{"metadata": {"vulnerability": "CVE-2026-6460", "count": 25, "kinds": {"milestone": 4, "sighting": 13, "kev": 0, "other": 8}, "linked_omitted": 0}, "data": [{"timestamp": "2026-04-17T00:15:46.725Z", "date_only": false, "value": "2026-04-17T00:15:46.725Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-6460", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-12T14:15:32.415Z", "date_only": false, "value": "2026-11-12T14:15:32.415Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-6460", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-12T14:15:32.415Z", "date_only": false, "value": "2026-11-12T14:15:32.415Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / PostgreSQL", "record": "CVE-2026-6460", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-12T14:59:17.725Z", "date_only": false, "value": "2026-11-12T14:59:17.725728Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117604060830300256", "record": "CVE-2026-6460", "field": "creation_timestamp", "uuid": "babf8505-c46e-4aef-bf05-241f83d6bc77", "content": "CVE-2026-6460 PostgreSQL type confusion after ALTER ... SET DATA TYPE executes arbitrary code Type confusion in PostgreSQL allows an object creator to execute arbitrary code as the operating system user running the database, via ALTER ... SET DATA TYPE primarily.  Other DDL attack routes exist, such as \"ALTER TABLE ... ADD COLUMN; ROLLBACK; ALTER TABLE ... ADD COLUMN\".  The system had inadequate tracking of typed values, and values were not self-identifying.  Stale values could appear in data dictionary entries, PL/pgSQL variables, and many other parts of the system.  PostgreSQL Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.\nhttps://www.cve.org/CVERecord?id=CVE-2026-6460https://www.postgresql.org/support/security/CVE-2026-6460/#postgresql#CVE_2026_6460#bot", "url": "https://infosec.exchange/users/cve/statuses/117604060830300256"}, {"timestamp": "2026-11-12T15:00:56.240Z", "date_only": false, "value": "2026-11-12T15:00:56.240581Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/planet.postgresql.org/post/3n24qe35tba2h", "record": "CVE-2026-6460", "field": "creation_timestamp", "uuid": "f9e7fed2-c3ed-4673-93b0-82b341668c93", "content": "Mehmet Ince: Part 3/6 | How I Ended Up Turning a 22-Year-Old PostgreSQL Type-Confusion Primitive into RCE (CVE-2026-6460)\n\nhttps://postgr.es/p/9BE\n\n#postgresql", "url": "https://bsky.app/profile/planet.postgresql.org/post/3n24qe35tba2h"}, {"timestamp": "2026-11-12T15:17:51Z", "date_only": false, "value": "2026-11-12T15:17:51Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-7M3P-Q8W8-4QGH", "record": "GHSA-7M3P-Q8W8-4QGH", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-12T15:17:51.597Z", "date_only": false, "value": "2026-11-12T15:17:51.597", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-6460", "record": "FKIE_CVE-2026-6460", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-12T15:32:01Z", "date_only": false, "value": "2026-11-12T15:32:01Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-7M3P-Q8W8-4QGH", "record": "GHSA-7M3P-Q8W8-4QGH", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-12T15:32:02Z", "date_only": false, "value": "2026-11-12T15:32:02Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-7M3P-Q8W8-4QGH", "record": "GHSA-7M3P-Q8W8-4QGH", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-12T15:53:50.862Z", "date_only": false, "value": "2026-11-12T15:53:50.862930Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/exmfk7vv7poco", "record": "CVE-2026-6460", "field": "creation_timestamp", "uuid": "513f3358-b92d-456a-a346-c9a1263472b6", "content": "CVE-2026-6460 - PostgreSQL type confusion after ALTER ... SET DATA TYPE executes arbitrary code\nCVE ID : CVE-2026-6460\n \n Published : Nov. 12, 2026, 2:15 p.m. | 1\u00a0hour, 1\u00a0minute ago\n \n Description : Type confusion in PostgreSQL allows an object creator to execute arbitrary cod...