The 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 26.0.2 and 27 releases of Oracle Java SE installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2026 CPU advisory.

  - Vulnerability in the Oracle Java SE, Oracle JavaFX product of Oracle Java SE (component: JavaFX     (WebKitGTK)). Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4     and 27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Oracle Java SE, Oracle JavaFX. Successful attacks require human interaction from a     person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle     Java SE, Oracle JavaFX. (CVE-2026-43660)

  - Vulnerability in Oracle Java SE (component: Java plugin). Supported versions that are affected are Oracle     Java SE: 8u503 and 8u503-perf. Difficult to exploit vulnerability allows low privileged attacker with logon     to the infrastructure where Oracle Java SE executes to compromise Oracle Java SE. While the vulnerability is     in Oracle Java SE, attacks may significantly impact additional products (scope change). (CVE-2026-91484)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf,     11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle     GraalVM Enterprise Edition: 21.3.19.1.1. Successful attacks of this vulnerability can result in unauthorized     ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM for     JDK, Oracle GraalVM Enterprise Edition as well as unauthorized update, insert or delete access to some of     Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data and unauthorized     read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition     accessible data. (CVE-2026-91415)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3555-1 advisory.

    This update for webkit2gtk3 fixes the following issue:

    Security fixes:

    - CVE-2024-4367,CVE-2026-39872,CVE-2026-43663,CVE-2026-43676,CVE-2026-43699,CVE-2026-43701,       CVE-2026-43705,CVE-2026-43707,CVE-2026-43712,CVE-2026-43713,CVE-2026-43715,CVE-2026-43716,       CVE-2026-43720,CVE-2026-43721,CVE-2026-43725,CVE-2026-43726,CVE-2026-43727,CVE-2026-43731,       CVE-2026-43732,CVE-2026-43734,CVE-2026-43740,CVE-2026-43742,CVE-2026-43745:
      WebKitGTK and WPE WebKit Security Advisory WSA-2026-0004 (bsc#1271638).

    Other fixes:

    - Update to version 2.52.5 (bsc#1271638):
     + Fire scrollend event for instant programmatic scrolls.
     + Increase network idle connection timeout to 115 seconds.
     + Add User-Agent quirk for HBO Max.
     + Fix the build with system malloc.
     + Fix several crashes and rendering issues.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:54634 advisory.

    WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

    Security Fix(es):

    * Mozilla: Arbitrary JavaScript execution in PDF.js (CVE-2024-4367)

    * webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash     (CVE-2026-39872)

    * webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash     (CVE-2026-43663)

    * webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash     (CVE-2026-43676)

    * webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash     (CVE-2026-43699)

    * webkitgtk: webkitgtk: A malicious website may process restricted web content outside the sandbox     (CVE-2026-43701)

    * webkitgtk: webkitgtk: Maliciously crafted web content may lead to memory corruption (CVE-2026-43705)

    * webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash     (CVE-2026-43707)

    * webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash     (CVE-2026-43712)

    * webkitgtk: webkitgtk: Visiting a website may leak sensitive data (CVE-2026-43713)

    * webkitgtk: webkitgtk: Maliciously crafted web content may lead to memory corruption (CVE-2026-43715)

    * webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash     (CVE-2026-43716)

    * webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash     (CVE-2026-43720)

    * webkitgtk: webkitgtk: A malicious website may silently hijack clipboard data (CVE-2026-43721)

    * webkitgtk: webkitgtk: A malicious website may process restricted web content outside the sandbox     (CVE-2026-43725)

    * webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash     (CVE-2026-43726)

    * webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash     (CVE-2026-43727)

    * webkitgtk: webkitgtk: Maliciously crafted web content may lead to memory corruption (CVE-2026-43731)

    * webkitgtk: webkitgtk: Maliciously crafted web content may disclose sensitive user information     (CVE-2026-43732)

    * webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash     (CVE-2026-43734)

    * webkitgtk: webkitgtk: Maliciously crafted web content may disclose process memory (CVE-2026-43740)

    * webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash     (CVE-2026-43742)

    * webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash     (CVE-2026-43745)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1784988522 advisory.

