The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-4063 advisory.

    - Fix CVE-2026-2004: PostgreSQL intarray missing validation of type of input
    - Fix CVE-2026-2005: PostgreSQL pgcrypto heap buffer overflow
    - Fix CVE-2026-2006: PostgreSQL missing validation of multibyte character length

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:4063 advisory.

    * postgresql: PostgreSQL missing validation of multibyte character length executes arbitrary code     (CVE-2026-2006)
      * postgresql: PostgreSQL intarray missing validation of type of input to selectivity estimator executes     arbitrary code (CVE-2026-2004)
      * postgresql: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code (CVE-2026-2005)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:4059 advisory.

    * postgresql: PostgreSQL missing validation of multibyte character length executes arbitrary code     (CVE-2026-2006)
      * postgresql: PostgreSQL intarray missing validation of type of input to selectivity estimator executes     arbitrary code (CVE-2026-2004)
      * postgresql: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code (CVE-2026-2005)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6132 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6132-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     February 12, 2026                     https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : postgresql-15     CVE ID         : CVE-2026-2003 CVE-2026-2004 CVE-2026-2005 CVE-2026-2006

    Multiple security issues were discovered in PostgreSQL, which may result     in memory disclosure or the execution of arbitrary code.

    For the oldstable distribution (bookworm), these problems have been fixed     in version 15.16-0+deb12u1.

    We recommend that you upgrade your postgresql-15 packages.

    For the detailed security status of postgresql-15 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/postgresql-15

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0586-1 advisory.

    Update to version 17.8.

    Security issues fixed:

    - CVE-2026-2003: improper validation of type 'oidvector' may allow disclose a few bytes of server memory     (bsc#1258008).
    - CVE-2026-2004: intarray missing validation of type of input to selectivity estimator could lead to     arbitrary code       execution (bsc#1258009).
    - CVE-2026-2005: buffer overrun in contrib/pgcrypto's PGP decryption functions could lead to arbitrary     code execution       (bsc#1258010).
    - CVE-2026-2006: inadequate validation of multibyte character lengths could lead to arbitrary code     execution       (bsc#1258011).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0771-1 advisory.

    Update to version 15.17 (bsc#1258754).

    Security issues fixed:

    - CVE-2026-2003: improper validation of type 'oidvector' may allow disclose a few bytes of server memory     (bsc#1258008).
    - CVE-2026-2004: intarray missing validation of type of input to selectivity estimator could lead to     arbitrary code       execution (bsc#1258009).
    - CVE-2026-2005: buffer overrun in contrib/pgcrypto's PGP decryption functions could lead to arbitrary     code execution       (bsc#1258010).
    - CVE-2026-2006: inadequate validation of multibyte character lengths could lead to arbitrary code     execution       (bsc#1258011).

    Regression fixes:

      - the substring() function raises an error 'invalid byte sequence for encoding' on non-ASCII text values     if the         source of that value is a database column (caused by CVE-2026-2006 fix).
      - a standby may halt and return an error 'could not access status of transaction'.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:4475 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    Security Fix(es):

    * postgresql: PostgreSQL missing validation of multibyte character length executes arbitrary code     (CVE-2026-2006)

    * postgresql: PostgreSQL intarray missing validation of type of input to selectivity estimator executes     arbitrary code (CVE-2026-2004)

    * postgresql: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code (CVE-2026-2005)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4524 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4524-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                   Jochen Sprickerhof     April 08, 2026                                https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : postgresql-13     Version        : 13.23-0+deb11u2     CVE ID         : CVE-2026-2003 CVE-2026-2004 CVE-2026-2005 CVE-2026-2006     Debian Bug     :

    Multiple vulnerabilities were fixed in PostgreSQL, a popular database.

    CVE-2026-2003

        Fix CVE-2026-2003: Improper validation of type oidvector in PostgreSQL         allows a database user to disclose a few bytes of server memory. We have         not ruled out viability of attacks that arrange for presence of         confidential information in disclosed bytes, but they seem unlikely.

    CVE-2026-2004

        Fix CVE-2026-2004: Missing validation of type of input in PostgreSQL         intarray extension selectivity estimator function allows an object creator         to execute arbitrary code as the operating system user running the         database.

    CVE-2026-2005

        Fix CVE-2026-2005: Heap buffer overflow in PostgreSQL pgcrypto allows a         ciphertext provider to execute arbitrary code as the operating system user         running the database.

    CVE-2026-2006

        Fix CVE-2026-2006: Missing validation of multibyte character length in         PostgreSQL text manipulation allows a database user to issue crafted         queries that achieve a buffer overrun. That suffices to execute arbitrary         code as the operating system user running the database.

    For Debian 11 bullseye, these problems have been fixed in version     13.23-0+deb11u2.

    We recommend that you upgrade your postgresql-13 packages.

    For the detailed security status of postgresql-13 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/postgresql-13

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
301653	Oracle Linux 8 : postgresql:16 (ELSA-2026-4063)	Nessus	Oracle Linux Local Security Checks	2026/3/10	2026/3/10	high
301826	AlmaLinux 8 : postgresql:16 (ALSA-2026:4063)	Nessus	Alma Linux Local Security Checks	2026/3/11	2026/3/11	high
301829	AlmaLinux 8 : postgresql:15 (ALSA-2026:4059)	Nessus	Alma Linux Local Security Checks	2026/3/11	2026/3/11	high
298907	Debian dsa-6132 : libecpg-compat3 - security update	Nessus	Debian Local Security Checks	2026/2/13	2026/2/23	high
299717	SUSE SLES15 Security Update : postgresql17 (SUSE-SU-2026:0586-1)	Nessus	SuSE Local Security Checks	2026/2/21	2026/2/21	high
300975	SUSE SLES15 / openSUSE 15 Security Update : postgresql15 (SUSE-SU-2026:0771-1)	Nessus	SuSE Local Security Checks	2026/3/5	2026/3/5	high
302033	RHEL 9 : postgresql (RHSA-2026:4475)	Nessus	Red Hat Local Security Checks	2026/3/12	2026/3/12	high
307674	Debian dla-4524 : libecpg-compat3 - security update	Nessus	Debian Local Security Checks	2026/4/21	2026/4/21	high

检测

插件搜索

high

high

high

high

high

high

high

high