The remote host is running a version of macOS / Mac OS X that is 26.x prior to 26.4. It is, therefore, affected by multiple vulnerabilities:

  - A logic issue was addressed with improved checks. This issue is fixed in macOS Tahoe 26.4. A user may be     able to elevate privileges. (CVE-2026-20631)

  - When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol     redirect to a second URL that uses an IMAP, LDAP, POP3 or SMTP scheme, curl might wrongly pass on the     bearer token to the new target host. (CVE-2025-14524)

  - An integer overflow in the case of failed ACME certificate renewal leads, after a number of failures (~30     days in default configurations), to the backoff timer becoming 0. Attempts to renew the certificate then     are repeated without delays until it succeeds. This issue affects Apache HTTP Server: from 2.4.30 before     2.4.66. Users are recommended to upgrade to version 2.4.66, which fixes the issue. (CVE-2025-55753)

  - Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not     mod_cgi) passes the shell-escaped query string to #exec cmd=... directives. This issue affects Apache     HTTP Server before 2.4.66. Users are recommended to upgrade to version 2.4.66, which fixes the issue.
    (CVE-2025-58098)

  - Server-Side Request Forgery (SSRF) vulnerability in Apache HTTP Server on Windows with AllowEncodedSlashes     On and MergeSlashes Off allows to potentially leak NTLM hashes to a malicious server via SSRF and     malicious requests or content Users are recommended to upgrade to version 2.4.66, which fixes the issue.
    (CVE-2025-59775)

Note that Nessus has not tested for these issues but has instead relied only on the operating system's self-reported version number.

The version of Apple iOS running on the mobile device is prior to 18.7.7. It is, therefore, affected by multiple vulnerabilities.

The version of Apple iOS running on the mobile device is prior to 26.4. It is, therefore, affected by multiple vulnerabilities.

The remote host is running a version of macOS / Mac OS X that is 14.x prior to 14.8.5. It is, therefore, affected by multiple vulnerabilities:

  - A permissions issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia     15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to modify protected parts of the file     system. (CVE-2026-28892)

  - A privacy issue was addressed with improved handling of user preferences. This issue is fixed in iOS 26.4     and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. Hide IP Address and Block     All Remote Content may not apply to all mail content. (CVE-2026-20692)

  - When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol     redirect to a second URL that uses an IMAP, LDAP, POP3 or SMTP scheme, curl might wrongly pass on the     bearer token to the new target host. (CVE-2025-14524)

  - An integer overflow in the case of failed ACME certificate renewal leads, after a number of failures (~30     days in default configurations), to the backoff timer becoming 0. Attempts to renew the certificate then     are repeated without delays until it succeeds. This issue affects Apache HTTP Server: from 2.4.30 before     2.4.66. Users are recommended to upgrade to version 2.4.66, which fixes the issue. (CVE-2025-55753)

  - Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not     mod_cgi) passes the shell-escaped query string to #exec cmd=... directives. This issue affects Apache     HTTP Server before 2.4.66. Users are recommended to upgrade to version 2.4.66, which fixes the issue.
    (CVE-2025-58098)

Note that Nessus has not tested for these issues but has instead relied only on the operating system's self-reported version number.

The remote host is running a version of macOS / Mac OS X that is 15.x prior to 15.7.7. It is, therefore, affected by multiple vulnerabilities:

  - A privacy issue was addressed by removing sensitive data. This issue is fixed in iOS 18.7.7 and iPadOS     18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sonoma 14.8.5, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, watchOS     26.4. An app may be able to enumerate a user's installed apps. (CVE-2026-28878)

  - An information leakage was addressed with additional validation. (CVE-2025-43524, CVE-2026-28819,     CVE-2026-28840, CVE-2026-28846, CVE-2026-28848, CVE-2026-28897, CVE-2026-28906, CVE-2026-28908,     CVE-2026-28915, CVE-2026-28919, CVE-2026-28920, CVE-2026-28922, CVE-2026-28923, CVE-2026-28924,     CVE-2026-28925, CVE-2026-28929, CVE-2026-28940, CVE-2026-28941, CVE-2026-28943, CVE-2026-28951,     CVE-2026-28952, CVE-2026-28954, CVE-2026-28956, CVE-2026-28959, CVE-2026-28969, CVE-2026-28972,     CVE-2026-28974, CVE-2026-28977, CVE-2026-28978, CVE-2026-28986, CVE-2026-28987, CVE-2026-28990,     CVE-2026-28992, CVE-2026-28993, CVE-2026-28994, CVE-2026-28996, CVE-2026-39869, CVE-2026-39870,     CVE-2026-39871, CVE-2026-43654, CVE-2026-43656, CVE-2026-43659, CVE-2026-43666, CVE-2026-43668)

Note that Nessus has not tested for these issues but has instead relied only on the operating system's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
303481	macOS 26.x < 26.4 Multiple Vulnerabilities (126794)	Nessus	MacOS X Local Security Checks	3/24/2026	5/15/2026	high
303480	Apple iOS < 18.7.7 Multiple Vulnerabilities (126793)	Nessus	Mobile Devices	3/24/2026	5/11/2026	high
303482	Apple iOS < 26.4 Multiple Vulnerabilities (126792)	Nessus	Mobile Devices	3/24/2026	5/15/2026	high
303479	macOS 14.x < 14.8.5 Multiple Vulnerabilities (126796)	Nessus	MacOS X Local Security Checks	3/24/2026	5/11/2026	medium
314174	macOS 15.x < 15.7.7 Multiple Vulnerabilities (127116)	Nessus	MacOS X Local Security Checks	5/11/2026	5/15/2026	high

Detections

Analytics

Plugins Search

high

high

high

medium

high