{"vulnerability": "cve-2026-6690", "sightings": [{"uuid": "e69c69bf-3db7-464e-9e23-c8d118c1b6d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66901", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3iwqm2chk7oin", "content": "CVE-2026-66901: Google::Auth versions before 0.09 for Perl allow server side request forgery and credential exfiltration via unvalidated URLs taken from the credentials JSON", "creation_timestamp": "2026-08-04T21:22:42.073075Z"}, {"uuid": "a75577f0-adb0-410d-88e1-58979d56f20d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66902", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/5jerlnuteddya", "content": "CVE-2026-66902: Google::Auth versions before 0.06 for Perl run a command named in an external_account credentials JSON via an ungated system call", "creation_timestamp": "2026-08-04T21:24:40.549711Z"}, {"uuid": "bddb5e50-c557-4d16-a6ca-fa270c20fc8c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6690", "type": "seen", "source": "https://bsky.app/profile/atomicedge.bsky.social/post/3mlx7yjc64q2l", "content": "CVE-2026-6690 lifepress (CVSS Score 7.2) #WordPress plugin #vulnerability #cybersecurity #wordpressfirewall #wordpresssecurity #hacking #wpsecurity #atomicedge", "creation_timestamp": "2026-05-16T06:32:06.397881Z"}, {"uuid": "1cae0345-ca76-4ad6-9464-e28308c52781", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6690", "type": "seen", "source": "https://bsky.app/profile/potato.software/post/3mlx7yjq5xq27", "content": "CVE-2026-6690 lifepress (CVSS Score 7.2) #WordPress plugin #vulnerability #potatosecurity #wordpressfirewall #wordpresssecurity #mashing #wpsecurity #atomicedge", "creation_timestamp": "2026-05-16T06:32:07.191042Z"}, {"uuid": "19b35a58-0ddd-46f5-b930-2ca6665f1955", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66902", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3msedshg2v22h", "content": "CVE-2026-66902 - google::auth\nVersions of Google::Auth for Perl before 0.06 allow an attacker to run arbitrary system commands with the same privileges as the application. This is a concern if you're\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#googleauth #cjcollier #CVE #infosec", "creation_timestamp": "2026-08-05T20:16:04.490408Z"}, {"uuid": "10d7817f-18aa-4459-ad28-62a4f931c724", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66902", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3msg2dnb4oa2u", "content": "CVE-2026-66902\nOld versions of Google::Auth for Perl can run any command from a configuration file, which can be a security risk if the configuration file is controlled by an attacker. This means an attacker could potentially\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-08-06T12:32:03.670068Z"}, {"uuid": "451dcf86-53e3-4c9b-af15-933a44a466bd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66909", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3msgf6ln3fh2l", "content": "CVE-2026-66909 - apache cxf\nApache CXF's JMS transport can be tricked into running malicious code. This can cause a server crash or allow an attacker to take control of the server. To fix this,\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#apachecxf #apachefoundation #CVE #infosec", "creation_timestamp": "2026-08-06T15:46:04.998938Z"}, {"uuid": "d890cc29-013f-4e6b-85e9-1eea3ed26c9e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66909", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/5h65hmmkj3bok", "content": "CVE-2026-66909: Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage", "creation_timestamp": "2026-08-06T20:45:57.930517Z"}, {"uuid": "4de8c4e5-634c-4077-9409-5ebdb27da7bc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66909", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mshqbc63ne2r", "content": "\ud83d\udccc CVE-2026-66909 - Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage\u00a0using native Java deserialization, with no type restrictions in plac... https://www.cyberhub.blog/cves/CVE-2026-66909", "creation_timestamp": "2026-08-07T04:37:07.104182Z"}, {"uuid": "6069eb38-fc2b-4e28-b146-753df0246e90", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66907", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/b3t23arm45stm", "content": "CVE-2026-66907: Apache Camel: Camel-Google-Storage: the consumer appended the remote object name to the configured downloadFileName directory without constraining the result", "creation_timestamp": "2026-08-24T18:16:25.909147Z"}, {"uuid": "2e05b456-6be3-47d3-afab-013a397b14fe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66908", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/b4ptz5cw32ay2", "content": "CVE-2026-66908: Apache Camel: Camel-platform-http-main: when JWT authentication was configured with a keystore but no issuer or audience, the iss and aud claims were never validated, so any unexpired token signed by a trusted key was accepted", "creation_timestamp": "2026-08-24T18:22:28.901151Z"}, {"uuid": "9c03e5bd-fe95-4b30-b6d7-7fa1ceb960b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66907", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/i3jusx6tr2icc", "content": "CVE-2026-66907 - Apache Camel: Camel-Google-Storage: the consumer appended the remote object name to the configured downloadFileName directory without constraining the result\nCVE ID : CVE-2026-66907\n \n Published : Aug. 24, 2026, 5:18 p.m. | 45\u00a0minutes ago\n \n Description : Rela...", "creation_timestamp": "2026-08-24T18:29:25.195164Z"}, {"uuid": "7cb9bd41-e506-43ac-921e-8f8d82b73b8e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66906", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtwnvvtamb24", "content": "CVE-2026-66906 - apache camel\nThe Azure Storage Blob feature in Apache Camel can save downloaded files to any location if a blob\u2019s name includes path tricks. This could let an attacker place or\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#apachecamel #apachefoundation #CVE #infosec", "creation_timestamp": "2026-08-25T20:30:04.854364Z"}, {"uuid": "185df1c0-3f1d-4430-a986-9ce633469c3e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66908", "type": "seen", "source": "Telegram/_8ioC0-GS3hqaK0vZF92ZaP06wwac1xjhQxJkXlFfEhMVG4", "content": "", "creation_timestamp": "2026-08-24T21:00:03.994222Z"}, {"uuid": "c3295a54-18c5-463c-98e0-296307882ac6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66906", "type": "seen", "source": "Telegram/_8ioC0-GS3hqaK0vZF92ZaP06wwac1xjhQxJkXlFfEhMVG4", "content": "", "creation_timestamp": "2026-08-24T21:00:04.213073Z"}, {"uuid": "ff019e73-1c82-4082-8993-0bd0bca3cfbe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66907", "type": "seen", "source": "Telegram/_8ioC0-GS3hqaK0vZF92ZaP06wwac1xjhQxJkXlFfEhMVG4", "content": "", "creation_timestamp": "2026-08-24T21:00:04.284966Z"}, {"uuid": "737bb10d-05cd-4118-9832-e4098f6d5171", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66906", "type": "published-proof-of-concept", "source": "Telegram/_8ioC0-GS3hqaK0vZF92ZaP06wwac1xjhQxJkXlFfEhMVG4", "content": "", "creation_timestamp": "2026-08-25T00:00:09.860993Z"}, {"uuid": "8a9c5d2b-9f5f-4799-ba3f-a90ecc64b29c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66907", "type": "published-proof-of-concept", "source": "Telegram/_8ioC0-GS3hqaK0vZF92ZaP06wwac1xjhQxJkXlFfEhMVG4", "content": "", "creation_timestamp": "2026-08-25T00:00:09.954047Z"}, {"uuid": "2f41ec40-e188-4f36-935a-1c680d83083a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66908", "type": "published-proof-of-concept", "source": "Telegram/_8ioC0-GS3hqaK0vZF92ZaP06wwac1xjhQxJkXlFfEhMVG4", "content": "", "creation_timestamp": "2026-08-25T00:00:10.097683Z"}]}