CVE-2026-48165 | High | 8.0 | 2026-06-12 | MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11… |
CVE-2026-48163 | High | 8.0 | 2026-06-12 | MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11… |
CVE-2026-44173 | Medium | 5.0 | 2026-06-12 | MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11… |
CVE-2026-44172 | Critical | 9.1 | 2026-06-12 | MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping i… |
CVE-2026-44171 | Medium | 6.3 | 2026-06-12 | MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11… |
CVE-2026-44170 | Critical | 9.8 | 2026-06-12 | MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11… |
CVE-2026-44169 | Medium | 4.3 | 2026-06-12 | MariaDB server is a community developed fork of MySQL server. From versions 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, a user getting EXECU… |
CVE-2026-44168 | High | 8.0 | 2026-06-12 | MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11… |
CVE-2026-49261 | Critical | 10.0 | 2026-06-11 | MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through… |
CVE-2026-35549 | Medium | 6.5 | 2026-04-03 | An issue was discovered in MariaDB Server before 11.4.10, 11.5.x through 11.8.x before 11.8.6, and 12.x before 12.2.2. If the caching_sha2_password authenticat… |
CVE-2026-32710 | High | 8.5 | 2026-03-20 | MariaDB server is a community developed fork of MySQL server. An authenticated user can crash MariaDB versions 11.4 before 11.4.10 and 11.8 before 11.8.6 via a… |
CVE-2026-3494 | Medium | 4.3 | 2026-03-03 | In MariaDB server version through 11.8.5, when server audit plugin is enabled with server_audit_events variable configured with QUERY_DCL, QUERY_DDL, or QUERY_… |
CVE-2025-13699 | High | 7.0 | 2025-12-23 | MariaDB mariadb-dump Utility Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on a… |
CVE-2025-56404 | High | 7.5 | 2025-09-10 | An issue was discovered in MariaDB MCP 0.1.0 allowing attackers to gain sensitive information via the SSE service as the SSE service lacks user validation. |
CVE-2023-52971 | Medium | 4.9 | 2025-03-08 | MariaDB Server 10.10 through 10.11.* and 11.0 through 11.4.* crashes in JOIN::fix_all_splittings_in_plan. |
CVE-2023-52970 | Medium | 4.9 | 2025-03-08 | MariaDB Server 10.4 through 10.5.*, 10.6 through 10.6.*, 10.7 through 10.11.*, 11.0 through 11.0.*, and 11.1 through 11.4.* crashes in Item_direct_view_ref::de… |
CVE-2023-52969 | Medium | 4.9 | 2025-03-08 | MariaDB Server 10.4 through 10.5.*, 10.6 through 10.6.*, 10.7 through 10.11.*, and 11.0 through 11.0.* can sometimes crash with an empty backtrace log. This ma… |
CVE-2023-52968 | Medium | 4.9 | 2025-03-08 | MariaDB Server 10.4 before 10.4.33, 10.5 before 10.5.24, 10.6 before 10.6.17, 10.7 through 10.11 before 10.11.7, 11.0 before 11.0.5, and 11.1 before 11.1.4 cal… |
CVE-2024-27766 | Medium | 5.7 | 2024-10-17 | An issue in MariaDB v.11.1 allows a remote attacker to execute arbitrary code via the lib_mysqludf_sys.so function. NOTE: this is disputed by the MariaDB Found… |
CVE-2023-39593 | Medium | 5.6 | 2024-10-17 | Insecure permissions in the sys_exec function of MariaDB v10.5 allows authenticated attackers to execute arbitrary commands with elevated privileges. NOTE: thi… |
CVE-2023-26785 | Critical | 9.8 | 2024-10-17 | MariaDB v10.5 was discovered to contain a remote code execution (RCE) vulnerability via UDF Code in a Shared Object File, followed by a "create function" state… |
CVE-2023-22084 | Medium | 4.9 | 2023-10-17 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.43 and prior, 8.0.34 and prior and… |
CVE-2023-5157 | High | 7.5 | 2023-09-27 | A vulnerability was found in MariaDB. An OpenVAS port scan on ports 3306 and 4567 allows a malicious remote client to cause a denial of service. |
CVE-2023-40354 | Medium | 6.5 | 2023-08-14 | An issue was discovered in MariaDB MaxScale before 23.02.3. A user enters an encrypted password on a "maxctrl create service" command line, but this password i… |
