Login Request a demo
PG
Product
Pgbouncer
by Pgbouncer · last CVE May 9, 2026
10
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities10In the news0Timeline
Severity mix
Critical 2High 6Medium 2Low 0
Severity
All severities10Critical2High6Medium2Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Pgbouncer to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2025-12819
8.1
0%
Dec 3
Untrusted search path in auth_query connection in PgBouncer
Affected: before 1.25.1
CVE-2021-3935
8.1
1%
Nov 22
When PgBouncer is configured to use "cert" authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of…
Affected: before 1.16.1
CVE-2015-6817
8.1
2%
May 23
PgBouncer 1.6.x before 1.6.1, when configured with auth_user, allows remote attackers to gain login access as auth_user via an unknown username
Affected: 1.6
CVE-2026-6666
7.5
0%
May 9
PgBouncer crash in kill_pool_logins_server_error
Affected: before 1.25.2
CVE-2026-6664
7.5
1%
May 9
PgBouncer integer overflow in PgBouncer network packet parsing
Affected: before 1.25.2
CVE-2015-4054
7.5
4%
May 23
PgBouncer before 1.5.5 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) by sending a password packet before a startup packet
Affected: through 1.5.4
Showing 6