a path traversal issue in     Vim's tar.vim plugin can allow overwriting of arbitrary files when opening specially crafted tar archives.
    Impact is low because this exploit requires direct user interaction. However, successfully exploitation     can lead to overwriting sensitive files or placing executable code in privileged locations, depending on     the permissions of the process editing the archive. The victim must edit such a file using Vim which will     reveal the filename and the file content, a careful user may suspect some strange things going on.
    Successful exploitation could results in the ability to execute arbitrary commands on the underlying     operating system. Version 9.1.1552 contains a patch for the vulnerability. (CVE-2025-53905)

  - Vim is an open source, command line text editor. Prior to version 9.1.1551, a path traversal issue in     Vim's zip.vim plugin can allow overwriting of arbitrary files when opening specially crafted zip archives.
    Impact is low because this exploit requires direct user interaction. However, successfully exploitation     can lead to overwriting sensitive files or placing executable code in privileged locations, depending on     the permissions of the process editing the archive. The victim must edit such a file using Vim which will     reveal the filename and the file content, a careful user may suspect some strange things going on.
    Successful exploitation could results in the ability to execute arbitrary commands on the underlying     operating system. Version 9.1.1551 contains a patch for the vulnerability. (CVE-2025-53906)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AHV installed on the remote host is prior to AHV-10.3.1.4. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-10.3.1.4 advisory.

  - In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is     intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are     fixed versions.) (CVE-2025-68973)

  - LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable     Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, an out-of-bounds read     vulnerability exists in png_image_read_composite when processing palette images with     PNG_FLAG_OPTIMIZE_ALPHA enabled. The palette compositing code in png_init_read_transformations incorrectly     applies background compositing during premultiplication, violating the invariant component  alpha  257     required by the simplified PNG API. This issue has been patched in version 1.6.51. (CVE-2025-64720)

  - LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable     Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, there is a heap buffer overflow     vulnerability in the libpng simplified API function png_image_finish_read when processing 16-bit     interlaced PNGs with 8-bit output format. Attacker-crafted interlaced PNG files cause heap writes beyond     allocated buffer bounds. This issue has been patched in version 1.6.51. (CVE-2025-65018)

  - LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable     Network Graphics) raster image files. Prior to 1.6.52, an out-of-bounds read vulnerability in libpng's     simplified API allows reading up to 1012 bytes beyond the png_sRGB_base[512] array when processing valid     palette PNG images with partial transparency and gamma correction. The PNG files that trigger this     vulnerability are valid per the PNG specification; the bug is in libpng's internal state management.
    Upgrade to libpng 1.6.52 or later. (CVE-2025-66293)

  - Issue summary: An application trying to decrypt CMS messages encrypted using password based encryption can     trigger an out-of-bounds read and write. Impact summary: This out-of-bounds read may trigger a crash which     leads to Denial of Service for an application. The out-of-bounds write can cause a memory corruption which     can have various consequences including a Denial of Service or Execution of attacker-supplied code.
    Although the consequences of a successful exploit of this vulnerability could be severe, the probability     that the attacker would be able to perform it is low. Besides, password based (PWRI) encryption support in     CMS messages is very rarely used. For that reason the issue was assessed as Moderate severity according to     our Security Policy. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue,     as the CMS implementation is outside the OpenSSL FIPS module boundary. (CVE-2025-9230)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:0928 advisory.

    * JDK: Improve JMX connections (CVE-2026-21925)

    * JDK: Improve HttpServer Request handling (CVE-2026-21933)

    * JDK: Enhance Certificate Checking (CVE-2026-21945)

    * libpng: LIBPNG buffer overflow (CVE-2025-64720)

    * libpng: LIBPNG heap buffer overflow (CVE-2025-65018)

    Bug Fix(es):