CVE-2022-47015 | Medium | 6.5 | 2023-01-20 | MariaDB Server before 10.3.34 thru 10.9.3 is vulnerable to Denial of Service. It is possible for function spider_db_mbase::print_warnings to dereference a null… |
CVE-2022-21595 | Medium | 4.4 | 2022-10-18 | Vulnerability in the MySQL Server product of Oracle MySQL (component: C API). Supported versions that are affected are 5.7.36 and prior and 8.0.27 and prior. D… |
CVE-2022-38791 | Medium | 5.5 | 2022-08-27 | In MariaDB before 10.9.2, compress_write in extra/mariabackup/ds_compress.cc does not release data_mutex upon a stream write failure, which allows local users… |
CVE-2022-32091 | High | 7.5 | 2022-07-01 | MariaDB v10.7 was discovered to contain an use-after-poison in in __interceptor_memset at /libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc. |
CVE-2022-32089 | High | 7.5 | 2022-07-01 | MariaDB v10.5 to v10.7 was discovered to contain a segmentation fault via the component st_select_lex_unit::exclude_level. |
CVE-2022-32088 | High | 7.5 | 2022-07-01 | MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Exec_time_tracker::get_loops/Filesort_tracker::report_use/filesort. |
CVE-2022-32087 | High | 7.5 | 2022-07-01 | MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Item_args::walk_args. |
CVE-2022-32086 | High | 7.5 | 2022-07-01 | MariaDB v10.4 to v10.8 was discovered to contain a segmentation fault via the component Item_field::fix_outer_field. |
CVE-2022-32085 | High | 7.5 | 2022-07-01 | MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Item_func_in::cleanup/Item::cleanup_processor. |
CVE-2022-32084 | High | 7.5 | 2022-07-01 | MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component sub_select. |
CVE-2022-32083 | High | 7.5 | 2022-07-01 | MariaDB v10.2 to v10.6.1 was discovered to contain a segmentation fault via the component Item_subselect::init_expr_cache_tracker. |
CVE-2022-32082 | High | 7.5 | 2022-07-01 | MariaDB v10.5 to v10.7 was discovered to contain an assertion failure at table->get_ref_count() == 0 in dict0dict.cc. |
CVE-2022-32081 | High | 7.5 | 2022-07-01 | MariaDB v10.4 to v10.7 was discovered to contain an use-after-poison in prepare_inplace_add_virtual at /storage/innobase/handler/handler0alter.cc. |
CVE-2022-31624 | Medium | 5.5 | 2022-05-25 | MariaDB Server before 10.7 is vulnerable to Denial of Service. While executing the plugin/server_audit/server_audit.c method log_statement_ex, the held lock lo… |
CVE-2022-31623 | Medium | 5.5 | 2022-05-25 | MariaDB Server before 10.7 is vulnerable to Denial of Service. In extra/mariabackup/ds_compress.cc, when an error occurs (i.e., going to the err label) while e… |
CVE-2022-31622 | Medium | 5.5 | 2022-05-25 | MariaDB Server before 10.7 is vulnerable to Denial of Service. In extra/mariabackup/ds_compress.cc, when an error occurs (pthread_create returns a nonzero valu… |
CVE-2022-31621 | Medium | 5.5 | 2022-05-25 | MariaDB Server before 10.7 is vulnerable to Denial of Service. In extra/mariabackup/ds_xbstream.cc, when an error occurs (stream_ctxt->dest_file == NULL) while… |
CVE-2022-21451 | Medium | 4.4 | 2022-04-19 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.37 and prior and 8.0.28 and prior… |
CVE-2022-21427 | Medium | 4.9 | 2022-04-19 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). Supported versions that are affected are 5.7.37 and prior and 8.0.28 and pr… |
CVE-2022-27457 | High | 7.5 | 2022-04-14 | MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component my_mb_wc_latin1 at /strings/ctype-latin1.c. |
CVE-2022-27456 | High | 7.5 | 2022-04-14 | MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component VDec::VDec at /sql/sql_type.cc. |
CVE-2022-27455 | High | 7.5 | 2022-04-14 | MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component my_wildcmp_8bit_impl at /strings/ctype-simple.c. |
CVE-2022-27452 | High | 7.5 | 2022-04-14 | MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_cmpfunc.cc. |
