Amazon Linux 2023 : mariadb123, mariadb123-backup, mariadb123-client-utils (ALAS2023-2026-3201)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3201 advisory. Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Replication. Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL...

melee

MELEE: Una herramienta para detectar infecciones de ransomware en instancias MySQL Los atacantes están abusando de las instancias MySQL para llevar a cabo operaciones nefastas en Internet. Los ciberdelincuentes están apuntando a instancias MySQL expuestas y desencadenando infecciones a gran escal...

csaf

Il Cyber Security Awareness Framework CSAF è un approccio strutturato volto a migliorare la consapevolezza e la comprensione della sicurezza informatica tra individui, organizzazioni e comunità. Fornisce indicazioni per lo sviluppo di programmi efficaci di sensibilizzazione alla sicurezza...

CVE-2026-107822

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. ...

UBUNTU-CVE-2026-107814

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege...

CVE-2026-107814

MariaDB server RPM packages (versions 10.6.1 to 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2) are vulnerable due to the mysql service account being created with the database data directory as its home directory. A database user possessing the FILE privilege can write startup dot-files, ...

CVE-2026-107814 MariaDB: Insecure $HOME in MariaDB rpm packages

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege...

chef-mysql-hardening

mysql-hardening Chef cookbook Descrizione Fornisce configurazioni di sicurezza per mysql. È pensato per configurare istanze mysql pronte per la produzione, configurate con una superficie minima per gli attaccanti. Questo cookbook si concentra sulla configurazione di sicurezza di mysql e riutilizz...

PT-2026-108973

Name of the Vulnerable Software and Affected Versions MariaDB versions 10.6.1 through 10.6.27 MariaDB version 10.11.18 and earlier MariaDB version 11.4.12 and earlier MariaDB version 11.8.8 and earlier MariaDB version 12.3.2 and earlier MariaDB version 13.0.1 and earlier Description In RPM...

PT-2026-109269

Name of the Vulnerable Software and Affected Versions MariaDB server versions 10.6.1 through 10.6.27 MariaDB server version 10.11.18 and earlier MariaDB server version 11.4.12 and earlier MariaDB server version 11.8.8 and earlier MariaDB server version 12.3.2 and earlier MariaDB server version...

@aliceo2/bookkeeping (>=0.27.0, <=1.20.0), @azteam/mysql-model (>=1.0.70, <=1.0.158) +62 more potentially affected by CVE-2026-107383 via mariadb (>=3.0.0, <=3.2.3)

mariadb NPM version =3.0.0, =0.27.0, =1.0.70, =2.0.0, =0.0.1, =1.0.0-alpha.0, =0.0.6, =1.1.0, =1.1.1, =1.1.2 - @keystone-6-master/example-assets-cloud 0.0.2 - @keystone-6-master/example-assets-local 0.0.2 - @keystone-6-master/example-auth 0.0.3 - @keystone-6-master/example-blog 0.0.2 -...

dovecot: Dovecot: MySQL multi-byte escaping wrong

A flaw was found in Dovecot. A remote attacker with high attack complexity could exploit this vulnerability to gain access to sensitive information and modify data without requiring any user interaction or privileges...

Wireshark 1.8.x < 1.8.7 Multiple Vulnerabilities (macOS)

The version of Wireshark installed on the remote macOS / Mac OS X host is prior to 1.8.7. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-1.8.7 advisory. - Multiple integer signedness errors in the tvbunmasked function in epan/dissectors/packet-websocket.c in...

dovecot: Dovecot: MySQL multi-byte escaping wrong

A flaw was found in Dovecot. A remote attacker with high attack complexity could exploit this vulnerability to gain access to sensitive information and modify data without requiring any user interaction or privileges...

[SECURITY] Fedora 45 Update: ocaml-mysql-1.2.4-24.fc45

ocaml-mysql is a package for ocaml that provides access to mysql databases. It consists of low level functions implemented in C and a module Mysql intended for application development...

PT-2026-106712

A vulnerability has been found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. Impacted is the function mysql error of the file login.php of the component Login Endpoint. The manipulation of the argument username/password leads to sql injection. The atta...

Linux Distros Unpatched Vulnerability : CVE-2026-59783

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Zabbix Server/Proxy has a vulnerability where binary items can crash the Server/Proxy on certain NULL byte input leading to potential loss of availability...

0perator (>=0.1.0, <=0.3.0), 0pflow (>=0.1.0-dev.00aaa03, <=0.1.0) +2970 more potentially affected by CVE-2026-104872 via @opentelemetry/instrumentation-mysql (>=0.15.0, <=0.66.0)

@opentelemetry/instrumentation-mysql NPM version =0.15.0, =0.1.0, =0.1.0-dev.00aaa03, =0.0.1, =3.11.1, =0.0.53, =0.0.31, =0.8.0, =0.1.0, =1.0.5, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.3.702, =0.0.65, =0.2.0, =0.2.0, =0.2.6 and more Source cves: CVE-2026-104872 Source advisory...

0perator (>=0.1.0, <=0.3.0), 0pflow (>=0.1.0-dev.00aaa03, <=0.1.0) +2970 more potentially affected by CVE-2026-104872 via @opentelemetry/instrumentation-mysql (>=0.15.0, <=0.66.0)

@opentelemetry/instrumentation-mysql NPM version =0.15.0, =0.1.0, =0.1.0-dev.00aaa03, =0.0.1, =3.11.1, =0.0.53, =0.0.31, =0.8.0, =0.1.0, =1.0.5, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.3.702, =0.0.65, =0.2.0, =0.2.0, =0.2.6 and more Source cves: CVE-2026-104872 Source advisory...

Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute

Impact Multiple @opentelemetry/instrumentation- packages recorded the database connection username as the db.user span attribute on every instrumented database operation. This attribute was emitted unconditionally — it was not gated by enhancedDatabaseReporting or any other opt-in flag, and it wa...