    * When using a P11SecretKey for both signing and encryption in FIPS mode, the FIPS PKCS11 provider would     fail with a CKR_ATTRIBUTE_VALUE_INVALID error. This was due to the default configuration not applying the     CKA_ENCRYPT=true attribute to the key.  The configuration in this release is updated to include this     attribute. (Rocky Linux-142860, Rocky Linux-142876, Rocky Linux-142877, Rocky Linux-142878, Rocky     Linux-142879, Rocky Linux-142880)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the libpng package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable     Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, there is a heap buffer overflow     vulnerability in the libpng simplified API function png_image_finish_read when processing 16-bit     interlaced PNGs with 8-bit output format. Attacker-crafted interlaced PNG files cause heap writes beyond     allocated buffer bounds. This issue has been patched in version 1.6.51.(CVE-2025-65018)

    LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable     Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, a heap buffer over-read     vulnerability exists in libpng's png_write_image_8bit function when processing 8-bit images through the     simplified write API with convert_to_8bit enabled. The vulnerability affects 8-bit grayscale+alpha,     RGB/RGBA, and images with incomplete row data. A conditional guard incorrectly allows 8-bit input to enter     code expecting 16-bit input, causing reads up to 2 bytes beyond allocated buffer boundaries. This issue     has been patched in version 1.6.51.(CVE-2025-64506)

    LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable     Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, an out-of-bounds read     vulnerability exists in png_image_read_composite when processing palette images with     PNG_FLAG_OPTIMIZE_ALPHA enabled. The palette compositing code in png_init_read_transformations incorrectly     applies background compositing during premultiplication, violating the invariant component  alpha     257 required by the simplified PNG API. This issue has been patched in version 1.6.51.(CVE-2025-64720)

    LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable     Network Graphics) raster image files. Prior to version 1.6.51, a heap buffer over-read vulnerability     exists in libpng's png_do_quantize function when processing PNG files with malformed palette indices. The     vulnerability occurs when palette_lookup array bounds are not validated against externally-supplied image     data, allowing an attacker to craft a PNG file with out-of-range palette indices that trigger out-of-     bounds memory access. This issue has been patched in version 1.6.51.(CVE-2025-64505)

Tenable has extracted the preceding description block directly from the EulerOS libpng security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the libpng package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable     Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, a heap buffer over-read     vulnerability exists in libpng's png_write_image_8bit function when processing 8-bit images through the     simplified write API with convert_to_8bit enabled. The vulnerability affects 8-bit grayscale+alpha,     RGB/RGBA, and images with incomplete row data. A conditional guard incorrectly allows 8-bit input to enter     code expecting 16-bit input, causing reads up to 2 bytes beyond allocated buffer boundaries. This issue     has been patched in version 1.6.51.(CVE-2025-64506)

    LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable     Network Graphics) raster image files. Prior to version 1.6.51, a heap buffer over-read vulnerability     exists in libpng's png_do_quantize function when processing PNG files with malformed palette indices. The     vulnerability occurs when palette_lookup array bounds are not validated against externally-supplied image     data, allowing an attacker to craft a PNG file with out-of-range palette indices that trigger out-of-     bounds memory access. This issue has been patched in version 1.6.51.(CVE-2025-64505)

    LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable     Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, there is a heap buffer overflow     vulnerability in the libpng simplified API function png_image_finish_read when processing 16-bit     interlaced PNGs with 8-bit output format. Attacker-crafted interlaced PNG files cause heap writes beyond     allocated buffer bounds. This issue has been patched in version 1.6.51.(CVE-2025-65018)

    LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable     Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, an out-of-bounds read     vulnerability exists in png_image_read_composite when processing palette images with     PNG_FLAG_OPTIMIZE_ALPHA enabled. The palette compositing code in png_init_read_transformations incorrectly     applies background compositing during premultiplication, violating the invariant component  alpha     257 required by the simplified PNG API. This issue has been patched in version 1.6.51.(CVE-2025-64720)

    LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable     Network Graphics) raster image files. Prior to 1.6.52, an out-of-bounds read vulnerability in libpng's     simplified API allows reading up to 1012 bytes beyond the png_sRGB_base[512] array when processing valid     palette PNG images with partial transparency and gamma correction. The PNG files that trigger this     vulnerability are valid per the PNG specification; the bug is in libpng's internal state management.
    Upgrade to libpng 1.6.52 or later.(CVE-2025-66293)

Tenable has extracted the preceding description block directly from the EulerOS libpng security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1305 advisory.

