349 matches found
ROS-20260724-73-0047
The vulnerability of the JOIN::fixallsplittingsinplan function in the MariaDB database management system is related to improper behavior. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...
ROOT-OS-DEBIAN-13-CVE-2026-44173 CVE-2026-44173 in rootio-mariadb - Patched by Root
Root has patched CVE-2026-44173 in the rootio-mariadb package for Root:Debian:13. Multiple fixed versions available...
mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysql_real_escape_string()
A flaw was found in MariaDB server. An application processing non-validated user input, which then uses mysqlrealescapestring and sends data to the database via text protocol with the big5 character set, is vulnerable to SQL injection. This allows a remote attacker to execute malicious SQL...
mariadb: MariaDB: Privilege bypass allows unauthorized file write via subqueries
A flaw was found in MariaDB server. This vulnerability allows a low-privileged authenticated user to bypass a security control that normally restricts file operations. Specifically, the system failed to verify the necessary 'FILE' privilege when certain 'SELECT' statements, which write data to...
CVE-2026-48165
A flaw was found in MariaDB server. A high-privileged MariaDB user could exploit this vulnerability by manipulating specific global system variables, namely wsrepsstreceiveaddress or wsrepsstdonor. This manipulation could allow the user to execute arbitrary shell commands as the user ID of the...
CVE-2026-44173
A flaw was found in MariaDB server. This vulnerability allows a low-privileged authenticated user to bypass a security control that normally restricts file operations. Specifically, the system failed to verify the necessary 'FILE' privilege when certain 'SELECT' statements, which write data to...
BIT-MYSQL-CLIENT-2026-48165 MariaDB: unsafe usage of `wsrep_sst_receive_address` values on the joiner side
MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, a high-privileged MariaDB user could've used wsrepsstreceiveaddress or wsrepsstdonor global system...
aida-tools (>=0.1.0 <=0.1.3), apache-airflow-providers-mariadb (=1.0.0) +66 more potentially affected by CVE-2026-44172 via mariadb (>=1.0.11 <=2.0.0rc2)
mariadb PYPI version =1.0.11, =0.1.0, =0.0.1, =0.6.0, =1.0.1, =0.3.1, =0.1.0, =0.1.0, =0.1.4, =1.1.8, =2.0.5, =0.0.3, =0.0.1, =1.1.0, =1.4.0 and more Source cves: CVE-2026-44172 Source advisory: OSV:PYSEC-2026-217...
ALPINE-CVE-2026-44171
MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, mbstream did not check for /../ in the path when unpacking the archive. A proper backup can never contai...
CVE-2026-48165 MariaDB: unsafe usage of `wsrep_sst_receive_address` values on the joiner side
MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, a high-privileged MariaDB user could've used wsrepsstreceiveaddress or wsrepsstdonor global system...
Medium: mariadb114
Issue Overview: Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to...
mariadb: MariaDB: Privilege bypass allows unauthorized file write via subqueries
A flaw was found in MariaDB server. This vulnerability allows a low-privileged authenticated user to bypass a security control that normally restricts file operations. Specifically, the system failed to verify the necessary 'FILE' privilege when certain 'SELECT' statements, which write data to...
ROS-20260524-73-0043
Vulnerability in mariadb related to security configuration errors. Exploitation of the vulnerability could allow an attacker to cause a denial of service...
Unity Linux 20.1070e Security Update: mariadb (UTSA-2026-021672)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-021672 advisory. getsortbytable in MariaDB before 10.6.2 allows an application crash via certain subquery uses of ORDER BY. Tenable has extracted the preceding description block...
Unity Linux 20.1070e Security Update: mariadb (UTSA-2026-021669)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-021669 advisory. MariaDB through 10.5.9 allows a sqlparse.cc application crash because of incorrect usedtables expectations. Tenable has extracted the preceding description block...
Unity Linux 20.1070e Security Update: mariadb (UTSA-2026-021663)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-021663 advisory. MariaDB through 10.5.9 allows attackers to trigger a convertconsttoint use-after-free when the BIGINT data type is used. Tenable has extracted the preceding...
Astra Linux – Vulnerability in Mariadb 10.3
MariaDB version 10.5.13 allows a hamaria::extra application to crash due to certain SELECT statements...
Astra Linux – Vulnerability in Mariadb 10.3
It has been discovered that MariaDB Server v10.7 and earlier contain a global buffer overflow in the decimalbinsize component, which can be exploited through specially crafted SQL statements...
Astra Linux – Vulnerability in Mariadb 10.3
A remote code execution issue was discovered in MariaDB 10.2 before 10.2.37, 10.3 before 10.3.28, 10.4 before 10.4.18, and 10.5 before 10.5.9; Percona Server up to 2021-03-03; and the wsrep patch up to 2021-03-03 for MySQL. An untrusted search path leads to eval injection, in which a database SUP...