The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0614-1 advisory.

    Update to version 16.12.

    Security issues fixed:

    - CVE-2026-2003: improper validation of type 'oidvector' may allow disclose a few bytes of server memory     (bsc#1258008).
    - CVE-2026-2004: intarray missing validation of type of input to selectivity estimator could lead to     arbitrary code execution (bsc#1258009).
    - CVE-2026-2005: buffer overrun in contrib/pgcrypto's PGP decryption functions could lead to arbitrary     code execution (bsc#1258010).
    - CVE-2026-2006: inadequate validation of multibyte character lengths could lead to arbitrary code     execution (bsc#1258011).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the Tenable Security Center running on the remote host is 6.5.0 through 6.8.0 and missing security patch SC-202604.1. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2026-10 advisory.

  - Missing validation of multibyte character length in PostgreSQL text manipulation allows a database user to     issue crafted queries that achieve a buffer overrun. That suffices to execute arbitrary code as the     operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21     are affected. (CVE-2026-2006)

  - Heap buffer overflow in PostgreSQL pgcrypto allows a ciphertext provider to execute arbitrary code as the     operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21     are affected. (CVE-2026-2005)

  - Missing validation of type of input in PostgreSQL intarray extension selectivity estimator function allows     an object creator to execute arbitrary code as the operating system user running the database. Versions     before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected. (CVE-2026-2004)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:4546 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    Security Fix(es):

    * postgresql: PostgreSQL oidvector discloses a few bytes of memory (CVE-2026-2003)

    * postgresql: PostgreSQL missing validation of multibyte character length executes arbitrary code     (CVE-2026-2006)

    * postgresql: PostgreSQL intarray missing validation of type of input to selectivity estimator executes     arbitrary code (CVE-2026-2004)

    * postgresql: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code (CVE-2026-2005)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:4548 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    Security Fix(es):

    * postgresql: PostgreSQL oidvector discloses a few bytes of memory (CVE-2026-2003)

    * postgresql: PostgreSQL missing validation of multibyte character length executes arbitrary code     (CVE-2026-2006)

    * postgresql: PostgreSQL intarray missing validation of type of input to selectivity estimator executes     arbitrary code (CVE-2026-2004)

    * postgresql: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code (CVE-2026-2005)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-325:01 advisory.

    * postgresql: PostgreSQL missing validation of multibyte character length executes arbitrary code     (CVE-2026-2006)
      * postgresql: PostgreSQL intarray missing validation of type of input to selectivity estimator executes     arbitrary code (CVE-2026-2004)
      * postgresql: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code (CVE-2026-2005)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6133 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6133-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     February 12, 2026                     https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : postgresql-17     CVE ID         : CVE-2026-2003 CVE-2026-2004 CVE-2026-2005 CVE-2026-2006

    Multiple security issues were discovered in PostgreSQL, which may result     in memory disclosure or the execution of arbitrary code.

    For the stable distribution (trixie), these problems have been fixed in     version 17.8-0+deb13u1.

    We recommend that you upgrade your postgresql-17 packages.

    For the detailed security status of postgresql-17 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/postgresql-17

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0615-1 advisory.

    Update to version 15.16.

    Security issues fixed:

    - CVE-2026-2003: improper validation of type 'oidvector' may allow disclose a few bytes of server memory     (bsc#1258008).
    - CVE-2026-2004: intarray missing validation of type of input to selectivity estimator could lead to     arbitrary code execution (bsc#1258009).
    - CVE-2026-2005: buffer overrun in contrib/pgcrypto's PGP decryption functions could lead to arbitrary     code execution (bsc#1258010).
    - CVE-2026-2006: inadequate validation of multibyte character lengths could lead to arbitrary code     execution (bsc#1258011).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:3730 advisory.

    * postgresql: PostgreSQL missing validation of multibyte character length executes arbitrary code     (CVE-2026-2006)

    * postgresql: PostgreSQL intarray missing validation of type of input to selectivity estimator executes     arbitrary code (CVE-2026-2004)

    * postgresql: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code (CVE-2026-2005)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of postgresql installed on the remote host is prior to 14.21-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2POSTGRESQL14-2026-022 advisory.

    Improper validation of type oidvector in PostgreSQL allows a database user to disclose a few bytes of     server memory.  We have not ruled out viability of attacks that arrange for presence of confidential     information in disclosed bytes, but they seem unlikely.  Versions before PostgreSQL 18.2, 17.8, 16.12,     15.16, and 14.21 are affected. (CVE-2026-2003)

    Missing validation of type of input in PostgreSQL intarray extension selectivity estimator function allows     an object creator to execute arbitrary code as the operating system user running the database.  Versions     before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected. (CVE-2026-2004)

    Heap buffer overflow in PostgreSQL pgcrypto allows a ciphertext provider to execute arbitrary code as the     operating system user running the database.  Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and     14.21 are affected. (CVE-2026-2005)

    Missing validation of multibyte character length in PostgreSQL text manipulation allows a database user to     issue crafted queries that achieve a buffer overrun.  That suffices to execute arbitrary code as the     operating system user running the database.  Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and     14.21 are affected. (CVE-2026-2006)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6132 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6132-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     February 12, 2026                     https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : postgresql-15     CVE ID         : CVE-2026-2003 CVE-2026-2004 CVE-2026-2005 CVE-2026-2006

    Multiple security issues were discovered in PostgreSQL, which may result     in memory disclosure or the execution of arbitrary code.

    For the oldstable distribution (bookworm), these problems have been fixed     in version 15.16-0+deb12u1.