    A heap buffer over-read vulnerability exists in libpng's png_do_quantize function when processing PNG     files with malformed palette indices. The vulnerability occurs when palette_lookup array bounds are not     validated against externally-supplied image data, allowing an attacker to craft a PNG file with out-of-     range palette indices that trigger out-of-bounds memory access. (CVE-2025-64505)

    LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable     Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, a heap buffer over-read     vulnerability exists in libpng's png_write_image_8bit function when processing 8-bit images through the     simplified write API with convert_to_8bit enabled. The vulnerability affects 8-bit grayscale+alpha,     RGB/RGBA, and images with incomplete row data. A conditional guard incorrectly allows 8-bit input to enter     code expecting 16-bit input, causing reads up to 2 bytes beyond allocated buffer boundaries. This issue     has been patched in version 1.6.51. (CVE-2025-64506)

    LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable     Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, an out-of-bounds read     vulnerability exists in png_image_read_composite when processing palette images with     PNG_FLAG_OPTIMIZE_ALPHA enabled. The palette compositing code in png_init_read_transformations incorrectly     applies background compositing during premultiplication, violating the invariant component <= alpha x 257     required by the simplified PNG API. This issue has been patched in version 1.6.51. (CVE-2025-64720)

    Heap buffer overflow in the libpng simplified API function png_image_finish_read when processing 16-bit     interlaced PNGs with 8-bit output format. Attacker-crafted interlaced PNG files cause heap writes beyond     allocated buffer bounds. (CVE-2025-65018)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the libpng package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable     Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, a heap buffer over-read     vulnerability exists in libpng's png_write_image_8bit function when processing 8-bit images through the     simplified write API with convert_to_8bit enabled. The vulnerability affects 8-bit grayscale+alpha,     RGB/RGBA, and images with incomplete row data. A conditional guard incorrectly allows 8-bit input to enter     code expecting 16-bit input, causing reads up to 2 bytes beyond allocated buffer boundaries. This issue     has been patched in version 1.6.51.(CVE-2025-64506)

    LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable     Network Graphics) raster image files. Prior to version 1.6.51, a heap buffer over-read vulnerability     exists in libpng's png_do_quantize function when processing PNG files with malformed palette indices. The     vulnerability occurs when palette_lookup array bounds are not validated against externally-supplied image     data, allowing an attacker to craft a PNG file with out-of-range palette indices that trigger out-of-     bounds memory access. This issue has been patched in version 1.6.51.(CVE-2025-64505)

    LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable     Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, there is a heap buffer overflow     vulnerability in the libpng simplified API function png_image_finish_read when processing 16-bit     interlaced PNGs with 8-bit output format. Attacker-crafted interlaced PNG files cause heap writes beyond     allocated buffer bounds. This issue has been patched in version 1.6.51.(CVE-2025-65018)

    LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable     Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, an out-of-bounds read     vulnerability exists in png_image_read_composite when processing palette images with     PNG_FLAG_OPTIMIZE_ALPHA enabled. The palette compositing code in png_init_read_transformations incorrectly     applies background compositing during premultiplication, violating the invariant component  alpha     257 required by the simplified PNG API. This issue has been patched in version 1.6.51.(CVE-2025-64720)

    LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable     Network Graphics) raster image files. Prior to 1.6.52, an out-of-bounds read vulnerability in libpng's     simplified API allows reading up to 1012 bytes beyond the png_sRGB_base[512] array when processing valid     palette PNG images with partial transparency and gamma correction. The PNG files that trigger this     vulnerability are valid per the PNG specification; the bug is in libpng's internal state management.
    Upgrade to libpng 1.6.52 or later.(CVE-2025-66293)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization libpng security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 / 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6076 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6076-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     December 10, 2025                     https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : libpng1.6     CVE ID         : CVE-2025-64505 CVE-2025-64506 CVE-2025-64720 CVE-2025-65018                      CVE-2025-66293     Debian Bug     : 1121216 1121217 1121218 1121219 1121877

    Several vulnerabilities were reported in the libpng PNG library, which     could lead to information leaks, denial of service or potentially the     execution of arbitrary code if a specially crafted image is processed.

