{"vulnerability": "cve-2026-6664", "sightings": [{"uuid": "1a10ca3c-c17a-4b3b-92a8-bce95c6660bb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6664", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mlgvniz4zf2t", "content": "\ud83d\udfe0 CVE-2026-6664 - High (7.5)\n\nAn integer overflow in network packet parsing code in PgBouncer before 1.25.2 bypasses a boundary...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-6664/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-05-09T18:44:24.357170Z"}, {"uuid": "f8fb9d2f-e5cb-461c-a989-80565e32f947", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6664", "type": "seen", "source": "Telegram/uli2GhURI2CJbk1kAeqzAiHzDld1f3ZduT020MgDdyP-5f4", "content": "", "creation_timestamp": "2026-05-12T19:00:12.000000Z"}, {"uuid": "b8d3c978-35b2-4901-9e34-5de551c1567b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6664", "type": "seen", "source": "Telegram/gmqsYJuL8AU1ZXxnDjjWQKLCPTC0oBwWP4DJHqZuZarsDHs", "content": "", "creation_timestamp": "2026-05-12T21:00:04.000000Z"}, {"uuid": "c1578d7f-ce33-41a2-89c8-4f8a76eaae01", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6664", "type": "seen", "source": "https://t.me/bdufstecru/3160", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0439 mbuf_get_bytes() \u0438 mbuf_get_chars() \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u043f\u0443\u043b\u0430 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f \u0432 PostgreSQL PgBouncer \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0446\u0435\u043b\u043e\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u044b\u043c \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435\u043c. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438 \u043f\u0443\u0442\u0435\u043c \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u043f\u0430\u043a\u0435\u0442\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 SCRAM\n\nBDU:2026-06724\nCVE-2026-6664\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\nhttps://www.pgbouncer.org/changelog.html#pgbouncer-125x", "creation_timestamp": "2026-05-15T12:56:28.000000Z"}, {"uuid": "405e9c1b-50d6-4daa-9330-afba6bf20f14", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6664", "type": "seen", "source": "https://bsky.app/profile/pgexperts.bsky.social/post/3mmpk2g736r2r", "content": "PgBouncer 1.25.2 fixes CVE-2026-6664: pre-auth integer overflow in the SCRAM packet parser. CVSS 7.5, DoS only, but unauthenticated and network-reachable.\n\nThe vendor workaround is \"don't use SCRAM,\" which isn't a workaround. Patch.\n\nwww.pgbouncer.org/changelog.html\n\npgexperts.com", "creation_timestamp": "2026-05-25T22:36:01.873223Z"}, {"uuid": "30881bc4-1062-4136-ad95-47f99a3307fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6664", "type": "seen", "source": "https://bsky.app/profile/pgexperts.bsky.social/post/3mms2jdkrgm2m", "content": "CVE-2026-6664: integer overflow in PgBouncer SCRAM packet parsing. Pre-authentication. Any TCP connection can crash the pooler. CVSS 7.5.\n\nnvd.nist.gov/vuln/detail/...\n\nIf your pooler tier quietly goes years between patches, we can help with that. \n\npgexperts.com", "creation_timestamp": "2026-05-26T22:36:01.637472Z"}, {"uuid": "0d0646aa-19d3-4ed0-9d3a-62892b1c797b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6664", "type": "seen", "source": "https://bsky.app/profile/pgexperts.bsky.social/post/3mms7m5dgey2r", "content": "PgBouncer 1.25.2 fixes four CVEs. Two of them (CVE-2026-6664 and CVE-2026-6665) are reachable pre-auth and crash the pooler from a single SCRAM packet.\n\nIf your pooler is behind an unfiltered LB, patch this week.\n\nwww.pgbouncer.org/2026/05/pgbo...\n\npgexperts.com", "creation_timestamp": "2026-05-27T00:07:11.647366Z"}, {"uuid": "dcd2a170-b972-4ad3-9a82-d5dafd6567fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66649", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtjeo5njyo2t", "content": "CVE-2026-66649 - directory pro\nThe Directory Pro add\u2011on for WordPress can be reached by anyone on the internet and may be made to run unexpected commands against the site\u2019s database. This could let an\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#directorypro #eplugins #CVE #infosec", "creation_timestamp": "2026-08-20T13:40:05.476438Z"}, {"uuid": "3209a715-8504-4f90-a1ff-fc868b105912", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66649", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mtjgapffbo2p", "content": "\ud83d\udea8 CVE-2026-66649 \u2014 CVSS 9.3 CRITICAL\n\nUnauthenticated SQL Injection in Directory Pro <= 2.5.8 versions.\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-66649\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-08-20T14:08:20.479288Z"}, {"uuid": "6223c99e-8fa8-45d5-8aa0-cf0fe282e42f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66648", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mtti3h5kqo23", "content": "\ud83d\udea8 CVE-2026-66648 \u2014 CVSS 9.8 CRITICAL\n\nUnauthenticated Privilege Escalation in Jawn <= 1.4.2 versions.\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-66648\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-08-24T14:07:48.890721Z"}, {"uuid": "6928e07b-aafe-46b0-a11b-485de6008a1a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66648", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/giyrj2vmymevx", "content": "CVE-2026-66648 - WordPress Jawn theme\nCVE ID : CVE-2026-66648\n \n Published : Aug. 24, 2026, 11:54 a.m. | 6\u00a0minutes ago\n \n Description : Unauthenticated Privilege Escalation in Jawn <= 1.4.2 versions.\n \n Severity: 9.8 | CRITICAL\n \n Visit the link for more details, such as CV...", "creation_timestamp": "2026-08-24T12:18:46.658888Z"}, {"uuid": "d6946a4e-4a63-41d0-9b32-948d2065ef3e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66648", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mttece2jp52e", "content": "CVE-2026-66648 - jawn\nThe Jawn theme for WordPress, in versions up to 1.4.2, can be used by anyone on the internet to take control of the site. An attacker could give themselves administrator privileges and\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#jawn #mvpthemes #CVE #infosec", "creation_timestamp": "2026-08-24T13:00:05.959421Z"}]}