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/exmfk7vv7poco"}, {"timestamp": "2026-11-12T16:02:30.927Z", "date_only": false, "value": "2026-11-12T16:02:30.927535Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3n24ts6hfja2y", "record": "CVE-2026-6460", "field": "creation_timestamp", "uuid": "d194947b-3297-4a93-9350-17a10e4dfbed", "content": "\ud83d\udfe0 CVE-2026-6460 - High (8.8)\n\nType confusion in PostgreSQL allows an object creator to execute arbitrary code as the operating ...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-6460/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3n24ts6hfja2y"}, {"timestamp": "2026-11-12T17:39:31.953Z", "date_only": false, "value": "2026-11-12T17:39:31.953646Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/r-netsec.bsky.social/post/3n24z7obpaj2l", "record": "CVE-2026-6460", "field": "creation_timestamp", "uuid": "483aafac-4c1d-451d-9991-e777861cf8db", "content": "prepared statements prevents SQLi. But it also helped me to exploit a 22 years old PostgreSQL 0-day RCE (CVE-2026-6460)", "url": "https://bsky.app/profile/r-netsec.bsky.social/post/3n24z7obpaj2l"}, {"timestamp": "2026-11-12T19:10:34.523Z", "date_only": false, "value": "2026-11-12T19:10:34.523582Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hnbot.gsuscs.xyz/post/3n256cen4ds2w", "record": "cve-2026-6460", "field": "creation_timestamp", "uuid": "e3e14c4e-8a9d-4c9b-9e8a-93f14f17d103", "content": "22-Year-Old PostgreSQL Bug Turned into Remote Code Execution\n\nhttps://mehmetince.net/part-3-6-how-i-ended-up-turning-a-22-year-old-postgresql-type-confusion-primitive-into-rce-cve-2026-6460/", "url": "https://bsky.app/profile/hnbot.gsuscs.xyz/post/3n256cen4ds2w"}, {"timestamp": "2026-11-12T19:50:21.720Z", "date_only": false, "value": "2026-11-12T19:50:21.720944Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/betterhn20.e-work.xyz/post/3n25ajlmubd2v", "record": "cve-2026-6460", "field": "creation_timestamp", "uuid": "a3ac5e35-d2be-4886-af27-8231d6462ed6", "content": "22-Year-Old PostgreSQL Bug Turned into Remote Code Execution https://mehmetince.net/part-3-6-how-i-ended-up-turning-a-22-year-old-postgresql-type-confusion-primitive-into-rce-cve-2026-6460/ (https://news.ycombinator.com/item?id=50471761)", "url": "https://bsky.app/profile/betterhn20.e-work.xyz/post/3n25ajlmubd2v"}, {"timestamp": "2026-11-12T19:54:32.144Z", "date_only": false, "value": "2026-11-12T19:54:32.144109Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/r-redteamsec.bsky.social/post/3n25ar2vmtq25", "record": "CVE-2026-6460", "field": "creation_timestamp", "uuid": "e50e5840-b747-4842-b649-53cfe0d37135", "content": "exploit a 22 years old PostgreSQL composite-type vulnerability CVE-2026-6460", "url": "https://bsky.app/profile/r-redteamsec.bsky.social/post/3n25ar2vmtq25"}, {"timestamp": "2026-11-12T21:09:23.837Z", "date_only": false, "value": "2026-11-12T21:09:23.837823Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-6460", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-11-12T21:09:23.837Z", "date_only": false, "value": "2026-11-12T21:09:23.837823Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-6460", "record": "FKIE_CVE-2026-6460", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-11-12T21:41:16.474Z", "date_only": false, "value": "2026-11-12T21:41:16.474Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-6460", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-12T21:41:16.474Z", "date_only": false, "value": "2026-11-12T21:41:16.474Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-6460", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-12T22:19:23.417Z", "date_only": false, "value": "2026-11-12T22:19:23.417", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-6460", "record": "FKIE_CVE-2026-6460", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-11-12T22:45:15.770Z", "date_only": false, "value": "2026-11-12T22:45:15.770632Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hn100.atproto.rocks/post/3n25kcdud3e24", "record": "cve-2026-6460", "field": "creation_timestamp", "uuid": "3e58c18c-6564-4046-8e42-906a83e7ae25", "content": "22-Year-Old