The versions of MySQL Server installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2026 CPU advisory.

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Docker Images (SQLite)). Supported     versions that are affected are 8.4.0-8.4.7. Easily exploitable vulnerability allows unauthenticated attacker with     network access via MySQL Protocol to compromise MySQL Server. Successful attacks of this vulnerability can result in     takeover of MySQL Server. (CVE-2025-6965)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Packaging). Supported versions that are     affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and 9.0.0-9.5.0. Easily exploitable vulnerability allows unauthenticated attacker     with network access via MySQL Protocol to compromise MySQL Server. Successful attacks of this vulnerability can result     in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2025-9230)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are     affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and 9.0.0-9.5.0. Easily exploitable vulnerability allows low privileged attacker     with network access via MySQL Protocol to compromise MySQL Server. Successful attacks of this vulnerability can result     in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2026-21968)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the sqlite package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    In SQLite 3.49.0 before 3.49.1, certain argument values to sqlite3_db_config (in the C-language API) can     cause a denial of service (application crash). An sz*nBig multiplication is not cast to a 64-bit integer,     and consequently some memory allocations may be incorrect.(CVE-2025-29088)

    There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could     exceed the number of columns available. This could lead to a memory corruption issue. We recommend     upgrading to version 3.50.2 or above.(CVE-2025-6965)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization sqlite security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of CBL-Mariner Releases installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-6965 advisory.

  - There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could     exceed the number of columns available. This could lead to a memory corruption issue. We recommend     upgrading to version 3.50.2 or above. (CVE-2025-6965)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AHV installed on the remote host is prior to AHV-10.3.0.2. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-10.3.0.2 advisory.

  - There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could     exceed the number of columns available. This could lead to a memory corruption issue. We recommend     upgrading to version 3.50.2 or above. (CVE-2025-6965)

  - LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize),     affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data     corruption.) NOTE: the vendor states only a few specific / uncommon usages of the API are at risk.
    (CVE-2019-17543)

  - A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under     certain circumstances when the XML schematron has the <sch:name path=.../> schema elements. This flaw     allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the     program's crash using libxml or other possible undefined behaviors. (CVE-2025-49794)

  - A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can     trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that     can lead libxml to crash, resulting in a denial of service or other possible undefined behavior due to     sensitive data being corrupted in memory. (CVE-2025-49796)

  - A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations     can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of     service when processing crafted input. (CVE-2025-6021)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
296583	Oracle MySQL Server 8.4.x < 8.4.8 (January 2026 CPU)	Nessus	Databases	1/26/2026	2/3/2026	high
302546	EulerOS Virtualization 2.12.1 : sqlite (EulerOS-SA-2026-1463)	Nessus	Huawei Local Security Checks	3/16/2026	4/14/2026	high
302632	EulerOS Virtualization 2.12.0 : sqlite (EulerOS-SA-2026-1520)	Nessus	Huawei Local Security Checks	3/16/2026	4/14/2026	high
306405	Azure Linux 3.0 Security Update: CBL-Mariner Releases (CVE-2025-6965)	Nessus	Azure Linux Local Security Checks	4/14/2026	4/14/2026	high
261687	Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-10.3.0.2)	Nessus	Misc.	9/8/2025	4/29/2026	high

Detections

Analytics

Plugins Search

high

high

high

high

high