The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-ce70c33170 advisory.

    Update to 1.9.4

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-09a9388be9 advisory.

    Update to 19be9d8

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-cdaa0a840e advisory.

    Update to 19be9d8

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_39573 advisory.

    * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)

    * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label     processing (CVE-2026-39821)

    * crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries     (CVE-2026-27145)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1885 advisory.

    Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.
    (CVE-2026-25680)

    Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can     be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
    (CVE-2026-25681)

    Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can     be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
    (CVE-2026-27136)

    (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject     Alternative Name (SAN) entries. This caused strings.Split(host, .) to execute repeatedly on the same     input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of     SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before     building the certificate chain, this overhead occurred even for untrusted certificates. (CVE-2026-27145)

    The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-     only label. For example, ToUnicode(xn--example-.com) incorrectly returns the name example.com rather     than an error. This behavior can lead to privilege escalation in programs using the idna package. For     example, a program which performs privilege checks on the ASCII hostname may reject example.com but     permit xn--example-.com. If that program subsequently converts the ASCII hostname to Unicode, it will     inadvertently permits access to the Unicode name example.com. (CVE-2026-39821)

    Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can     be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
    (CVE-2026-42502)

    Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive     CPU. (CVE-2026-42504)

    Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can     be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
    (CVE-2026-42506)

    When returning errors, functions in the net/textproto package would include its input as part of the     error. This might allow an attacker to inject misleading content to errors that are printed or logged.
    (CVE-2026-42507)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-f33ade2ba6 advisory.

    This update aligns the package to the latest Upstream release, which is also the first stable version of     complyctl.

    It introduced the core redesign from OSCAL to Gemara. The project has gone through three pre-release     milestones (alpha, beta, RC) with contributions from 11 people across 200+ commits. This release marks the     point where the CLI surface, configuration format, provider gRPC API, and output formats are considered     stable under semantic versioning.
    More information in https://github.com/complytime/complyctl/releases/tag/v1.0.0

    The providers, formerly plugins, were also moved to their own repository and are no longer delivered in     the same package of complyctl. A new package called complytime-providers is being introduced to Fedora     repositories via https://bugzilla.redhat.com/show_bug.cgi?id=2526823



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
344882	Fedora 45 : grpcurl (2026-ce70c33170)	Nessus	Fedora Local Security Checks	9/11/2026	9/11/2026	high
345456	Fedora 45 : golang-x-perf (2026-09a9388be9)	Nessus	Fedora Local Security Checks	9/12/2026	9/12/2026	high
345468	Fedora 44 : golang-x-perf (2026-cdaa0a840e)	Nessus	Fedora Local Security Checks	9/13/2026	9/13/2026	high
358306	Rocky Linux 10.2 [CIQ] Security Update: yggdrasil / yggdrasil-debuginfo / yggdrasil-debugsource / etc Multiple Vulnerabilities (crlsa-2026_39573)	Nessus	Rocky Linux Local Security Checks	10/1/2026	10/1/2026	high
322109	Amazon Linux 2023 : credentials-fetcher (ALAS2023-2026-1885)	Nessus	Amazon Linux Local Security Checks	6/22/2026	7/2/2026	high
343965	Fedora 44 : complyctl (2026-f33ade2ba6)	Nessus	Fedora Local Security Checks	9/9/2026	9/9/2026	critical

Detections

Analytics

Plugins Search

high

high

high

high

high

critical