There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - flatted is a circular JSON parser. Prior to version 3.4.2, the parse() function in flatted can use
    attacker-controlled string values from the parsed JSON as direct array index keys, without validating that
    they are numeric. Since the internal input buffer is a JavaScript Array, accessing it with the key
    "__proto__" returns Array.prototype via the inherited getter. This object is then treated as a legitimate
    parsed value and assigned as a property of the output object, effectively leaking a live reference to
    Array.prototype to the consumer. Any code that subsequently writes to that property will pollute the
    global prototype. This issue has been patched in version 3.4.2. (CVE-2026-33228)

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - flatted 是一個循環 JSON 剖析器。在 3.4.2 版之前，flatted 中的 parse() 函式可使用已剖析之 JSON 中受攻擊者控制的字串值作為直接陣列索引金鑰，而無需驗證其是否為數值。由於內部輸入緩衝區為 JavaScript 陣列，因此使用
    __proto__  金鑰存取此緩衝區將會透過繼承的 getter 傳回 Array.prototype。然後，此物件會被視為合法的剖析值，並被指派為輸出物件的內容，實際上是將 Array.prototype 的即時參照洩漏給了使用者。之後寫入該屬性的任何程式碼都會污染全域原型。此問題已在 3.4.2 版中修正。(CVE-2026-33228)

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - flatted 是循环 JSON 解析器。在低于 3.4.2 的版本中，flatted 中的 parse() 函数可能会将所解析 JSON 中受攻击者控制的字符串值用作直接数组索引键，且不会验证这些值是否为数值。由于内部输入缓冲区是 JavaScript 数组，因此使用键 __proto__ 访问时，
    它会通过继承的 getter 返回 Array.prototype。然后，此对象会被视为合法的解析值，并被分配为输出对象的属性，从而有效地向使用者泄漏对 Array.prototype 的实时引用。之后写入该属性的任何代码都将污染全局原型。已在版本 3.4.2 中修补此问题。(CVE-2026-33228)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - flatted は、循環 JSON パーサーです。バージョン 3.4.2 より前では、flated での parse() 関数は、解析された JSON からの攻撃者が制御する文字列値を、数値であることを検証せずに、直接配列インデックスキーとして使用する可能性があります。内部入力バッファは JavaScript 配列であるため、
    __proto__ というキーでアクセスすると、継承されたゲッターを通じて Array.prototype を返します。このオブジェクトは、正当な解析値として扱われ、出力オブジェクトのプロパティとして割り当てられるため、Array.prototype へのライブ参照がコンシューマーに実質的に漏洩します。その後、そのプロパティに書き込みを行うコードは、グローバルプロトタイプを汚染します。この問題には、バージョン 3.4.2 でパッチが適用されています。(CVE-2026-33228)

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

リモートの Fedora 45 ホストには、FEDORA-2026-a8a5f6b41b のアドバイザリに記載された複数の脆弱性の影響を受けるパッケージがインストールされています。

    最新の Ansible 13

    - 偽造 CVE をクローズ

Tenable は、前述の記述ブロックを Fedora セキュリティアドバイザリから直接抽出しています。

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0295 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-42037:
    Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.1, the     FormDataPart constructor in lib/helpers/formDataToStream.js interpolates value.type directly into the     Content-Type header of each multipart part without sanitizing CRLF (\r\n) sequences. An attacker who     controls the .type property of a Blob/File-like object (e.g., via a user-uploaded file in a Node.js proxy     service) can inject arbitrary MIME part headers into the multipart form-data body. This bypasses Node.js     v18+ built-in header protections because the injection targets the multipart body structure, not HTTP     request headers. This vulnerability is fixed in 1.15.1.

    CVE-2026-42035:
    Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, a prototype     pollution gadget exists in the Axios HTTP adapter (lib/adapters/http.js) that allows an attacker to inject     arbitrary HTTP headers into outgoing requests. The vulnerability exploits duck-type checking of the data     payload, where if Object.prototype is polluted with getHeaders, append, pipe, on, once, and     Symbol.toStringTag, Axios misidentifies any plain object payload as a FormData instance and calls the     attacker-controlled getHeaders() function, merging the returned headers into the outgoing request. The     vulnerable code resides exclusively in lib/adapters/http.js. The prototype pollution source does not need     to originate from Axios itself  any prototype pollution primitive in any dependency in the     application's dependency tree is sufficient to trigger this gadget. This vulnerability is fixed in 1.15.1     and 0.31.1.

