CVE-2026-3494

In MariaDB server version through 11.8.5, when server audit plugin is enabled with serverauditevents variable configured with QUERYDCL, QUERYDDL, or QUERYDML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen — or hash style comments, the statement is...

CVE-2026-3494 MariaDB Server Audit Plugin Comment Handling Bypass

In MariaDB server version through 11.8.5, when server audit plugin is enabled with serverauditevents variable configured with QUERYDCL, QUERYDDL, or QUERYDML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen — or hash style comments, the statement is...

PT-2026-22790

Name of the Vulnerable Software and Affected Versions MariaDB versions through 11.8.5 Description When the server audit plugin is enabled with the server audit events variable configured with QUERY DCL, QUERY DDL, or QUERY DML filtering, SQL statements prefixed with double-hyphen — or hash style...

MCP MariaDB Server 安全漏洞

MCP MariaDB Server is a server implementation of the MariaDB open-source large language model context protocol. Versions of MCP MariaDB Server 11.8.5 and earlier contain security vulnerabilities. These vulnerabilities arise when the server audit plugin is enabled and specific filtering events are...

GHSA-FW7P-63QQ-7HPR vulnerabilities

Vulnerabilities for packages: sftpgo, trillian, dbmate, sftpgo-plugin-eventstore, step, mattermost, envoy-gateway, kine, ratify, dgraph, loki, splunk-otel-collector, apko, kots, nri-mysql, fulcio, gitea, aactl, tkn, caddy, dex, mariadb-operator, amass, spicedb, age, witness, sqlexporter, tailscal...

OESA-2026-1383 mariadb security update

MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is a client/server implementation consisting of a server daemon mariadbd and many different client programs and libraries. The base package contains the standard MariaDB/MySQL client programs a...

SQL_ARES_LZL

SQL ARES LZL - Suite de Inyección SQL Avanzada ARES LZL...

MariaDB 10.6.0 < 10.6.24

The version of MariaDB installed on the remote host is prior to 10.6.24. It is, therefore, affected by a vulnerability as referenced in the 10.6.24 advisory. - Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are...

MariaDB 10.11.0 < 10.11.15

The version of MariaDB installed on the remote host is prior to 10.11.15. It is, therefore, affected by a vulnerability as referenced in the 10.11.15 advisory. - Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are...

MariaDB 12.1.0 < 12.1.2

The version of MariaDB installed on the remote host is prior to 12.1.2. It is, therefore, affected by a vulnerability as referenced in the 12.1.2 advisory. - Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are...

MariaDB 11.4.0 < 11.4.9

The version of MariaDB installed on the remote host is prior to 11.4.9. It is, therefore, affected by a vulnerability as referenced in the 11.4.9 advisory. - Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are...

MariaDB 11.8.0 < 11.8.4

The version of MariaDB installed on the remote host is prior to 11.8.4. It is, therefore, affected by a vulnerability as referenced in the 11.8.4 advisory. - Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are...

CVE-2026-25518 vulnerabilities

Vulnerabilities for packages: cert-manager-webhook-pdns, cert-manager-csi-driver, cert-manager-google-cas-issuer-fips, cert-manager-openshift-routes-fips, cert-manager-cmctl, aws-privateca-issuer-fips, mariadb-operator-fips, percona-xtradb-cluster-operator, cert-manager-istio-csr-fips,...

CVE-2026-25518 vulnerabilities

Vulnerabilities for packages: percona-server-mongodb-operator, step-issuer, cert-manager-cmctl, aws-privateca-issuer, cert-manager-webhook-pdns, cert-manager-istio-csr, cert-manager-csi-driver, mariadb-operator, opentelemetry-operator...

GHSA-GX3X-VQ4P-MHHV vulnerabilities

Vulnerabilities for packages: percona-server-mongodb-operator, step-issuer, cert-manager-cmctl, aws-privateca-issuer, cert-manager-webhook-pdns, cert-manager-istio-csr, cert-manager-csi-driver, mariadb-operator, opentelemetry-operator...

GHSA-GX3X-VQ4P-MHHV vulnerabilities

Vulnerabilities for packages: cert-manager-webhook-pdns, cert-manager-csi-driver, cert-manager-google-cas-issuer-fips, cert-manager-openshift-routes-fips, cert-manager-cmctl, aws-privateca-issuer-fips, mariadb-operator-fips, percona-xtradb-cluster-operator, cert-manager-istio-csr-fips,...

ROS-20260129-73-0058

Vulnerability in mariadb11.8 related to incorrect path name restriction to a restricted directory. Exploitation of the vulnerability may allow a remote attacker to gain unauthorized access to protected information...

ROS-20260129-73-0057

Vulnerability in mariadb11.4 related to incorrect path name restriction to a restricted directory. Exploitation of the vulnerability may allow a remote attacker to gain unauthorized access to protected information...

ROS-20260129-73-0055

Vulnerability in mariadb related to incorrect path name restriction to a restricted directory. Exploitation of the vulnerability may allow a remote attacker to gain unauthorized access to protected information...

Oracle Linux 7 : mariadb (ELSA-2026-0367)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-0367 advisory. - Fixes CVE-2025-13699, remote code execution via improper path validation Orabug: 38829265 Tenable has extracted the preceding description block directly from...