    For the oldstable distribution (bookworm), these problems have been fixed     in version 1.6.39-2+deb12u1.

    For the stable distribution (trixie), these problems have been fixed in     version 1.6.48-1+deb13u1.

    We recommend that you upgrade your libpng1.6 packages.

    For the detailed security status of libpng1.6 please refer to its     security tracker page at:
    https://security-tracker.debian.org/tracker/libpng1.6

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 4b297f5a-cbad-11f0-ac9f-b42e991fc52e advisory.

    https://github.com/pnggroup/libpng/security/advisories/GHSA-7wv6-48j4-hj3g reports:
    LIBPNG is a reference library for use in applications             that read, create, and manipulate PNG (Portable Network             Graphics) raster image files.


Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-9d0f04f316 advisory.

    Update to libpng-1.6.51.



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-13b23a6952 advisory.

    Update to 2.1.0. Update bundled libpng, libtiff, to latest versions. Built against TCL/TK 9. Fix FTBFS.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
294991	Oracle Linux 8 / 9 : java-17-openjdk (ELSA-2026-0927)	Nessus	Oracle Linux Local Security Checks	1/22/2026	1/22/2026	high
297553	MiracleLinux 9 : java-17-openjdk-17.0.18.0.8-1.el9.ML.1 (AXSA:2026-123:03)	Nessus	Miracle Linux Local Security Checks	2/2/2026	2/4/2026	high
303851	Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-11.0.1)	Nessus	Misc.	3/26/2026	3/27/2026	medium
300398	Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-10.3.1.4)	Nessus	Misc.	3/3/2026	3/3/2026	high
296252	RockyLinux 8 : java-21-openjdk (RLSA-2026:0928)	Nessus	Rocky Linux Local Security Checks	1/23/2026	1/23/2026	high
297587	EulerOS 2.0 SP13 : libpng (EulerOS-SA-2026-1225)	Nessus	Huawei Local Security Checks	2/2/2026	2/2/2026	high
302437	EulerOS 2.0 SP10 : libpng (EulerOS-SA-2026-1315)	Nessus	Huawei Local Security Checks	3/16/2026	3/16/2026	high
277818	Amazon Linux 2023 : firefox (ALAS2023-2025-1305)	Nessus	Amazon Linux Local Security Checks	12/9/2025	12/9/2025	high
302441	EulerOS 2.0 SP10 : libpng (EulerOS-SA-2026-1341)	Nessus	Huawei Local Security Checks	3/16/2026	3/16/2026	high
302671	EulerOS Virtualization 2.10.0 : libpng (EulerOS-SA-2026-1559)	Nessus	Huawei Local Security Checks	3/17/2026	3/17/2026	high
278084	Debian dsa-6076 : libpng-dev - security update	Nessus	Debian Local Security Checks	12/10/2025	1/21/2026	high
277324	FreeBSD : png -- Multiple vulnerabilities (4b297f5a-cbad-11f0-ac9f-b42e991fc52e)	Nessus	FreeBSD Local Security Checks	12/3/2025	12/3/2025	high
277856	Fedora 42 : mingw-libpng (2025-9d0f04f316)	Nessus	Fedora Local Security Checks	12/9/2025	12/9/2025	high
280109	Fedora 43 : tkimg (2025-13b23a6952)	Nessus	Fedora Local Security Checks	12/28/2025	2/19/2026	critical

Detections

Analytics

Plugins Search

high

high

medium

high

high

high

high

high

high

high

high

high

high

critical