    CVE-2026-42033:
    Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when     Object.prototype has been polluted by any co-dependency with keys that axios reads without a     hasOwnProperty guard, an attacker can (a) silently intercept and modify every JSON response before the     application sees it, or (b) fully hijack the underlying HTTP transport, gaining access to request     credentials, headers, and body. The precondition is prototype pollution from a separate source in the same     process. This vulnerability is fixed in 1.15.1 and 0.31.1.

    CVE-2026-41242:
    protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1 and     7.5.5, attackers can inject arbitrary code in the type fields of protobuf definitions, which will then     execute during object decoding using that definition. Versions 8.0.1 and 7.5.5 patch the issue.

    CVE-2026-33896:
    Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.
    Prior to version 1.4.0, `pki.verifyCertificateChain()` does not enforce RFC 5280 basicConstraints     requirements when an intermediate certificate lacks both the `basicConstraints` and `keyUsage` extensions.
    This allows any leaf certificate (without these extensions) to act as a CA and sign other certificates,     which node-forge will accept as valid. Version 1.4.0 patches the issue.

    CVE-2026-33895:
    Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.
    Prior to version 1.4.0, Ed25519 signature verification accepts forged non-canonical signatures where the     scalar S is not reduced modulo the group order (`S >= L`). A valid signature and its `S + L` variant both     verify in forge, while Node.js `crypto.verify` (OpenSSL-backed) rejects the `S + L` variant, as defined by     the specification. This class of signature malleability has been exploited in practice to bypass     authentication and authorization logic (see CVE-2026-25793, CVE-2022-35961). Applications relying on     signature uniqueness (i.e., dedup by signature bytes, replay tracking, signed-object canonicalization     checks) may be bypassed. Version 1.4.0 patches the issue.

    CVE-2026-33894:
    Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.
    Prior to version 1.4.0, RSASSA PKCS#1 v1.5 signature verification accepts forged signatures for low public     exponent keys (e=3). Attackers can forge signatures by stuffing garbage bytes within the ASN     structure in order to construct a signature that passes verification, enabling Bleichenbacher style     forgery. This issue is similar to CVE-2022-24771, but adds bytes in an addition field within the ASN     structure, rather than outside of it.  Additionally, forge does not validate that signatures include a     minimum of 8 bytes of padding as defined by the specification, providing attackers additional space to     construct Bleichenbacher forgeries. Version 1.4.0 patches the issue.

    CVE-2026-33891:
    Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.
    Prior to version 1.4.0, a Denial of Service (DoS) vulnerability exists in the node-forge library due to an     infinite loop in the BigInteger.modInverse() function (inherited from the bundled jsbn library). When     modInverse() is called with a zero value as input, the internal Extended Euclidean Algorithm enters an     unreachable exit condition, causing the process to hang indefinitely and consume 100% CPU. Version 1.4.0     patches the issue.

    CVE-2026-33228:
    flatted is a circular JSON parser. Prior to version 3.4.2, the parse() function in flatted can use     attacker-controlled string values from the parsed JSON as direct array index keys, without validating that     they are numeric. Since the internal input buffer is a JavaScript Array, accessing it with the key
    __proto__ returns Array.prototype via the inherited getter. This object is then treated as a legitimate     parsed value and assigned as a property of the output object, effectively leaking a live reference to     Array.prototype to the consumer. Any code that subsequently writes to that property will pollute the     global prototype. This issue has been patched in version 3.4.2.

    CVE-2026-32141:
    flatted is a circular JSON parser. Prior to 3.4.0, flatted's parse() function uses a recursive revive()     phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested     or self-referential $ indices, the recursion depth is unbounded, causing a stack overflow that crashes the     Node.js process. This vulnerability is fixed in 3.4.0.

