The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - SQL injection in PostgreSQL logical replication ALTER SUBSCRIPTION ... REFRESH PUBLICATION allows a     subscriber table creator to execute arbitrary SQL with the subscription's publication-side credentials.
    The attack takes effect at the next REFRESH PUBLICATION. Within major versions 16, 17, and 18, minor     versions before PostgreSQL 18.4, 17.10, and 16.14 are affected. Versions before PostgreSQL 16 are     unaffected. (CVE-2026-6638)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1944-1 advisory.

    This update for postgresql18 fixes the following issues

    Update to version 18.4.

    Security issues:

    - CVE-2026-6472: ensure the user has CREATE privilege on the schema specified (bsc#1265172).
    - CVE-2026-6473: integer overflows in memory-allocation calculations (bsc#1265173).
    - CVE-2026-6474: Guard against malicious time zone names (bsc#1265174).
    - CVE-2026-6475: Prevent path traversal in pg_basebackup and pg_rewind (bsc#1265175).
    - CVE-2026-6476: Properly quote subscription names in pg_createsubscriber (bsc#1265176).
    - CVE-2026-6477: Mark PQfn() as unsafe, and avoid using it within libpq (bsc#1265177).
    - CVE-2026-6478: Use timing-safe string comparisons in authentication code (bsc#1265178).
    - CVE-2026-6479: Prevent unbounded recursion while processing startup packets (bsc#1265179).
    - CVE-2026-6575: Detect faulty input when restoring attribute MCV statistics (bsc#1265180).
    - CVE-2026-6637: Prevent SQL injection and buffer overruns in contrib/spi (bsc#1265181).
    - CVE-2026-6638: Properly quote object names in logical replication origin checks (bsc#1265182).

    Non security issue:

    - Get rid of update-alternatives for openSUSE/SLE 16.0 and newer to support immutable systems and     transactional       updates (jsc#PED-14820).
    - /usr/bin/pg_config is missing after migrating away from update-alternatives (bsc#1263804).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6270 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6270-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     May 14, 2026                          https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : postgresql-17     CVE ID         : CVE-2026-6472 CVE-2026-6473 CVE-2026-6474 CVE-2026-6475                      CVE-2026-6476 CVE-2026-6477 CVE-2026-6478 CVE-2026-6479                      CVE-2026-6637 CVE-2026-6638

    Multiple security issues were discovered in PostgreSQL, which may result     in authorisation bypass, execution of arbitrary code, information     disclosure, privilege escalation, SQL injection or denial of service.

    For the stable distribution (trixie), these problems have been fixed in     version 17.10-0+deb13u1.

    We recommend that you upgrade your postgresql-17 packages.

    For the detailed security status of postgresql-17 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/postgresql-17

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1942-1 advisory.

    This update for postgresql16 fixes the following issues

    Update to version 16.13.

    Security issues:

    - CVE-2026-6472: ensure the user has CREATE privilege on the schema specified (bsc#1265172).
    - CVE-2026-6473: integer overflows in memory-allocation calculations (bsc#1265173).
    - CVE-2026-6474: Guard against malicious time zone names (bsc#1265174).
    - CVE-2026-6475: Prevent path traversal in pg_basebackup and pg_rewind (bsc#1265175).
    - CVE-2026-6477: Mark PQfn() as unsafe, and avoid using it within libpq (bsc#1265177).
    - CVE-2026-6478: Use timing-safe string comparisons in authentication code (bsc#1265178).
    - CVE-2026-6479: Prevent unbounded recursion while processing startup packets (bsc#1265179).
    - CVE-2026-6637: Prevent SQL injection and buffer overruns in contrib/spi (bsc#1265181).
    - CVE-2026-6638: Properly quote object names in logical replication origin checks (bsc#1265182).

    Non security issue:

    - Get rid of update-alternatives for openSUSE/SLE 16.0 and newer to support immutable systems and     transactional       updates (jsc#PED-14824).
    - /usr/bin/pg_config is missing after migrating away from update-alternatives (bsc#1263804).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1945-1 advisory.

    This update for postgresql18 fixes the following issues

    Update to version 18.4.

    Security issues:

    - CVE-2026-6472: ensure the user has CREATE privilege on the schema specified (bsc#1265172).
    - CVE-2026-6473: integer overflows in memory-allocation calculations (bsc#1265173).
    - CVE-2026-6474: Guard against malicious time zone names (bsc#1265174).
    - CVE-2026-6475: Prevent path traversal in pg_basebackup and pg_rewind (bsc#1265175).
    - CVE-2026-6476: Properly quote subscription names in pg_createsubscriber (bsc#1265176).
    - CVE-2026-6477: Mark PQfn() as unsafe, and avoid using it within libpq (bsc#1265177).
    - CVE-2026-6478: Use timing-safe string comparisons in authentication code (bsc#1265178).
    - CVE-2026-6479: Prevent unbounded recursion while processing startup packets (bsc#1265179).
    - CVE-2026-6575: Detect faulty input when restoring attribute MCV statistics (bsc#1265180).
    - CVE-2026-6637: Prevent SQL injection and buffer overruns in contrib/spi (bsc#1265181).
    - CVE-2026-6638: Properly quote object names in logical replication origin checks (bsc#1265182).

