Skip to content

Mariadb · weakness class

SQL Injection

9 CVEs

Every dot is a CVE in what this vendor ships; the named ones are the most at risk.

Every one of the 9 is a mark on the map. Named now: 1 to 9, most at risk first.

  1. An issue in the component Create_tmp_table::finalize of MariaDB Server v10.7 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted S…CVE-2022-27378Mariadb · 2.4% likely

    CWE-89

  2. MariaDB Server v10.7 and below was discovered to contain a segmentation fault via the component sql/sql_class.cc.CVE-2022-27386Mariadb · 2.3% likely

    CWE-89

  3. An issue in the component my_decimal::operator= of MariaDB Server v10.6.3 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL…CVE-2022-27380Mariadb · 2.3% likely

    CWE-89

  4. An issue in the component Arg_comparator::compare_real_fixed of MariaDB Server v10.6.2 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially…CVE-2022-27379Mariadb · 2.3% likely

    CWE-89

  5. An issue in the component Item_subselect::init_expr_cache_tracker of MariaDB Server v10.6 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specia…CVE-2022-27384Mariadb · 2.2% likely

    CWE-89

  6. An issue in the component Field::set_default of MariaDB Server v10.6 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL state…CVE-2022-27381Mariadb · 2.2% likely

    CWE-89

  7. An issue in the component Used_tables_and_const_cache::used_tables_and_const_cache_join of MariaDB Server v10.7 and below was discovered to allow attackers to cause a Denial of Se…CVE-2022-27385Mariadb · 1.7% likely

    CWE-89

  8. MariaDB: mysql_real_escape_string() incorrectly handled big5CVE-2026-44172MariaDB · CVSS 9.1 · 1.0% likely

    CWE-89

  9. MariaDB: Insufficient quoting in mariadb-dump and SHOW commandsCVE-2026-86047MariaDB · CVSS 7.7 · 0.9% likely

    CWE-89

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.