Where
AND
-Infinity
0

Trending

Last week
Last month
Last year

MariaDB MariaDB ServerMariaDB server has unsafe parameter handling in `wsrep_notify_cmd`

Risk 87
Severity
10
OS Command Injection
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Last updated 11 July 2026

1 / 2
Source: Ubuntu
First published (updated )
CVE-2026-49261

MariaDB MariaDB ServerMariaDB: unsafe usage of `wsrep_sst_receive_address` values on the joiner side

Risk 72
Severity
9.1
OS Command Injection
AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Last updated 12 July 2026

1 / 2
Source: Ubuntu
First published (updated )
CVE-2026-48165

MariaDB MariaDB ServerMariaDB: wsrep SST unsafe parameter handling on the donor side (rsync)

Risk 72
Severity
9.1
OS Command Injection
AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Last updated 11 July 2026

1 / 2
Source: Ubuntu
First published (updated )
CVE-2026-48163

MariaDB MariaDB ServerMariaDB: FILE privilege was not checked for subqueries in the FROM clause

Risk 60
Severity
8.1
AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L

Last updated 11 July 2026

1 / 2
Source: Ubuntu
First published (updated )
CVE-2026-44173

MariaDB MariaDB ServerMariaDB: wsrep SST unsafe parameter handling on the donor side

Risk 65
Severity
8
OS Command Injection
AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Last updated 11 July 2026

1 / 2
Source: Ubuntu
First published (updated )
CVE-2026-44168

MariaDB MariaDB ServerMariaDB: Argument injection in CONNECT REST Xcurl on Windows via unsanitized URL

Risk 82
Severity
6.3
OS Command Injection
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB on WIndows with installed CONNECT engine and enabled REST support interpolated table HTTP attribute into the curl command line without proper sanitizing. This allows the user to execute shell commands on the server. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.

First published (updated )
CVE-2026-44170

MariaDB MariaDB ServerMariaDB: path traversal in mbstream

Risk 68
Severity
7.8
Path Traversal
AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H

Last updated 11 July 2026

1 / 2
Source: Ubuntu
First published (updated )
CVE-2026-44171

MariaDB MariaDB ServerMariaDB: Authorization bypass in role-based routine-level privilege check exposes stored routine definitions

Risk 22
Severity
4.3
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Last updated 11 July 2026

1 / 2
Source: Ubuntu
First published (updated )
CVE-2026-44169

MariaDB MariaDB ServerHeap-based Buffer Overflow in MariaDB

Risk 61
Severity
9.9
EPSS
0.26%
AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

MariaDB server is a community developed fork of MySQL server. An authenticated user can crash MariaDB versions 11.4 before 11.4.10 and 11.8 before 11.8.6 via a bug in JSONSCHEMAVALID() function. Under certain conditions it might be possible to turn the crash into a remote code execution. These conditions require tight control over memory layout which is generally only attainable in a lab environment. This issue is fixed in MariaDB 11.4.10, MariaDB 11.8.6, and MariaDB 12.2.2.

First published (updated )
CVE-2026-32710

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203