The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:20464-1 advisory.

    This update for cockpit-repos fixes the following issue:

    - CVE-2026-26996: minimatch: ReDoS when glob pattern contains many consecutive wildcards followed by a     literal character       that doesn't appear in the test string (bsc#1258637).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.
    Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob     pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the     test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine     backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number     of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively     forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is     vulnerable to DoS. This issue has been fixed in version 10.2.1. (CVE-2026-26996)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21399-1 advisory.

    Security issues fixed:

    - CVE-2025-13465: lodash: prototype pollution in the _.unset and _.omit functions can lead to deletion of     methods from       global prototypes (bsc#1257325).
    - CVE-2026-4631: SSH command-line argument injection can lead to unauthenticated remote code execution     (bsc#1261829).
    - CVE-2026-25547: brace-expansion: unbounded brace range expansion can lead to excessive CPU and memory     consumption and       may crash a Node.js process (bsc#1257836 bsc#1257838 bsc#1257840).
    - CVE-2026-26996: minimatch: ReDoS when glob pattern contains many consecutive wildcards followed by a     literal character       that doesn't appear in the test string (bsc#1258637 bsc#1258640 bsc#1258641).
    - CVE-2026-27904: minimatch: nested *() extglobs can lead to regular expressions with exponential     backtracking       complexity and a ReDoS (bsc#1259010 bsc#1259013 bsc#1259015).

    Non security issues fixed:

    - cockpit webUI - 'Software updates - install all updates' got an unexpected internal error (bsc#1259210).
    - cockpit-machines does not work out of the box, missing libvirt daemon (bsc#1236149).

    Changes for cockpit:

    - Update to 364.

    - Update to 361 (jsc#PED-15706/jsc#CPT-183):

     * Remove all Mount actions in Anaconda mode
     * Dependency updates

    - Update to 360:
     * ws: be more explicit when handling hostnames on cli bsc#1261829/CVE-2026-4631
     * ws: support loading a custom login page

    - Update to 358:

     * Networking: Add Wi-Fi support
     * Cockpit Client updated to GTK 4
     * Bugfixes and translation updates

    - Update to 357:

     * lib: Use browser context menu on shift
     * bridge: support Python 3.14 on old kernels (RHEL 8)

    - Update to 356:

     * systemd: Allow editing timers created by Cockpit
     * Convert license headers to SPDX format

    - Update to 355:

     * ws: Remove obsolete pam_cockpit_cert module
     * shell: add StartTransientUnit as a sudo alternative

    Changes for cockpit-machines:

    - Update to 354.

    - Update to 352:

     - Improvements to the Add disk and Create Volume dialogs.

    - Update suse_version requirement to function with the planned bump (jsc#PED-15820).
    - Drop explict dependency on libvirt (bsc#1258040, bsc#1236149).

    - Update to 348:

     * Translation updates
     * Convert license headers to SPDX format
     * Now requires cockpit-devel 356 due to the replacement of xterm/addon-canvas with xterm/addon-webgl

    - Update to 347:
     * Bug fixes and translation updates

    - Fix esbuild for ppc64le (bsc#1257698).

    Changes for cockpit-packages:

    - Update to version 5:

     * Support transactional systems
     * Improve error/success messages
     * Translation updates

    - Patch esbuild to use native runtime on ppc64 (bsc#1257698).

    Changes for cockpit-podman:

    - Update to 128.
    - Fix esbuild for ppc64le (bsc#1257698).

    Changes for cockpit-repos:

    - Update to 4.8.
    - Patch esbuild to use native runtime on ppc64 (bsc#1257698).

    Changes for cockpit-subscriptions:

    - Update to version 16.2 (bsc#1257033).
    - Patch esbuild to use native runtime on ppc64 (bsc#1257698).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:7080 advisory.

    * brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)
      * minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)
      * minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions     (CVE-2026-27904)
      * undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate     decompression (CVE-2026-1526)
      * undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter     (CVE-2026-2229)
      * undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers     (CVE-2026-1525)
      * undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)
      * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination     (CVE-2026-27135)
      * Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:7675 advisory.

    Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network     applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and     efficient, perfect for data-intensive real-time applications that run across distributed devices.

    Security Fix(es):

    * nodejs: Nodejs denial of service (CVE-2026-21637)

    * brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)

    * minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

    * undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)

    * undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)

    * undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate     decompression (CVE-2026-1526)

    * undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter     (CVE-2026-2229)

    * undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers     (CVE-2026-1525)

    * undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)

    * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination     (CVE-2026-27135)

    * Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing     (CVE-2026-21712)

    * Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)

    * Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read     restrictions (CVE-2026-21715)

    * nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership     via incomplete security fix. (CVE-2026-21716)

    * Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission     checks (CVE-2026-21711)

    * Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)

    * Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames     (CVE-2026-21714)

    * nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash     collisions (CVE-2026-21717)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:7675 advisory.

    * nodejs: Nodejs denial of service (CVE-2026-21637)
      * brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion     (CVE-2026-25547)
      * minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)
      * undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)
      * undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)
      * undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate     decompression (CVE-2026-1526)
      * undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter     (CVE-2026-2229)
      * undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers     (CVE-2026-1525)
      * undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)
      * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination     (CVE-2026-27135)
      * Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing     (CVE-2026-21712)
      * Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)
      * Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read     restrictions (CVE-2026-21715)
      * nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership     via incomplete security fix. (CVE-2026-21716)
      * Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket     permission checks (CVE-2026-21711)
      * Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)
      * Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames     (CVE-2026-21714)
      * nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash     collisions (CVE-2026-21717)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-446:01 advisory.

    * brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)
      * minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)
      * minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions     (CVE-2026-27904)
      * undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate     decompression (CVE-2026-1526)
      * undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter     (CVE-2026-2229)
      * undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers     (CVE-2026-1525)
      * undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)
      * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination     (CVE-2026-27135)
      * Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_7896 advisory.

    * minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

    * minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions     (CVE-2026-27904)

    * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination     (CVE-2026-27135)

    * Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
305839	openSUSE 16 Security Update : cockpit-repos (openSUSE-SU-2026:20464-1)	Nessus	SuSE Local Security Checks	4/10/2026	4/10/2026	high
299696	Linux Distros Unpatched Vulnerability : CVE-2026-26996	Nessus	Misc.	2/20/2026	11/5/2026	high
329307	openSUSE 16: cockpit / cockpit-bridge / cockpit-devel / cockpit-firewalld / etc (openSUSE-SU-2026:21399-1)	Nessus	SuSE Local Security Checks	7/24/2026	7/24/2026	critical
305944	AlmaLinux 10 : nodejs22 (ALSA-2026:7080)	Nessus	Alma Linux Local Security Checks	4/10/2026	4/10/2026	critical
306067	RHEL 10 : nodejs24 (RHSA-2026:7675)	Nessus	Red Hat Local Security Checks	4/13/2026	4/13/2026	critical
306516	AlmaLinux 10 : nodejs24 (ALSA-2026:7675)	Nessus	Alma Linux Local Security Checks	4/15/2026	4/21/2026	critical
307261	MiracleLinux 9 : nodejs:22 (AXSA:2026-446:01)	Nessus	Miracle Linux Local Security Checks	4/17/2026	4/22/2026	critical
354920	Rocky Linux 9 [CIQ] Security Update: nodejs / nodejs-debuginfo / nodejs-debugsource / nodejs-devel / etc Multiple Vulnerabilities (crlsa-2026_7896)	Nessus	Rocky Linux Local Security Checks	10/1/2026	10/1/2026	high

Detections

Analytics

Plugins Search

high

high

critical

critical

critical

critical

critical

high