The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-326:01 advisory.

    * postgresql: PostgreSQL missing validation of multibyte character length executes arbitrary code     (CVE-2026-2006)
      * postgresql: PostgreSQL intarray missing validation of type of input to selectivity estimator executes     arbitrary code (CVE-2026-2004)
      * postgresql: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code (CVE-2026-2005)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of PostgreSQL installed on the remote host is 14 prior to 14.21, 15 prior to 15.16, 16 prior to 16.12, 17 prior to 17.8, or 18 prior to 18.2. As such, it is potentially affected by multiple vulnerabilities:

  - Missing validation of multibyte character length in PostgreSQL text manipulation allows a database user to     issue crafted queries that achieve a buffer overrun. That suffices to execute arbitrary code as the     operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and     14.21 are affected. (CVE-2026-2006)

  - Heap buffer overflow in PostgreSQL pgcrypto allows a ciphertext provider to execute arbitrary code as the     operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and     14.21 are affected. (CVE-2026-2005)

  - Missing validation of type of input in PostgreSQL intarray extension selectivity estimator function allows     an object creator to execute arbitrary code as the operating system user running the database. Versions     before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected. (CVE-2026-2004)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0616-1 advisory.

    Update to version 14.21.

    Security issues fixed:

    - CVE-2026-2003: improper validation of type 'oidvector' may allow disclose a few bytes of server memory     (bsc#1258008).
    - CVE-2026-2004: intarray missing validation of type of input to selectivity estimator could lead to     arbitrary code execution (bsc#1258009).
    - CVE-2026-2005: buffer overrun in contrib/pgcrypto's PGP decryption functions could lead to arbitrary     code execution (bsc#1258010).
    - CVE-2026-2006: inadequate validation of multibyte character lengths could lead to arbitrary code     execution (bsc#1258011).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0125 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-2006:
    Missing validation of multibyte character length in PostgreSQL text manipulation allows a database user to     issue crafted queries that achieve a buffer overrun.  That suffices to execute arbitrary code as the     operating system user running the database.  Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and     14.21 are affected.

    CVE-2026-2005:
    Heap buffer overflow in PostgreSQL pgcrypto allows a ciphertext provider to execute arbitrary code as the     operating system user running the database.  Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and     14.21 are affected.

    CVE-2026-2004:
    Missing validation of type of input in PostgreSQL intarray extension selectivity estimator function allows     an object creator to execute arbitrary code as the operating system user running the database.  Versions     before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.

    CVE-2026-2003:
    Improper validation of type oidvector in PostgreSQL allows a database user to disclose a few bytes of     server memory.  We have not ruled out viability of attacks that arrange for presence of confidential     information in disclosed bytes, but they seem unlikely.  Versions before PostgreSQL 18.2, 17.8, 16.12,     15.16, and 14.21 are affected.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0768-1 advisory.

    Update to version 14.22 (bsc#1258754).

    Security issues fixed:

    - CVE-2026-2003: improper validation of type 'oidvector' may allow disclose a few bytes of server memory     (bsc#1258008).
    - CVE-2026-2004: intarray missing validation of type of input to selectivity estimator could lead to     arbitrary code       execution (bsc#1258009).
    - CVE-2026-2005: buffer overrun in contrib/pgcrypto's PGP decryption functions could lead to arbitrary     code execution       (bsc#1258010).
    - CVE-2026-2006: inadequate validation of multibyte character lengths could lead to arbitrary code     execution       (bsc#1258011).

    Regression fixes:

      - the substring() function raises an error 'invalid byte sequence for encoding' on non-ASCII text values     if the         source of that value is a database column (caused by CVE-2026-2006 fix).
      - a standby may halt and return an error 'could not access status of transaction'.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:4064 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    Security Fix(es):

    * postgresql: PostgreSQL missing validation of multibyte character length executes arbitrary code     (CVE-2026-2006)

    * postgresql: PostgreSQL intarray missing validation of type of input to selectivity estimator executes     arbitrary code (CVE-2026-2004)

    * postgresql: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code (CVE-2026-2005)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-4024 advisory.

