The version of PostgreSQL installed on the remote host is 14 prior to 14.23, 15 prior to 15.18, 16 prior to 16.14, 17 prior to 17.10, or 18 prior to 18.4. As such, it is potentially affected by multiple vulnerabilities:

  - Stack buffer overflow in PostgreSQL module refint allows an unprivileged database user to execute     arbitrary code as the operating system user running the database. A distinct attack is possible if the     application declares a user-controlled column as a refint cascade primary key and facilitates user-     controlled updates to that column. In that case, a SQL injection allows a primary key update value     provider to execute arbitrary SQL as the database user performing the primary key update. Versions before     PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected. (CVE-2026-6637)

  - Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(),     lo_read(), lo_lseek64(), and lo_tell64() functions allows the server superuser to overwrite a client stack     buffer with an arbitrarily-large response. Like gets(), PQfn(..., result_is_int=0, ...) stores arbitrary-     length, server-determined data into a buffer of unspecified size. Because both the \lo_export command in     psql and pg_dump call lo_read(), the server superuser can overwrite pg_dump or psql stack memory. Versions     before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected. (CVE-2026-6477)

  - Integer wraparound in multiple PostgreSQL server features allows an unprivileged database user to cause     the server to undersize an allocation and write out-of-bounds. This may execute arbitrary code as the     operating system user running the database. In applications that pass gigabyte-scale user inputs to the     relevant database functions, the application input provider may achieve a segmentation fault. Versions     before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected. (CVE-2026-6473)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:67848 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    Security Fix(es):

    * postgresql: PostgreSQL: SQL injection in pg_createsubscriber allows arbitrary SQL execution as superuser     (CVE-2026-6476)

    * postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery     functions (CVE-2026-14662)

    * postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump     (CVE-2026-18408)

    * postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN     (CVE-2026-6464)

    * postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin (CVE-2026-6471)

    * postgresql: PostgreSQL: Arbitrary code execution via type confusion with internal arguments     (CVE-2026-14680)

    * postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp (CVE-2026-14664)

    * postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl     (CVE-2026-14677)

    * postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound     (CVE-2026-15742)

    * postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle (CVE-2026-16239)

    * postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation (CVE-2026-14669)

    * postgresql: PostgreSQL: Arbitrary code execution via type confusion in pg_restore_attribute_stats()     (CVE-2026-16238)

    * postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation (CVE-2026-14679)

    * postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module (CVE-2026-14671)

    * postgresql: PostgreSQL pg_stat_statements: Arbitrary code execution via heap buffer overflow     (CVE-2026-14676)

    * postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow     (CVE-2026-14670)

    * postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator     (CVE-2026-14668)

    * postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists (CVE-2026-19385)

    * postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse (CVE-2026-15741)

    * postgis: PostGIS: Memory Disclosure and Denial of Service via Malformed FlatGeobuf Buffer     (CVE-2026-73515)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1944-1 advisory.

    This update for postgresql18 fixes the following issues

    Update to version 18.4.

    Security issues:

    - CVE-2026-6472: ensure the user has CREATE privilege on the schema specified (bsc#1265172).
    - CVE-2026-6473: integer overflows in memory-allocation calculations (bsc#1265173).
    - CVE-2026-6474: Guard against malicious time zone names (bsc#1265174).
    - CVE-2026-6475: Prevent path traversal in pg_basebackup and pg_rewind (bsc#1265175).
    - CVE-2026-6476: Properly quote subscription names in pg_createsubscriber (bsc#1265176).
    - CVE-2026-6477: Mark PQfn() as unsafe, and avoid using it within libpq (bsc#1265177).
    - CVE-2026-6478: Use timing-safe string comparisons in authentication code (bsc#1265178).
    - CVE-2026-6479: Prevent unbounded recursion while processing startup packets (bsc#1265179).
    - CVE-2026-6575: Detect faulty input when restoring attribute MCV statistics (bsc#1265180).
    - CVE-2026-6637: Prevent SQL injection and buffer overruns in contrib/spi (bsc#1265181).
    - CVE-2026-6638: Properly quote object names in logical replication origin checks (bsc#1265182).

    Non security issue:

    - Get rid of update-alternatives for openSUSE/SLE 16.0 and newer to support immutable systems and     transactional       updates (jsc#PED-14820).
    - /usr/bin/pg_config is missing after migrating away from update-alternatives (bsc#1263804).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-27742 advisory.

    [18.4-1.0.1]
    - Replace upstream reference

    [18.4-1]
    - Update to 18.4
    - Fix CVE-2026-6478

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1943-1 advisory.

    This update for postgresql17 fixes the following issues

    Update to version 17.10.