    Non security issue:

    - Get rid of update-alternatives for openSUSE/SLE 16.0 and newer to support immutable systems and     transactional       updates (jsc#PED-14820).
    - /usr/bin/pg_config is missing after migrating away from update-alternatives (bsc#1263804).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1946-1 advisory.

    This update for postgresql18 fixes the following issues

    Update to version 18.4.

    Security issues:

    - CVE-2026-6472: ensure the user has CREATE privilege on the schema specified (bsc#1265172).
    - CVE-2026-6473: integer overflows in memory-allocation calculations (bsc#1265173).
    - CVE-2026-6474: Guard against malicious time zone names (bsc#1265174).
    - CVE-2026-6475: Prevent path traversal in pg_basebackup and pg_rewind (bsc#1265175).
    - CVE-2026-6476: Properly quote subscription names in pg_createsubscriber (bsc#1265176).
    - CVE-2026-6477: Mark PQfn() as unsafe, and avoid using it within libpq (bsc#1265177).
    - CVE-2026-6478: Use timing-safe string comparisons in authentication code (bsc#1265178).
    - CVE-2026-6479: Prevent unbounded recursion while processing startup packets (bsc#1265179).
    - CVE-2026-6575: Detect faulty input when restoring attribute MCV statistics (bsc#1265180).
    - CVE-2026-6637: Prevent SQL injection and buffer overruns in contrib/spi (bsc#1265181).
    - CVE-2026-6638: Properly quote object names in logical replication origin checks (bsc#1265182).

    Non security issue:

    - Get rid of update-alternatives for openSUSE/SLE 16.0 and newer to support immutable systems and     transactional       updates (jsc#PED-14820).
    - /usr/bin/pg_config is missing after migrating away from update-alternatives (bsc#1263804).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1943-1 advisory.

    This update for postgresql17 fixes the following issues

    Update to version 17.10.

    Security issues:

    - CVE-2026-6472: ensure the user has CREATE privilege on the schema specified (bsc#1265172).
    - CVE-2026-6473: integer overflows in memory-allocation calculations (bsc#1265173).
    - CVE-2026-6474: Guard against malicious time zone names (bsc#1265174).
    - CVE-2026-6475: Prevent path traversal in pg_basebackup and pg_rewind (bsc#1265175).
    - CVE-2026-6476: Properly quote subscription names in pg_createsubscriber (bsc#1265176).
    - CVE-2026-6477: Mark PQfn() as unsafe, and avoid using it within libpq (bsc#1265177).
    - CVE-2026-6478: Use timing-safe string comparisons in authentication code (bsc#1265178).
    - CVE-2026-6479: Prevent unbounded recursion while processing startup packets (bsc#1265179).
    - CVE-2026-6637: Prevent SQL injection and buffer overruns in contrib/spi (bsc#1265181).
    - CVE-2026-6638: Properly quote object names in logical replication origin checks (bsc#1265182).

    Non security issue:

    - Get rid of update-alternatives for openSUSE/SLE 16.0 and newer to support immutable systems and     transactional       updates (jsc#PED-14825 bsc#1245875).
    - /usr/bin/pg_config is missing after migrating away from update-alternatives (bsc#1263804).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
314720	Linux Distros Unpatched Vulnerability : CVE-2026-6638	Nessus	Misc.	5/14/2026	5/19/2026	high
315255	SUSE SLED15 / SLES15 Security Update : postgresql18 (SUSE-SU-2026:1944-1)	Nessus	SuSE Local Security Checks	5/19/2026	5/19/2026	high
314703	Debian dsa-6270 : libecpg-compat3 - security update	Nessus	Debian Local Security Checks	5/14/2026	5/19/2026	high
315268	SUSE SLES15 Security Update : postgresql16 (SUSE-SU-2026:1942-1)	Nessus	SuSE Local Security Checks	5/19/2026	5/19/2026	high
315271	SUSE SLES15 Security Update : postgresql18 (SUSE-SU-2026:1945-1)	Nessus	SuSE Local Security Checks	5/19/2026	5/19/2026	high
315292	SUSE SLES12 Security Update : postgresql18 (SUSE-SU-2026:1946-1)	Nessus	SuSE Local Security Checks	5/19/2026	5/19/2026	high
315289	SUSE SLED15 / SLES15 Security Update : postgresql17 (SUSE-SU-2026:1943-1)	Nessus	SuSE Local Security Checks	5/19/2026	5/19/2026	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high