    We recommend that you upgrade your postgresql-15 packages.

    For the detailed security status of postgresql-15 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/postgresql-15

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0586-1 advisory.

    Update to version 17.8.

    Security issues fixed:

    - CVE-2026-2003: improper validation of type 'oidvector' may allow disclose a few bytes of server memory     (bsc#1258008).
    - CVE-2026-2004: intarray missing validation of type of input to selectivity estimator could lead to     arbitrary code       execution (bsc#1258009).
    - CVE-2026-2005: buffer overrun in contrib/pgcrypto's PGP decryption functions could lead to arbitrary     code execution       (bsc#1258010).
    - CVE-2026-2006: inadequate validation of multibyte character lengths could lead to arbitrary code     execution       (bsc#1258011).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0771-1 advisory.

    Update to version 15.17 (bsc#1258754).

    Security issues fixed:

    - CVE-2026-2003: improper validation of type 'oidvector' may allow disclose a few bytes of server memory     (bsc#1258008).
    - CVE-2026-2004: intarray missing validation of type of input to selectivity estimator could lead to     arbitrary code       execution (bsc#1258009).
    - CVE-2026-2005: buffer overrun in contrib/pgcrypto's PGP decryption functions could lead to arbitrary     code execution       (bsc#1258010).
    - CVE-2026-2006: inadequate validation of multibyte character lengths could lead to arbitrary code     execution       (bsc#1258011).

    Regression fixes:

      - the substring() function raises an error 'invalid byte sequence for encoding' on non-ASCII text values     if the         source of that value is a database column (caused by CVE-2026-2006 fix).
      - a standby may halt and return an error 'could not access status of transaction'.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4524 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4524-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                   Jochen Sprickerhof     April 08, 2026                                https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : postgresql-13     Version        : 13.23-0+deb11u2     CVE ID         : CVE-2026-2003 CVE-2026-2004 CVE-2026-2005 CVE-2026-2006     Debian Bug     :

    Multiple vulnerabilities were fixed in PostgreSQL, a popular database.

    CVE-2026-2003

        Fix CVE-2026-2003: Improper validation of type oidvector in PostgreSQL         allows a database user to disclose a few bytes of server memory. We have         not ruled out viability of attacks that arrange for presence of         confidential information in disclosed bytes, but they seem unlikely.

    CVE-2026-2004

        Fix CVE-2026-2004: Missing validation of type of input in PostgreSQL         intarray extension selectivity estimator function allows an object creator         to execute arbitrary code as the operating system user running the         database.

    CVE-2026-2005

        Fix CVE-2026-2005: Heap buffer overflow in PostgreSQL pgcrypto allows a         ciphertext provider to execute arbitrary code as the operating system user         running the database.

    CVE-2026-2006

        Fix CVE-2026-2006: Missing validation of multibyte character length in         PostgreSQL text manipulation allows a database user to issue crafted         queries that achieve a buffer overrun. That suffices to execute arbitrary         code as the operating system user running the database.

    For Debian 11 bullseye, these problems have been fixed in version     13.23-0+deb11u2.

    We recommend that you upgrade your postgresql-13 packages.

    For the detailed security status of postgresql-13 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/postgresql-13

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
299983	SUSE SLES12 Security Update : postgresql16 (SUSE-SU-2026:0614-1)	Nessus	SuSE Local Security Checks	2026/2/26	2026/2/26	high
307259	Tenable Security Center Multiple Vulnerabilities (TNS-2026-10)	Nessus	Misc.	2026/4/17	2026/4/22	high
302021	RHEL 9 : postgresql:15 (RHSA-2026:4546)	Nessus	Red Hat Local Security Checks	2026/3/12	2026/3/12	high
302089	RHEL 9 : postgresql:15 (RHSA-2026:4548)	Nessus	Red Hat Local Security Checks	2026/3/13	2026/3/13	high
302780	MiracleLinux 9 : postgresql:15 (AXSA:2026-325:01)	Nessus	Miracle Linux Local Security Checks	2026/3/17	2026/3/24	high
298906	Debian dsa-6133 : libecpg-compat3 - security update	Nessus	Debian Local Security Checks	2026/2/13	2026/2/23	high
300041	SUSE SLES12 Security Update : postgresql15 (SUSE-SU-2026:0615-1)	Nessus	SuSE Local Security Checks	2026/2/26	2026/2/26	high
301156	RockyLinux 9 : postgresql (RLSA-2026:3730)	Nessus	Rocky Linux Local Security Checks	2026/3/6	2026/3/6	high
301262	Amazon Linux 2 : postgresql, --advisory ALAS2POSTGRESQL14-2026-022 (ALASPOSTGRESQL14-2026-022)	Nessus	Amazon Linux Local Security Checks	2026/3/6	2026/3/6	high
298907	Debian dsa-6132 : libecpg-compat3 - security update	Nessus	Debian Local Security Checks	2026/2/13	2026/2/23	high
299717	SUSE SLES15 Security Update : postgresql17 (SUSE-SU-2026:0586-1)	Nessus	SuSE Local Security Checks	2026/2/21	2026/2/21	high
300975	SUSE SLES15 / openSUSE 15 Security Update : postgresql15 (SUSE-SU-2026:0771-1)	Nessus	SuSE Local Security Checks	2026/3/5	2026/3/5	high
307674	Debian dla-4524 : libecpg-compat3 - security update	Nessus	Debian Local Security Checks	2026/4/21	2026/4/21	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high

high

high