    Security issues:

    - CVE-2026-6472: ensure the user has CREATE privilege on the schema specified (bsc#1265172).
    - CVE-2026-6473: integer overflows in memory-allocation calculations (bsc#1265173).
    - CVE-2026-6474: Guard against malicious time zone names (bsc#1265174).
    - CVE-2026-6475: Prevent path traversal in pg_basebackup and pg_rewind (bsc#1265175).
    - CVE-2026-6476: Properly quote subscription names in pg_createsubscriber (bsc#1265176).
    - CVE-2026-6477: Mark PQfn() as unsafe, and avoid using it within libpq (bsc#1265177).
    - CVE-2026-6478: Use timing-safe string comparisons in authentication code (bsc#1265178).
    - CVE-2026-6479: Prevent unbounded recursion while processing startup packets (bsc#1265179).
    - CVE-2026-6637: Prevent SQL injection and buffer overruns in contrib/spi (bsc#1265181).
    - CVE-2026-6638: Properly quote object names in logical replication origin checks (bsc#1265182).

    Non security issue:

    - Get rid of update-alternatives for openSUSE/SLE 16.0 and newer to support immutable systems and     transactional       updates (jsc#PED-14825 bsc#1245875).
    - /usr/bin/pg_config is missing after migrating away from update-alternatives (bsc#1263804).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-672800 advisory.

    - Fix CVE-2026-18408

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - SQL injection in PostgreSQL pg_createsubscriber allows an attacker with pg_create_subscription rights to     execute arbitrary SQL as a superuser. The attack takes effect when pg_createsubscriber next runs. Within     major versions 17 and 18, minor versions before PostgreSQL 18.4 and 17.10 are affected. Versions before     PostgreSQL 17 are unaffected. (CVE-2026-6476)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6270 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6270-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     May 14, 2026                          https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : postgresql-17     CVE ID         : CVE-2026-6472 CVE-2026-6473 CVE-2026-6474 CVE-2026-6475                      CVE-2026-6476 CVE-2026-6477 CVE-2026-6478 CVE-2026-6479                      CVE-2026-6637 CVE-2026-6638

    Multiple security issues were discovered in PostgreSQL, which may result     in authorisation bypass, execution of arbitrary code, information     disclosure, privilege escalation, SQL injection or denial of service.

    For the stable distribution (trixie), these problems have been fixed in     version 17.10-0+deb13u1.

    We recommend that you upgrade your postgresql-17 packages.

    For the detailed security status of postgresql-17 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/postgresql-17

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1945-1 advisory.

    This update for postgresql18 fixes the following issues

    Update to version 18.4.

    Security issues:

    - CVE-2026-6472: ensure the user has CREATE privilege on the schema specified (bsc#1265172).
    - CVE-2026-6473: integer overflows in memory-allocation calculations (bsc#1265173).
    - CVE-2026-6474: Guard against malicious time zone names (bsc#1265174).
    - CVE-2026-6475: Prevent path traversal in pg_basebackup and pg_rewind (bsc#1265175).
    - CVE-2026-6476: Properly quote subscription names in pg_createsubscriber (bsc#1265176).
    - CVE-2026-6477: Mark PQfn() as unsafe, and avoid using it within libpq (bsc#1265177).
    - CVE-2026-6478: Use timing-safe string comparisons in authentication code (bsc#1265178).
    - CVE-2026-6479: Prevent unbounded recursion while processing startup packets (bsc#1265179).
    - CVE-2026-6575: Detect faulty input when restoring attribute MCV statistics (bsc#1265180).
    - CVE-2026-6637: Prevent SQL injection and buffer overruns in contrib/spi (bsc#1265181).
    - CVE-2026-6638: Properly quote object names in logical replication origin checks (bsc#1265182).

    Non security issue:

    - Get rid of update-alternatives for openSUSE/SLE 16.0 and newer to support immutable systems and     transactional       updates (jsc#PED-14820).
    - /usr/bin/pg_config is missing after migrating away from update-alternatives (bsc#1263804).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1946-1 advisory.

    This update for postgresql18 fixes the following issues

    Update to version 18.4.

    Security issues:

    - CVE-2026-6472: ensure the user has CREATE privilege on the schema specified (bsc#1265172).
    - CVE-2026-6473: integer overflows in memory-allocation calculations (bsc#1265173).
    - CVE-2026-6474: Guard against malicious time zone names (bsc#1265174).
    - CVE-2026-6475: Prevent path traversal in pg_basebackup and pg_rewind (bsc#1265175).
    - CVE-2026-6476: Properly quote subscription names in pg_createsubscriber (bsc#1265176).
    - CVE-2026-6477: Mark PQfn() as unsafe, and avoid using it within libpq (bsc#1265177).
    - CVE-2026-6478: Use timing-safe string comparisons in authentication code (bsc#1265178).
    - CVE-2026-6479: Prevent unbounded recursion while processing startup packets (bsc#1265179).
    - CVE-2026-6575: Detect faulty input when restoring attribute MCV statistics (bsc#1265180).
    - CVE-2026-6637: Prevent SQL injection and buffer overruns in contrib/spi (bsc#1265181).
    - CVE-2026-6638: Properly quote object names in logical replication origin checks (bsc#1265182).

    Non security issue:

    - Get rid of update-alternatives for openSUSE/SLE 16.0 and newer to support immutable systems and     transactional       updates (jsc#PED-14820).
    - /usr/bin/pg_config is missing after migrating away from update-alternatives (bsc#1263804).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2303-1 advisory.

