The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-523:13 advisory.

    * expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small     document that is submitted for parsing (CVE-2025-59375)
      * python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075)
      * cpython: Out-of-memory when loading Plist (CVE-2025-13837)
      * cpython: Header injection via newlines in data URL mediatype in Python (CVE-2025-15282)
      * cpython: Header injection in http.cookies.Morsel in Python (CVE-2026-0672)
      * cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297)
      * cpython: Incomplete control character validation in http.cookies (CVE-2026-3644)
      * cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224)
      * python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502)
      * python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression     modules (CVE-2026-6100)
      * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API     (CVE-2026-4786)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-97a8eb204a advisory.

    Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-5713, CVE-2026-6100


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:13692 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression     modules (CVE-2026-6100)

    * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API     (CVE-2026-4786)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:19177 advisory.

    * expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small     document that is submitted for parsing (CVE-2025-59375)

    * python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075)

    * cpython: Out-of-memory when loading Plist (CVE-2025-13837)

    * cpython: Header injection via newlines in data URL mediatype in Python (CVE-2025-15282)

    * cpython: Header injection in http.cookies.Morsel in Python (CVE-2026-0672)

    * cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297)

    * cpython: Incomplete control character validation in http.cookies (CVE-2026-3644)

    * cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224)

    * python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519)

    * python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502)

    * python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression     modules (CVE-2026-6100)

    * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API     (CVE-2026-4786)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:19019 advisory.

    * cpython: wsgiref.headers.Headers allows header newline injection in Python (CVE-2026-0865)

    * cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297)

    * cpython: Incomplete control character validation in http.cookies (CVE-2026-3644)

    * cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224)

    * python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519)

    * python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502)

    * python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression     modules (CVE-2026-6100)

    * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API     (CVE-2026-4786)

    * python: Python: Information disclosure and arbitrary code execution via remote debugging with a     malicious process. (CVE-2026-5713)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
311812	MiracleLinux 8 : python3.12-3.12.13-2.el8_10 (AXSA:2026-523:13)	Nessus	Miracle Linux Local Security Checks	5/3/2026	5/3/2026	critical
311818	Fedora 43 : python3.14 (2026-97a8eb204a)	Nessus	Fedora Local Security Checks	5/3/2026	5/3/2026	critical
312253	RHEL 9 : python3.11 (RHSA-2026:13692)	Nessus	Red Hat Local Security Checks	5/5/2026	5/5/2026	critical
317440	RockyLinux 9 : python3.12 (RLSA-2026:19177)	Nessus	Rocky Linux Local Security Checks	5/28/2026	5/28/2026	critical
317973	RockyLinux 10 : python3.14 (RLSA-2026:19019)	Nessus	Rocky Linux Local Security Checks	5/29/2026	5/29/2026	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical