mysql8.4 security, bug fix, and enhancement update

8.4.11-1 - Rebase to 8.4.11...

ALSA-2026:56007 Important: mysql8.4 security, bug fix, and enhancement update

MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon mysqld and many different client programs and libraries. The base package contains the standard MySQL client programs and generic MySQL files. Security Fixes: mysql:...

RHEL 10 : mysql8.4 (RHSA-2026:56007)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:56007 advisory. MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon mysqld an...

CVE-2026-64657 Budibase: Database Connector SQL Injections in PostgreSQL, MS SQL, and MySQL

Budibase is an open-source low-code platform. Prior to 3.39.19, the PostgreSQL datasource connector in packages/server/src/integrations/postgres.ts interpolates the user-controlled schema configuration field into a SET searchpath statement without escaping embedded double quotes, allowing an...

CVE-2026-64657 Budibase: Database Connector SQL Injections in PostgreSQL, MS SQL, and MySQL

Budibase is an open-source low-code platform. Prior to 3.39.19, the PostgreSQL datasource connector in packages/server/src/integrations/postgres.ts interpolates the user-controlled schema configuration field into a SET searchpath statement without escaping embedded double quotes, allowing an...

BIT-PROXYSQL-2026-48773 ProxySQL pre-auth heap overflow in MySQL and PostgreSQL first-packet handling

ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. Versions 2.0.18 through 3.0.8 have a pre-authentication heap memory corruption vulnerability in the MySQL and PostgreSQL protocol first-read paths. A remote unauthenticated client can declare an oversized first packet length, and...

GHSA-H84G-69H7-MW6V vulnerabilities

Vulnerabilities for packages: airbyte-platform, airbyte-platform-fips, hono, debezium, airbyte-server-fips...

EUVD-2026-58858

The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Second-Order SQL Injection via MultipleFiles Second-Order Payload via 'cgmultiplefilesforpost' - 'cgRealId' in all versions up to, and including, 30.0.7 due to insufficient escaping ...

GO-2026-4503 vulnerabilities

Vulnerabilities for packages: tailscale, kine, sops, tkn, openfga, sqlexporter, kots, fulcio, splunk-otel-collector, spicedb, mariadb-operator, wolfictl, dbmate, ksops, kubeflow-pipelines, trufflehog, gitsign, telegraf, age, grafana-alloy, rekor, caddy, amass, croc, juicefs,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: bom, cloud-sql-proxy, amazon-cloudwatch-agent-operator, envconsul, kapp, nri-f5, polaris, portieris, buildkitd, gptscript, kubeflow-katib, rabbitmq-cluster-operator, rclone, rabbitmq-messaging-topology-operator, ini-file, aws-otel-collector,...

CVE-2026-73408

Budibase is an open-source low-code platform. Prior to 3.39.18, packages/server/src/integrations/mysql.ts enabled multipleStatements and inserted an unescaped tableName into a DESCRIBE statement. An attacker able to create a MySQL table with a backtick and stacked statement in its name could wait...

CVE-2026-73408 Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector

Budibase is an open-source low-code platform. Prior to 3.39.18, packages/server/src/integrations/mysql.ts enabled multipleStatements and inserted an unescaped tableName into a DESCRIBE statement. An attacker able to create a MySQL table with a backtick and stacked statement in its name could wait...

CVE-2026-73408 Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector

Budibase is an open-source low-code platform. Prior to 3.39.18, packages/server/src/integrations/mysql.ts enabled multipleStatements and inserted an unescaped tableName into a DESCRIBE statement. An attacker able to create a MySQL table with a backtick and stacked statement in its name could wait...

CVE-2026-73408

Budibase (open-source low-code platform) is affected up to version 3.39.18 in the MySQL integration code path, specifically packages/server/src/integrations/mysql.ts where multipleStatements is enabled and an unescaped tableName is inserted into a DESCRIBE statement. An attacker able to create a ...

CVE-2019-25765

creationtimestamp| type| source ---|---|--- 2026-08-13 18:46:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/eio7hnpnmjbon 2026-08-14 14:00:30+00:00| exploited| https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/b6890fd9-837f-4a64-a1fa-c036ecba0806 2026-08-30...

PT-2026-71916

Budibase is an open-source low-code platform. Prior to 3.39.18, packages/server/src/integrations/mysql.ts enabled multipleStatements and inserted an unescaped tableName into a DESCRIBE statement. An attacker able to create a MySQL table with a backtick and stacked statement in its name could wait...

CVE-2026-73300

Budibase is an open-source low-code platform. Prior to 3.40.0, the MySQL integration component in Budibase is configured with multipleStatements: true, enabling execution of multiple SQL statements in a single query. Attackers can inject malicious SQL commands through user input fields, leading t...

CVE-2026-73300

CVE-2026-73300 affects Budibase (open-source low-code platform). The MySQL integration component before version 3.40.0 is configured with multipleStatements: true, enabling injection of multiple SQL statements via user input fields and potentially full database compromise. Mitigation: upgrade to ...

CVE-2026-73300 Budibase: SQL Injection via `multipleStatements: true`

Budibase is an open-source low-code platform. Prior to 3.40.0, the MySQL integration component in Budibase is configured with multipleStatements: true, enabling execution of multiple SQL statements in a single query. Attackers can inject malicious SQL commands through user input fields, leading t...

CVE-2026-73300 Budibase: SQL Injection via `multipleStatements: true`

Budibase is an open-source low-code platform. Prior to 3.40.0, the MySQL integration component in Budibase is configured with multipleStatements: true, enabling execution of multiple SQL statements in a single query. Attackers can inject malicious SQL commands through user input fields, leading t...