The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-327:01 advisory.

    * postgresql: PostgreSQL missing validation of multibyte character length executes arbitrary code     (CVE-2026-2006)
      * postgresql: PostgreSQL intarray missing validation of type of input to selectivity estimator executes     arbitrary code (CVE-2026-2004)
      * postgresql: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code (CVE-2026-2005)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2026:0059 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2026-2004:
    Missing validation of type of input in PostgreSQL intarray extension selectivity estimator function allows     an object creator to execute arbitrary code as the operating system user running the database.  Versions     before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.

    CVE-2026-2005:
    Heap buffer overflow in PostgreSQL pgcrypto allows a ciphertext provider to execute arbitrary code as the     operating system user running the database.  Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and     14.21 are affected.

    CVE-2026-2006:
    Missing validation of multibyte character length in PostgreSQL text manipulation allows a database user to     issue crafted queries that achieve a buffer overrun.  That suffices to execute arbitrary code as the     operating system user running the database.  Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and     14.21 are affected.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4524 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4524-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                   Jochen Sprickerhof     April 08, 2026                                https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : postgresql-13     Version        : 13.23-0+deb11u2     CVE ID         : CVE-2026-2003 CVE-2026-2004 CVE-2026-2005 CVE-2026-2006     Debian Bug     :

    Multiple vulnerabilities were fixed in PostgreSQL, a popular database.

    CVE-2026-2003

        Fix CVE-2026-2003: Improper validation of type oidvector in PostgreSQL         allows a database user to disclose a few bytes of server memory. We have         not ruled out viability of attacks that arrange for presence of         confidential information in disclosed bytes, but they seem unlikely.

    CVE-2026-2004

        Fix CVE-2026-2004: Missing validation of type of input in PostgreSQL         intarray extension selectivity estimator function allows an object creator         to execute arbitrary code as the operating system user running the         database.

    CVE-2026-2005

        Fix CVE-2026-2005: Heap buffer overflow in PostgreSQL pgcrypto allows a         ciphertext provider to execute arbitrary code as the operating system user         running the database.

    CVE-2026-2006

        Fix CVE-2026-2006: Missing validation of multibyte character length in         PostgreSQL text manipulation allows a database user to issue crafted         queries that achieve a buffer overrun. That suffices to execute arbitrary         code as the operating system user running the database.

    For Debian 11 bullseye, these problems have been fixed in version     13.23-0+deb11u2.

    We recommend that you upgrade your postgresql-13 packages.

    For the detailed security status of postgresql-13 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/postgresql-13

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-19010 advisory.

    [16.13-1.0.1]
    - Replace upstream reference [Orabug: 37044148]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-19009 advisory.

    - Fix CVE-2026-2004: PostgreSQL intarray missing validation of type of input to selectivity estimator     executes arbitrary code
    - Fix CVE-2026-2005: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code
    - Fix CVE-2026-2006: PostgreSQL missing validation of multibyte character length executes arbitrary code
    - Fix CVE-2026-2007: PostgreSQL libpq read out-of-bound buffer error

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1773160910 advisory.

  - Missing validation of type of input in PostgreSQL intarray extension selectivity estimator function allows     an object creator to execute arbitrary code as the operating system user running the database. Versions     before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected. (CVE-2026-2004)

  - Heap buffer overflow in PostgreSQL pgcrypto allows a ciphertext provider to execute arbitrary code as the     operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21     are affected. (CVE-2026-2005)

  - Missing validation of multibyte character length in PostgreSQL text manipulation allows a database user to     issue crafted queries that achieve a buffer overrun. That suffices to execute arbitrary code as the     operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21     are affected. (CVE-2026-2006)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_4059 advisory.

    * postgresql: PostgreSQL missing validation of multibyte character length executes arbitrary code     (CVE-2026-2006)

    * postgresql: PostgreSQL intarray missing validation of type of input to selectivity estimator executes     arbitrary code (CVE-2026-2004)

    * postgresql: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code (CVE-2026-2005)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_4063 advisory.

    * postgresql: PostgreSQL missing validation of multibyte character length executes arbitrary code     (CVE-2026-2006)

    * postgresql: PostgreSQL intarray missing validation of type of input to selectivity estimator executes     arbitrary code (CVE-2026-2004)

    * postgresql: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code (CVE-2026-2005)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1564 advisory.

    This advisory aggregates security fixes for the postgresql SRPM in CIQ LTS 9.6. It addresses 39 CVEs:
    CVE-2026-14673, CVE-2026-6477, CVE-2026-14664, CVE-2026-6473, CVE-2026-6472, and 34 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the postgresql15 package has been released.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
302784	MiracleLinux 8 : postgresql:13 (AXSA:2026-327:01)	Nessus	Miracle Linux Local Security Checks	2026/3/17	2026/3/18	high
303437	Alibaba Cloud Linux 3 : 0059: postgresql:13 (ALINUX3-SA-2026:0059)	Nessus	Alibaba Cloud Linux Local Security Checks	2026/3/24	2026/3/24	high
307674	Debian dla-4524 : libecpg-compat3 - security update	Nessus	Debian Local Security Checks	2026/4/21	2026/5/15	high
327039	Oracle Linux 10 : postgresql16 (ELSA-2026-19010)	Nessus	Oracle Linux Local Security Checks	2026/7/15	2026/7/15	high
327057	Oracle Linux 10 : postgresql18 (ELSA-2026-19009)	Nessus	Oracle Linux Local Security Checks	2026/7/15	2026/7/15	high
352082	AlmaLinux 9.2 [TuxCare] Security Update: postgresql / postgresql-contrib / postgresql-docs / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1773160910)	Nessus	Alma Linux Local Security Checks	2026/9/30	2026/9/30	high
357770	Rocky Linux 8 [CIQ] Security Update: pg_repack / pg_repack-debuginfo / pg_repack-debugsource / pgaudit / etc Multiple Vulnerabilities (crlsa-2026_4059)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	high
358268	Rocky Linux 8 [CIQ] Security Update: pg_repack / pg_repack-debuginfo / pg_repack-debugsource / pgaudit / etc Multiple Vulnerabilities (crlsa-2026_4063)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	high
356888	Rocky Linux 9.6 [CIQ] Security Update: postgresql / postgresql-contrib / postgresql-docs / etc Multiple Vulnerabilities (ciqsa-2026_1564)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/12	high
374961	Photon OS 5.0: Postgresql15 PHSA-2026-5.0-90-1039	Nessus	PhotonOS Local Security Checks	2026/11/2	2026/11/2	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high