    This update for postgresql17 fixes the following issues

    Update to version 17.10.

    Security issues:

    - CVE-2026-6472: ensure the user has CREATE privilege on the schema specified (bsc#1265172).
    - CVE-2026-6473: integer overflows in memory-allocation calculations (bsc#1265173).
    - CVE-2026-6474: Guard against malicious time zone names (bsc#1265174).
    - CVE-2026-6475: Prevent path traversal in pg_basebackup and pg_rewind (bsc#1265175).
    - CVE-2026-6476: Properly quote subscription names in pg_createsubscriber (bsc#1265176).
    - CVE-2026-6477: Mark PQfn() as unsafe, and avoid using it within libpq (bsc#1265177).
    - CVE-2026-6478: Use timing-safe string comparisons in authentication code (bsc#1265178).
    - CVE-2026-6479: Prevent unbounded recursion while processing startup packets (bsc#1265179).
    - CVE-2026-6637: Prevent SQL injection and buffer overruns in contrib/spi (bsc#1265181).
    - CVE-2026-6638: Properly quote object names in logical replication origin checks (bsc#1265182).

    Non security issue:

    - Get rid of update-alternatives for openSUSE/SLE 16.0 and newer to support immutable systems and     transactional       updates (jsc#PED-14825 bsc#1245875).
    - /usr/bin/pg_config is missing after migrating away from update-alternatives (bsc#1263804).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:67280 advisory.

    PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package     contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML     documentation for the whole system.  These client programs can be located on the same machine as the     PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection.
    The PostgreSQL server can be found in the postgresql-server sub-package.

    Security Fix(es):

    * postgresql: PostgreSQL: SQL injection in pg_createsubscriber allows arbitrary SQL execution as superuser     (CVE-2026-6476)

    * postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery     functions (CVE-2026-14662)

    * postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump     (CVE-2026-18408)

    * postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN     (CVE-2026-6464)

    * postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin (CVE-2026-6471)

    * postgresql: PostgreSQL: Arbitrary code execution via type confusion with internal arguments     (CVE-2026-14680)

    * postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp (CVE-2026-14664)

    * postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl     (CVE-2026-14677)

    * postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound     (CVE-2026-15742)

    * postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle (CVE-2026-16239)

    * postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation (CVE-2026-14669)

    * postgresql: PostgreSQL: Arbitrary code execution via type confusion in pg_restore_attribute_stats()     (CVE-2026-16238)

    * postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation (CVE-2026-14679)

    * postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module (CVE-2026-14671)

    * postgresql: PostgreSQL pg_stat_statements: Arbitrary code execution via heap buffer overflow     (CVE-2026-14676)

    * postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow     (CVE-2026-14670)

    * postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator     (CVE-2026-14668)

    * postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists (CVE-2026-19385)

    * postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse (CVE-2026-15741)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
316515	PostgreSQL 14.x < 14.23 / 15.x < 15.18 / 16.x < 16.14 / 17.x < 17.10 / 18.x < 18.4 Multiple Vulnerabilities	Nessus	Databases	2026/5/22	2026/5/25	high
346291	RHEL 9 : postgresql:18 (RHSA-2026:67848)	Nessus	Red Hat Local Security Checks	2026/9/16	2026/9/16	high
315255	SUSE SLED15 / SLES15 Security Update : postgresql18 (SUSE-SU-2026:1944-1)	Nessus	SuSE Local Security Checks	2026/5/19	2026/5/22	high
328012	Oracle Linux 10 : postgresql18 (ELSA-2026-27742)	Nessus	Oracle Linux Local Security Checks	2026/7/20	2026/7/20	high
315289	SUSE SLED15 / SLES15 Security Update : postgresql17 (SUSE-SU-2026:1943-1)	Nessus	SuSE Local Security Checks	2026/5/19	2026/5/22	high
345982	Oracle Linux 10 : ELSA-2026-67280-0: / postgresql18 (ELSA-2026-672800)	Nessus	Oracle Linux Local Security Checks	2026/9/15	2026/9/15	high
314718	Linux Distros Unpatched Vulnerability : CVE-2026-6476	Nessus	Misc.	2026/5/14	2026/7/16	high
314703	Debian dsa-6270 : libecpg-compat3 - security update	Nessus	Debian Local Security Checks	2026/5/14	2026/5/22	high
315271	SUSE SLES15 Security Update : postgresql18 (SUSE-SU-2026:1945-1)	Nessus	SuSE Local Security Checks	2026/5/19	2026/5/22	high
315292	SUSE SLES12 Security Update : postgresql18 (SUSE-SU-2026:1946-1)	Nessus	SuSE Local Security Checks	2026/5/19	2026/5/22	high
321035	SUSE SLES15 Security Update : postgresql17 (SUSE-SU-2026:2303-1)	Nessus	SuSE Local Security Checks	2026/6/14	2026/6/14	high
345597	RHEL 10 : postgresql18 (RHSA-2026:67280)	Nessus	Red Hat Local Security Checks	2026/9/14	2026/9/15	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high

high