Vendor
MariaDB
- articles · all time
- 4+1 this week
- CVEs tracked · all time
- 13
- articles · since 11 Sep
- 2
4 articles from 1 outlet since 7 Jun; 1 in the last 7 days.
- Article
- First report
Show as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Wed 21 Oct · 03:01 UTC | SecurityOnline | MariaDB fixes seven flaws, including a file access bug that could enable code execution |
| Mon 12 Oct · 13:13 UTC | SecurityOnline | MariaDB Fixes Nine Flaws That Could Enable Code Execution and Data Theft |
| Tue 23 Jun · 02:31 UTC | SecurityOnline | Critical MariaDB bugs let attackers run shell commands via Galera |
| Sun 7 Jun · 21:50 UTC | SecurityOnline | CVE-2026-49261 flaw in MariaDB lets attackers run remote code |
Products: server
CVEs
13 CVEsCVE-2026-85748MariaDB: Use-after-free with a large number of SYS_REFCURSOR'sCVSS9.9Critical–Not in KEV0.9%EPSS1article
CVE-2026-85746MariaDB: Out-of-bound buffer write on in `ST_AsText` of nested GeometryCollectionsCVSS9.9Critical–Not in KEV1.0%EPSS1article
CVE-2026-92262MariaDB: Numerous issues caused by historical #mysql50# tablename encoding bypass.CVSS9.9Critical–Not in KEV1.4%EPSS1article
CVE-2026-85745MariaDB: Out-of-bound buffer read on in `ST_Area` of a multipolygon.CVSS4.3Medium–Not in KEV0.5%EPSS1article
CVE-2026-107815MariaDB: one byte OOB write in DOS tables of the CONNECT engineCVSS8.5High–Not in KEV1.4%EPSS1article
CVE-2026-107814MariaDB: Insecure $HOME in MariaDB rpm packagesCVSS8.4High–Not in KEV0.5%EPSS1article
CVE-2026-107818MariaDB: environment injection via wsrep bootstrap in the mariadb.service fileCVSS8.4High–Not in KEV0.3%EPSS1article
CVE-2026-107821MariaDB: insufficient validation of binary frm data when opening a tableCVSS8.0High–Not in KEV1.2%EPSS1article
CVE-2026-107823MariaDB: privilege escalation via incorrect view frm parsingCVSS7.2High–Not in KEV0.8%EPSS1article
CVE-2026-107822MariaDB: database privilege escalation via user / role name collision in the acl cacheCVSS6.4Medium–Not in KEV0.5%EPSS1article
CVE-2026-49261MariaDB server has unsafe parameter handling in `wsrep_notify_cmd`CVSS10.0Critical–Not in KEV1.6%EPSS2articles
1 more CVE
CVE-2026-48165MariaDB: unsafe usage of `wsrep_sst_receive_address` values on the joiner sideCVSS8.0High–Not in KEV1.5%EPSS2articles
- MariaDB fixes seven flaws, including a file access bug that could enable code executionSecurityOnline
- MariaDB Fixes Nine Flaws That Could Enable Code Execution and Data TheftSecurityOnline
- Critical MariaDB bugs let attackers run shell commands via GaleraSecurityOnline
- CVE-2026-49261 flaw in MariaDB lets attackers run remote codeSecurityOnline · first in our coverage