    CVE-2026-29074:
    SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files.
    From version 2.1.0 to before version 2.8.1, from version 3.0.0 to before version 3.3.3, and before version     4.0.1, SVGO accepts XML with custom entities, without guards against entity expansion or recursion. This     can result in a small XML file (811 bytes) stalling the application and even crashing the Node.js process     with JavaScript heap out of memory. This issue has been patched in versions 2.8.1, 3.3.3, and 4.0.1.

    CVE-2026-27904:
    minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.
    Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs     produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic     backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()`     stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes.
    This is the most severe finding: it is triggered by the default `minimatch()` API with no special options,     and the minimum viable pattern is only 12 bytes. The same issue affects `+()` extglobs equally. Versions     10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.

    CVE-2026-27903:
    minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.
    Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs     unbounded recursive backtracking when a glob pattern contains multiple non-adjacent `**` (GLOBSTAR)     segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- where `n` is     the number of path segments and `k` is the number of globstars. With k=11 and n=30, a call to the default     `minimatch()` API stalls for roughly 5 seconds. With k=13, it exceeds 15 seconds. No memoization or call     budget exists to bound this behavior. Any application where an attacker can influence the glob pattern     passed to `minimatch()` is vulnerable. The realistic attack surface includes build tools and task runners     that accept user-supplied glob arguments (ESLint, Webpack, Rollup config), multi-tenant systems where one     tenant configures glob-based rules that run in a shared process, admin or developer interfaces that accept     ignore-rule or filter configuration as globs, and CI/CD pipelines that evaluate user-submitted config     files containing glob patterns. An attacker who can place a crafted pattern into any of these paths can     stall the Node.js event loop for tens of seconds per invocation. The pattern is 56 bytes for a 5-second     stall and does not require authentication in contexts where pattern input is part of the feature. Versions     10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3 fix the issue.

    CVE-2026-26996:
    minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.
    Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob     pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the     test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine     backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number     of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively     forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is     vulnerable to DoS. This issue has been fixed in version 10.2.1.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - flatted is a circular JSON parser. Prior to version 3.4.2, the parse() function in flatted can use     attacker-controlled string values from the parsed JSON as direct array index keys, without validating that     they are numeric. Since the internal input buffer is a JavaScript Array, accessing it with the key
    __proto__ returns Array.prototype via the inherited getter. This object is then treated as a legitimate     parsed value and assigned as a property of the output object, effectively leaking a live reference to     Array.prototype to the consumer. Any code that subsequently writes to that property will pollute the     global prototype. This issue has been patched in version 3.4.2. (CVE-2026-33228)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 45 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-a8a5f6b41b advisory.

    Latest Ansible 13

    - Close bogus CVEs

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
472850	SCA: security update for flatted (GHSA-rf6f-7fwh-wjgh)	Tenable Self-Hosted Container Security	SCA Checks	2026/10/5	2026/10/9	critical
472850	SCA: security update for flatted (GHSA-rf6f-7fwh-wjgh)	Tenable Cloud Security	SCA Checks	2026/10/5	2026/10/9	critical
303264	Linux Distros 未修補的弱點：CVE-2026-33228	Nessus	Misc.	2026/3/21	2026/9/2	critical
303264	Linux Distros 未修补的漏洞：CVE-2026-33228	Nessus	Misc.	2026/3/21	2026/9/2	critical
303264	Linux Distros のパッチ未適用の脆弱性: CVE-2026-33228	Nessus	Misc.	2026/3/21	2026/9/2	critical
315971	Fedora 45 : ansible / ansible-core (2026-a8a5f6b41b)	Nessus	Fedora Local Security Checks	2026/5/20	2026/5/20	critical
319720	TencentOS Server 4: grafana (TSSA-2026:0295)	Nessus	Tencent Local Security Checks	2026/6/8	2026/6/8	critical
303264	Linux Distros Unpatched Vulnerability : CVE-2026-33228	Nessus	Misc.	2026/3/21	2026/9/2	critical
315971	Fedora 45 : ansible / ansible-core (2026-a8a5f6b41b)	Nessus	Fedora Local Security Checks	2026/5/20	2026/5/20	critical

検出

プラグインの検索

critical

critical

critical

critical

critical

critical

critical

critical

critical