The version of AOS installed on the remote host is prior to 7.1.1. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-7.1.1 advisory.

  - inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging     improper pointer arithmetic. (CVE-2016-9840)

  - Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information     disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache     Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34,     from 9.0.0.M1 through 9.0.98. The following versions were EOL at the time the CVE was created but are     known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. If all of the     following were true, a malicious user was able to view security sensitive files and/or inject content into     those files: - writes enabled for the default servlet (disabled by default) - support for partial PUT     (enabled by default) - a target URL for security sensitive uploads that was a sub-directory of a target     URL for public uploads - attacker knowledge of the names of security sensitive files being uploaded - the     security sensitive files also being uploaded via partial PUT If all of the following were true, a     malicious user was able to perform remote code execution: - writes enabled for the default servlet     (disabled by default) - support for partial PUT (enabled by default) - application was using Tomcat's file     based session persistence with the default storage location - application included a library that may be     leveraged in a deserialization attack Users are recommended to upgrade to version 11.0.3, 10.1.35 or     9.0.99, which fixes the issue. (CVE-2025-24813)

  - A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under     certain circumstances when the XML schematron has the <sch:name path=.../> schema elements. This flaw     allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the     program's crash using libxml or other possible undefined behaviors. (CVE-2025-49794)

  - A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can     trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that     can lead libxml to crash, resulting in a denial of service or other possible undefined behavior due to     sensitive data being corrupted in memory. (CVE-2025-49796)

  - A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations     can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of     service when processing crafted input. (CVE-2025-6021)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 7.3.1. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-7.3.1 advisory.

  - LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize),     affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data     corruption.) NOTE: the vendor states only a few specific / uncommon usages of the API are at risk.
    (CVE-2019-17543)

  - Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset     of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some     rewrite rules. If those rewrite rules effectively enforced security constraints, those constraints could     be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through     10.1.39, from 9.0.0.M1 through 9.0.102. The following versions were EOL at the time the CVE was created     but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users     are recommended to upgrade to version [FIXED_VERSION], which fixes the issue. (CVE-2025-31651)

  - Allows modifying some file metadata (e.g. last modified) with filter=data or file permissions (chmod)     with filter=tar of files outside the extraction directory. You are affected by this vulnerability if     using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract()     using the filter= parameter with a value of data or tar. See the tarfile extraction filters     documentation https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter for more     information. Only Python versions 3.12 or later are affected by these vulnerabilities, earlier versions     don't include the extraction filter feature. Note that for Python 3.14 or later the default value of     filter= changed from no filtering to `data, so if you are relying on this new default behavior then     your usage is also affected. Note that none of these vulnerabilities significantly affect the installation     of source distributions which are tar archives as source distributions already allow arbitrary code     execution during the build process. However when evaluating source distributions it's important to avoid     installing source distributions with suspicious links. (CVE-2024-12718)

  - Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination     directory, and the modification of some file metadata. You are affected by this vulnerability if using the     tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() using the     filter= parameter with a value of data or tar. See the tarfile extraction filters documentation     https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter for more information. Note that     for Python 3.14 or later the default value of filter= changed from no filtering to `data, so if you     are relying on this new default behavior then your usage is also affected. Note that none of these     vulnerabilities significantly affect the installation of source distributions which are tar archives as     source distributions already allow arbitrary code execution during the build process. However when     evaluating source distributions it's important to avoid installing source distributions with suspicious     links. (CVE-2025-4138, CVE-2025-4330)

  - When using a TarFile.errorlevel = 0 and extracting with a filter the documented behavior is that any     filtered members would be skipped and not extracted. However the actual behavior of TarFile.errorlevel = 0     in affected versions is that the member would still be extracted and not skipped. (CVE-2025-4435)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AHV installed on the remote host is prior to 10.3.1. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-10.3.1 advisory.

  - LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize),     affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data     corruption.) NOTE: the vendor states only a few specific / uncommon usages of the API are at risk.
    (CVE-2019-17543)

  - setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python     packages. A path traversal vulnerability in `PackageIndex` is present in setuptools prior to version     78.1.1. An attacker would be allowed to write files to arbitrary locations on the filesystem with the     permissions of the process running the Python code, which could escalate to remote code execution     depending on the context. Version 78.1.1 fixes the issue. (CVE-2025-47273)

  - A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under     certain circumstances when the XML schematron has the <sch:name path=.../> schema elements. This flaw     allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the     program's crash using libxml or other possible undefined behaviors. (CVE-2025-49794)

  - A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can     trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that     can lead libxml to crash, resulting in a denial of service or other possible undefined behavior due to     sensitive data being corrupted in memory. (CVE-2025-49796)

  - A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations     can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of     service when processing crafted input. (CVE-2025-6021)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0100 advisory.

    This advisory aggregates security fixes for the libxml2 SRPM in CIQ LTS 8.6. It addresses 30 CVEs:
    CVE-2015-7499, CVE-2015-7942, CVE-2018-14404, CVE-2008-4225, CVE-2015-7497, and 25 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 7.02, has libxml2 packages installed that are affected by multiple vulnerabilities:

  - A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can     trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that     can lead libxml to crash, resulting in a denial of service or other possible undefined behavior due to     sensitive data being corrupted in memory. (CVE-2025-49796)

  - A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under     certain circumstances when the XML schematron has the <sch:name path=.../> schema elements. This flaw     allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the     program's crash using libxml or other possible undefined behaviors. (CVE-2025-49794)

  - A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations     can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of     service when processing crafted input. (CVE-2025-6021)

  - A flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts     internal memory management. When XSLT functions, such as the key() process, result in tree fragments, this     corruption prevents the proper cleanup of ID attributes. As a result, the system may access freed memory,     causing crashes or enabling attackers to trigger heap corruption. (CVE-2025-7425)

  - A flaw was found in libxml2, an XML parsing library. This uncontrolled recursion vulnerability occurs in     the xmlCatalogXMLResolveURI function when an XML catalog contains a delegate URI entry that references     itself. A remote attacker could exploit this configuration-dependent issue by providing a specially     crafted XML catalog, leading to infinite recursion and call stack exhaustion. This ultimately results in a     segmentation fault, causing a Denial of Service (DoS) by crashing affected applications. (CVE-2026-0990)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02260-1 advisory.

    - CVE-2025-49794: Fixed a heap use after free which could lead to denial of service. (bsc#1244554)
    - CVE-2025-49796: Fixed type confusion which could lead to denial of service. (bsc#1244557)
    - CVE-2025-49795: Fixed a null pointer dereference which could lead to denial of service. (bsc#1244555)
    - CVE-2025-6170: Fixed a stack buffer overflow which could lead to a crash. (bsc#1244700)
    - CVE-2025-6021: Fixed an integer overflow in xmlBuildQName() which could lead to stack buffer overflow.
    (bsc#1244590)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
255240	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-7.1.1)	Nessus	Misc.	8/26/2025	4/19/2026	high
269907	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-7.3.1)	Nessus	Misc.	10/9/2025	9/11/2026	high
269975	Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-10.3.1)	Nessus	Misc.	10/10/2025	8/13/2026	high
358180	Rocky Linux 8.6 [CIQ] Security Update: libxml2 / libxml2-debuginfo / libxml2-debugsource / libxml2-devel / etc Multiple Vulnerabilities (ciqsa-2026_0100)	Nessus	Rocky Linux Local Security Checks	10/1/2026	10/11/2026	high
343576	NewStart CGSL MAIN 7.02 : libxml2 Multiple Vulnerabilities (NS-SA-2026-0087)	Nessus	NewStart CGSL Local Security Checks	9/8/2026	9/8/2026	critical
241674	SUSE SLED15: libxml2-2 / libxml2-2-32bit / libxml2-devel / libxml2-tools / etc (SUSE-SU-2025:02260-1)	Nessus	SuSE Local Security Checks	7/10/2025	6/25/2026	low

Detections

Analytics

Plugins Search

high

high

high

high

critical

low