    - fix CVE-2026-2004 CVE-2026-2005 CVE-2026-2006
    - Resolves: RHEL-128818 (CVE-2025-12818)
    - Fix CVE-2025-1094
    - Fixes: CVE-2024-10976 CVE-2024-10978 CVE-2024-10979
    - Fix CVE-2024-7348
    - Fix CVE-2024-0985
    - Fixes: CVE-2023-5868 CVE-2023-5869 CVE-2023-5870 CVE-2023-39417

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:4518 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    Security Fix(es):

    * postgresql: PostgreSQL missing validation of multibyte character length executes arbitrary code     (CVE-2026-2006)

    * postgresql: PostgreSQL intarray missing validation of type of input to selectivity estimator executes     arbitrary code (CVE-2026-2004)

    * postgresql: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code (CVE-2026-2005)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:4524 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    Security Fix(es):

    * postgresql: PostgreSQL missing validation of multibyte character length executes arbitrary code     (CVE-2026-2006)

    * postgresql: PostgreSQL intarray missing validation of type of input to selectivity estimator executes     arbitrary code (CVE-2026-2004)

    * postgresql: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code (CVE-2026-2005)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0882-1 advisory.

    Update to version 16.13 (bsc#1258754).

    Security issues fixed:

    - CVE-2026-2003: improper validation of type 'oidvector' may allow disclose a few bytes of server memory     (bsc#1258008).
    - CVE-2026-2004: intarray missing validation of type of input to selectivity estimator could lead to     arbitrary code       execution (bsc#1258009).
    - CVE-2026-2005: buffer overrun in contrib/pgcrypto's PGP decryption functions could lead to arbitrary     code execution       (bsc#1258010).
    - CVE-2026-2006: inadequate validation of multibyte character lengths could lead to arbitrary code     execution       (bsc#1258011).

    Regression fixes:

      - the substring() function raises an error 'invalid byte sequence for encoding' on non-ASCII text values     if the         source of that value is a database column (caused by CVE-2026-2006 fix).
      - a standby may halt and return an error 'could not access status of transaction'.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-303:01 advisory.

    * postgresql: PostgreSQL missing validation of multibyte character length executes arbitrary code     (CVE-2026-2006)
      * postgresql: PostgreSQL intarray missing validation of type of input to selectivity estimator executes     arbitrary code (CVE-2026-2004)
      * postgresql: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code (CVE-2026-2005)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-332:01 advisory.

    * postgresql: PostgreSQL missing validation of multibyte character length executes arbitrary code     (CVE-2026-2006)
      * postgresql: PostgreSQL intarray missing validation of type of input to selectivity estimator executes     arbitrary code (CVE-2026-2004)
      * postgresql: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code (CVE-2026-2005)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
302782	MiracleLinux 9 : postgresql:16 (AXSA:2026-326:01)	Nessus	Miracle Linux Local Security Checks	2026/3/17	2026/3/24	high
299758	PostgreSQL 14.x < 14.21 / 15.x < 15.16 / 16.x < 16.12 / 17.x < 17.8 / 18.x < 18.2 Multiple Vulnerabilities	Nessus	Databases	2026/2/23	2026/2/24	high
300091	SUSE SLES12 Security Update : postgresql14 (SUSE-SU-2026:0616-1)	Nessus	SuSE Local Security Checks	2026/2/28	2026/2/28	high
300596	TencentOS Server 4: postgresql (TSSA-2026:0125)	Nessus	Tencent Local Security Checks	2026/3/4	2026/3/4	high
301054	SUSE SLES15 Security Update : postgresql14 (SUSE-SU-2026:0768-1)	Nessus	SuSE Local Security Checks	2026/3/6	2026/3/6	high
301542	RHEL 8 : postgresql:12 (RHSA-2026:4064)	Nessus	Red Hat Local Security Checks	2026/3/9	2026/3/9	high
301655	Oracle Linux 8 : postgresql:13 (ELSA-2026-4024)	Nessus	Oracle Linux Local Security Checks	2026/3/10	2026/3/10	high
302015	RHEL 9 : postgresql (RHSA-2026:4518)	Nessus	Red Hat Local Security Checks	2026/3/12	2026/3/12	high
302084	RHEL 9 : postgresql (RHSA-2026:4524)	Nessus	Red Hat Local Security Checks	2026/3/13	2026/3/13	high
302112	SUSE SLES15 / openSUSE 15 Security Update : postgresql16 (SUSE-SU-2026:0882-1)	Nessus	SuSE Local Security Checks	2026/3/13	2026/3/13	high
302137	MiracleLinux 8 : postgresql:12 (AXSA:2026-303:01)	Nessus	Miracle Linux Local Security Checks	2026/3/13	2026/3/18	high
302855	MiracleLinux 8 : postgresql:16 (AXSA:2026-332:01)	Nessus	Miracle Linux Local Security Checks	2026/3/18	2026/3/24	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high

high