  - A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution     in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird <     115.11. (CVE-2024-4367)

  - The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 18.7.10     and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS     26.6. Processing maliciously crafted web content may lead to an unexpected process crash. (CVE-2026-39872,     CVE-2026-43663)

  - An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in Safari     26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, visionOS 26.6,     watchOS 26.6. Processing maliciously crafted web content may lead to an unexpected Safari crash.
    (CVE-2026-43676)

  - A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari     26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6,     visionOS 26.6, watchOS 26.6. Processing maliciously crafted web content may lead to an unexpected process     crash. (CVE-2026-43699, CVE-2026-43726, CVE-2026-43734, CVE-2026-43742)

  - The issue was addressed with improved checks. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS     18.7.10, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. A     malicious website may be able to process restricted web content outside the sandbox. (CVE-2026-43701)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1340:06 advisory.

    * Mozilla: Arbitrary JavaScript execution in PDF.js (CVE-2024-4367)
      * webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash     (CVE-2026-39872)
      * webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash     (CVE-2026-43663)
      * webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash     (CVE-2026-43676)
      * webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash     (CVE-2026-43699)
      * webkitgtk: webkitgtk: A malicious website may process restricted web content outside the sandbox     (CVE-2026-43701)
      * webkitgtk: webkitgtk: Maliciously crafted web content may lead to memory corruption (CVE-2026-43705)
      * webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash     (CVE-2026-43707)
      * webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash     (CVE-2026-43712)
      * webkitgtk: webkitgtk: Visiting a website may leak sensitive data (CVE-2026-43713)
      * webkitgtk: webkitgtk: Maliciously crafted web content may lead to memory corruption (CVE-2026-43715)
      * webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash     (CVE-2026-43716)
      * webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash     (CVE-2026-43720)
      * webkitgtk: webkitgtk: A malicious website may silently hijack clipboard data (CVE-2026-43721)
      * webkitgtk: webkitgtk: A malicious website may process restricted web content outside the sandbox     (CVE-2026-43725)
      * webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash     (CVE-2026-43726)
      * webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash     (CVE-2026-43727)
      * webkitgtk: webkitgtk: Maliciously crafted web content may lead to memory corruption (CVE-2026-43731)
      * webkitgtk: webkitgtk: Maliciously crafted web content may disclose sensitive user information     (CVE-2026-43732)
      * webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash     (CVE-2026-43734)
      * webkitgtk: webkitgtk: Maliciously crafted web content may disclose process memory (CVE-2026-43740)
      * webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash     (CVE-2026-43742)
      * webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash     (CVE-2026-43745)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Apple iOS running on the mobile device is prior to 26.5.2. It is, therefore, affected by multiple vulnerabilities.

ID	Name	Product	Family	Published	Updated	Severity
372932	Oracle Java SE Multiple Vulnerabilities (October 2026 CPU)	Nessus	Misc.	10/28/2026	10/29/2026	medium
358443	RockyLinux 8 : webkit2gtk3 (RLSA-2026:74084)	Nessus	Rocky Linux Local Security Checks	10/1/2026	10/2/2026	critical
362401	AlmaLinux 8 : webkit2gtk3 (ALSA-2026:74084)	Nessus	Alma Linux Local Security Checks	10/1/2026	11/6/2026	critical
363124	MiracleLinux 8 : webkit2gtk3-2.54.0-1.el8_10.ML.1 (AXSA:2026-1970:09)	Nessus	Miracle Linux Local Security Checks	10/6/2026	10/9/2026	critical
353421	RHEL 8 : webkit2gtk3 (RHSA-2026:74084)	Nessus	Red Hat Local Security Checks	9/30/2026	10/2/2026	critical
334703	SUSE SLES12: libjavascriptcoregtk-4_0-18 / libwebkit2gtk-4_0-37 / etc (SUSE-SU-2026:3555-1)	Nessus	SuSE Local Security Checks	8/12/2026	8/17/2026	high
335246	RHEL 9 : webkit2gtk3 (RHSA-2026:54634)	Nessus	Red Hat Local Security Checks	8/13/2026	8/14/2026	high
351934	AlmaLinux 9.2 [TuxCare] Security Update: webkit2gtk3 / webkit2gtk3-devel / webkit2gtk3-jsc / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1784988522)	Nessus	Alma Linux Local Security Checks	9/30/2026	10/1/2026	high
329279	MiracleLinux 8 : webkit2gtk3-2.52.5-1.el8_10.ML.1 (AXSA:2026-1340:06)	Nessus	Miracle Linux Local Security Checks	7/24/2026	7/27/2026	high
323674	Apple iOS < 26.5.2 Multiple Vulnerabilities (127594)	Nessus	Mobile Devices	6/29/2026	11/9/2026	critical

Detections

Analytics

Plugins Search

medium

critical

critical

critical

critical

high

high

high

high

critical