PostgreSQL Bug Turned into Remote Code Execution\nhttps://mehmetince.net/part-3-6-how-i-ended-up-turning-a-22-year-old-postgresql-type-confusion-primitive-into-rce-cve-2026-6460/\n\nhttps://news.ycombinator.com/item?id=50471761", "url": "https://bsky.app/profile/hn100.atproto.rocks/post/3n25kcdud3e24"}, {"timestamp": "2026-11-12T23:05:48.846Z", "date_only": false, "value": "2026-11-12T23:05:48.846399Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/axnews.bsky.social/post/3n25lh45nli24", "record": "CVE-2026-6460", "field": "creation_timestamp", "uuid": "a7dbf197-88ce-49d1-a529-d8e40bd518be", "content": "\ud83d\udea8 Breaking: CVE-2026-6460 \u2014 High 8.8\nImpacted if: PostgreSQL < 18.7 \u00b7 < 17.12 \u00b7 < 16.16 +2\nType confusion \u00b7 over the network \u00b7 any logged-in user\nhttps://ax-news.com/cve/CVE-2026-6460\n#CVE #infosec", "url": "https://bsky.app/profile/axnews.bsky.social/post/3n25lh45nli24"}, {"timestamp": "2026-11-12T23:45:46.024Z", "date_only": false, "value": "2026-11-12T23:45:46.024157Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/winsontang.com/post/3n25nojs55q2g", "record": "cve-2026-6460", "field": "creation_timestamp", "uuid": "58f72538-a2d1-43c4-bd27-7bdf40b88f3b", "content": "A 22-year-old bug in PostgreSQL has been transformed into a serious remote code execution vulnerability. This highlights the importance of ongoing security assessments,\u2026\n\nhttps://mehmetince.net/part-3-6-how-i-ended-up-turning-a-22-year-old-postgresql-type-confusion-primitive-into-rce-cve-2026-6460/", "url": "https://bsky.app/profile/winsontang.com/post/3n25nojs55q2g"}, {"timestamp": "2026-11-13T00:00:52.815Z", "date_only": false, "value": "2026-11-13T00:00:52.815950Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/planet.postgresql.org/post/3n25ojkzve42z", "record": "CVE-2026-6460", "field": "creation_timestamp", "uuid": "e49d0eae-810d-499b-96f2-4f3b80c9b9f0", "content": "Lukas Fittl: Postgres 18.7 Security Release: The Impact of CVE-2026-6460 & other memory corruption issues\n\nhttps://postgr.es/p/9BJ\n\n#postgresql", "url": "https://bsky.app/profile/planet.postgresql.org/post/3n25ojkzve42z"}, {"timestamp": "2026-11-13T00:30:46.192Z", "date_only": false, "value": "2026-11-13T00:30:46.192348Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/news.karthihegde.dev/post/3n25q6zistk2j", "record": "CVE-2026-6460", "field": "creation_timestamp", "uuid": "a66a9ce0-ebba-4a79-bfce-5983ad7d04a3", "content": "Lukas Fittl: Postgres 18.7 Security Release: The Impact of CVE-2026-6460 & other memory corruption issues\ntech_blogs_planetscale\n\n#SecurityResearch", "url": "https://bsky.app/profile/news.karthihegde.dev/post/3n25q6zistk2j"}], "metrics": {"as_of": "2026-11-13T01:24:12.916Z", "anchors": {"origin": {"timestamp": "2026-11-12T14:15:32.415Z", "date_only": false, "value": "2026-11-12T14:15:32.415Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-6460", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-12T14:15:32.415Z", "date_only": false, "value": "2026-11-12T14:15:32.415Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-6460", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 40120.501146, "hours": 11.144583651666668, "days": 0.4643576521527778, "min_seconds": 40120.501146, "max_seconds": 40120.501146, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-12T14:15:32.415Z", "date_only": false, "value": "2026-11-12T14:15:32.415Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-6460", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-13T01:24:12.916Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}