MariaDB product

server

← All MariaDB products

No server CVE is in the CISA KEV catalogue.

Tracked since 7 Jun · latest article Wed 21 Oct · RSS

Open KEV deadlines: 0; None open
Added to KEV · 90 days: 0; of 0 all time
High exploit odds · current: 0; high · not in KEV
Articles · 7 days: 1; usual rate

Exploited, by due date

CSV download

No server CVE is in the CISA KEV catalogue.

Coverage

4 articles · all timeFull timeline →

4 articles from 1 outlet since 7 Jun; 1 in the last 7 days.

Article
First report

Show as table

server: articles
Published (UTC)	Outlet	Headline
Wed 21 Oct · 03:01 UTC	SecurityOnline	MariaDB fixes seven flaws, including a file access bug that could enable code execution
Mon 12 Oct · 13:13 UTC	SecurityOnline	MariaDB Fixes Nine Flaws That Could Enable Code Execution and Data Theft
Tue 23 Jun · 02:31 UTC	SecurityOnline	Critical MariaDB bugs let attackers run shell commands via Galera
Sun 7 Jun · 21:50 UTC	SecurityOnline	CVE-2026-49261 flaw in MariaDB lets attackers run remote code

See the full timeline

21 OctMariaDB fixes seven flaws, including a file access bug that could enable code executionSecurityOnline
12 OctMariaDB Fixes Nine Flaws That Could Enable Code Execution and Data TheftSecurityOnline
23 JunCritical MariaDB bugs let attackers run shell commands via GaleraSecurityOnline
7 JunCVE-2026-49261 flaw in MariaDB lets attackers run remote codeSecurityOnline

All CVEs in coverage

CVE-2026-49261MariaDB server has unsafe parameter handling in `wsrep_notify_cmd`CVSS10.0Critical–Not in KEV1.6%EPSS2articles

CVE-2026-48165MariaDB: unsafe usage of `wsrep_sst_receive_address` values on the joiner sideCVSS8.0High–Not in KEV1.5%EPSS2articles

CVE-2026-92262MariaDB: Numerous issues caused by historical #mysql50# tablename encoding bypass.CVSS9.9Critical–Not in KEV1.4%EPSS1article

CVE-2026-107815MariaDB: one byte OOB write in DOS tables of the CONNECT engineCVSS8.5High–Not in KEV1.4%EPSS1article

CVE-2026-107821MariaDB: insufficient validation of binary frm data when opening a tableCVSS8.0High–Not in KEV1.2%EPSS1article

CVE-2026-85746MariaDB: Out-of-bound buffer write on in `ST_AsText` of nested GeometryCollectionsCVSS9.9Critical–Not in KEV1.0%EPSS1article

CVE-2026-85748MariaDB: Use-after-free with a large number of SYS_REFCURSOR'sCVSS9.9Critical–Not in KEV0.9%EPSS1article

CVE-2026-48163MariaDB server vulnerabilityCVSS8.0High–Not in KEV0.9%EPSS2articles

CVE-2026-107823MariaDB: privilege escalation via incorrect view frm parsingCVSS7.2High–Not in KEV0.8%EPSS1article

CVE-2026-85745MariaDB: Out-of-bound buffer read on in `ST_Area` of a multipolygon.CVSS4.3Medium–Not in KEV0.5%EPSS1article

CVE-2026-107822MariaDB: database privilege escalation via user / role name collision in the acl cacheCVSS6.4Medium–Not in KEV0.5%EPSS1article

CVE-2026-107814MariaDB: Insecure $HOME in MariaDB rpm packagesCVSS8.4High–Not in KEV0.5%EPSS1article

1 more CVEs

CVE-2026-107818MariaDB: environment injection via wsrep bootstrap in the mariadb.service fileCVSS8.4High–Not in KEV0.3%EPSS1article

How these numbers are made

CISA KEV counts use the full catalogue, refreshed every 10 minutes. CVEs in coverage are those recorded by CyberSIXT. BOD 22-01 deadlines bind US federal civilian agencies.

CVEs with FIRST EPSS at or above the 95th percentile (top 5%), excluding CVEs in CISA KEV. EPSS estimates exploitation probability over the next 30 days.

Coverage is above its usual rate at three or more articles in 7 days and at least 2.5 times the weekly mean of the preceding 8 weeks.

Product names are grouped by normalised names, with version and edition tails removed.

Fix listed refers to an advisory. Unknown fix status is counted as not listed.

server

Exploited, by due date

Coverage

All CVEs in coverage

On this device

Intel

Settings

Keyboard shortcuts