The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:5099-1 advisory.

    - CVE-2026-42356: deployment of wrong handler allows target of internal redirects from CGI programs to     also be treated       as CGI and executed (bsc#1284043).
    - CVE-2026-42528: memory calculation bug in `mod_dav` allows an attacker with permission to create WebDAV     locks to crash       server child processes (bsc#1284044).
    - CVE-2026-46729: NULL pointer dereference in `mod_heartmonitor` over unicast listener (bsc#1284045).
    - CVE-2026-47360: session cookie passed to a backend server when `SessionCookieRemove` changes across     internal redirects       (bsc#1284046).
    - CVE-2026-48005: missing authentication checks in `mod_auth_digest` allows an unauthenticated remote     client to cause a       DoS via forged `Authorization` headers when Digest authentication is enabled with `AuthDigestNcCheck`     (bsc#1284047).
    - CVE-2026-56153: out-of-bounds write in `mod_charset_lite` (bsc#1284048).
    - CVE-2026-56154: use-after-free in `mod_rewrite` when using lookahead `(%{LA-U:HTTP:...})` (bsc#1284049).
    - CVE-2026-57941: use-after-free in `mod_http2` via shared `session->bbtmp` re-entrancy (bsc#1284050).
    - CVE-2026-58415: internal state files accessible to external parties in `mod_dav_fs` allows a remote     client to read       WebDAV dead properties of resources it cannot author via a GET request for the .DAV state directory     (bsc#1284051).
    - CVE-2026-59797: improper privilege management in `mod_ssl` when using `SSLRequire` and file-related     expressions       (bsc#1284059).
    - CVE-2026-63045: improper validation of FTP PASV reply address in `mod_proxy_ftp` allows an untrusted FTP     server to       cause a proxy to open a data connection to an arbitrary third-party host (bsc#1284060).
    - CVE-2026-63292: stack-based buffer overflow in `mod_vhost_alias` allows a remote client to cause a DoS     or potentially       execute arbitrary code via an HTTP request with a specially crafted `Host` header (bsc#1284061).
    - CVE-2026-63686: NULL pointer dereference in `mod_xml2enc` allows an untrusted backend server to cause a     denial of       service via a crafted proxied response (bsc#1284058).
    - CVE-2026-63718: inconsistent interpretation of HTTP requests in `mod_proxy_uwsgi` allows for response     smuggling via a       crafted uwsgi response with `Transfer-Encoding` (bsc#1284057).
    - CVE-2026-73636: authentication bypass by capture-replay in `mod_auth_digest` allows a MiTM attacker to     replay captured       digest authentication credentials via crafted requests (bsc#1284056).
    - CVE-2026-73637: use-after-free in `mod_auth_digest` allows an unauthenticated remote client to cause     authentication       state corruption via concurrent Digest authentication requests (bsc#1284055).
    - CVE-2026-79768: path equivalence issue in the `mod_userdir` module when configured with absolute non-     wildcard       `UserDir` directive (bsc#1284054).
    - CVE-2026-93546: integer overflow in `mod_dav_fs` allows an authenticated WebDAV client with write access     to crash       worker processes and persistently corrupt a directory's property database (bsc#1284053).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6569 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6569-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     October 16, 2026                      https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : apache2     CVE ID         : CVE-2026-42356 CVE-2026-42528 CVE-2026-46729 CVE-2026-47360                      CVE-2026-48005 CVE-2026-56153 CVE-2026-56154 CVE-2026-56449                      CVE-2026-57941 CVE-2026-58415 CVE-2026-59797 CVE-2026-63045                      CVE-2026-63292 CVE-2026-63686 CVE-2026-63718 CVE-2026-73636                      CVE-2026-73637 CVE-2026-79768 CVE-2026-93546

    Multiple vulnerabilities have been discovered in the Apache HTTP server,     which may result in denial of service, information disclosure,     authentication bypass or HTTP request smuggling.

    For the stable distribution (trixie), these problems have been fixed in     version 2.4.69-1~deb13u1.

    We recommend that you upgrade your apache2 packages.

    For the detailed security status of apache2 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/apache2

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-d3cec01bde advisory.

    This update includes `httpd` version *2.4.69* addressing various security issues, see     https://downloads.apache.org/httpd/CHANGES_2.4.69 for more information.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150623 advisory.

    Unity Link Advisory UTSA-2026-150623

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
376953	SUSE SLES12: apache2 / apache2-devel / apache2-doc / apache2-example-pages / etc (SUSE-SU-2026:5099-1)	Nessus	SuSE Local Security Checks	2026/11/6	2026/11/6	critical
366715	Debian dsa-6569 : apache2 - security update	Nessus	Debian Local Security Checks	2026/10/17	2026/10/17	critical
366737	Fedora 43 : httpd (2026-d3cec01bde)	Nessus	Fedora Local Security Checks	2026/10/17	2026/10/17	critical
377080	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: httpd (UTSA-2026-150623)	Nessus	Unity Linux Local Security Checks	2026/11/6	2026/11/6	medium

検出

プラグインの検索

critical

critical

critical

medium