CVE-2022-27451 | High | 7.5 | 2022-04-14 | MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/field_conv.cc. |
CVE-2022-27449 | High | 7.5 | 2022-04-14 | MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_func.cc:148. |
CVE-2022-27448 | High | 7.5 | 2022-04-14 | There is an Assertion failure in MariaDB Server v10.9 and below via 'node->pcur->rel_pos == BTR_PCUR_ON' at /row/row0mysql.cc. |
CVE-2022-27447 | High | 7.5 | 2022-04-14 | MariaDB Server v10.9 and below was discovered to contain a use-after-free via the component Binary_string::free_buffer() at /sql/sql_string.h. |
CVE-2022-27446 | High | 7.5 | 2022-04-14 | MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_cmpfunc.h. |
CVE-2022-27445 | High | 7.5 | 2022-04-14 | MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/sql_window.cc. |
CVE-2022-27444 | High | 7.5 | 2022-04-14 | MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_subselect.cc. |
CVE-2022-27387 | High | 7.5 | 2022-04-12 | MariaDB Server v10.7 and below was discovered to contain a global buffer overflow in the component decimal_bin_size, which is exploited via specially crafted S… |
CVE-2022-27386 | High | 7.5 | 2022-04-12 | MariaDB Server v10.7 and below was discovered to contain a segmentation fault via the component sql/sql_class.cc. |
CVE-2022-27385 | High | 7.5 | 2022-04-12 | An issue in the component Used_tables_and_const_cache::used_tables_and_const_cache_join of MariaDB Server v10.7 and below was discovered to allow attackers to… |
CVE-2022-27384 | High | 7.5 | 2022-04-12 | An issue in the component Item_subselect::init_expr_cache_tracker of MariaDB Server v10.6 and below was discovered to allow attackers to cause a Denial of Serv… |
CVE-2022-27383 | High | 7.5 | 2022-04-12 | MariaDB Server v10.6 and below was discovered to contain an use-after-free in the component my_strcasecmp_8bit, which is exploited via specially crafted SQL st… |
CVE-2022-27382 | High | 7.5 | 2022-04-12 | MariaDB Server v10.7 and below was discovered to contain a segmentation fault via the component Item_field::used_tables/update_depend_map_for_order. |
CVE-2022-27381 | High | 7.5 | 2022-04-12 | An issue in the component Field::set_default of MariaDB Server v10.6 and below was discovered to allow attackers to cause a Denial of Service (DoS) via special… |
CVE-2022-27380 | High | 7.5 | 2022-04-12 | An issue in the component my_decimal::operator= of MariaDB Server v10.6.3 and below was discovered to allow attackers to cause a Denial of Service (DoS) via sp… |
CVE-2022-27379 | High | 7.5 | 2022-04-12 | An issue in the component Arg_comparator::compare_real_fixed of MariaDB Server v10.6.2 and below was discovered to allow attackers to cause a Denial of Service… |
CVE-2022-27378 | High | 7.5 | 2022-04-12 | An issue in the component Create_tmp_table::finalize of MariaDB Server v10.7 and below was discovered to allow attackers to cause a Denial of Service (DoS) via… |
CVE-2022-27377 | High | 7.5 | 2022-04-12 | MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component Item_func_in::cleanup(), which is exploited via specially crafted… |
CVE-2022-27376 | High | 7.5 | 2022-04-12 | MariaDB Server v10.6.5 and below was discovered to contain an use-after-free in the component Item_args::walk_arg, which is exploited via specially crafted SQL… |
CVE-2018-25032 | High | 7.5 | 2022-03-25 | zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches. |
CVE-2022-0778 | High | 7.5 | 2022-03-15 | The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this functi… |
CVE-2022-24052 | High | 7.8 | 2022-02-18 | MariaDB CONNECT Storage Engine Heap-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges… |
CVE-2022-24051 | High | 7.8 | 2022-02-18 | MariaDB CONNECT Storage Engine Format String Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected i… |
CVE-2022-24050 | High | 7.8 | 2022-02-18 | MariaDB CONNECT Storage Engine Use-After-Free Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected… |
CVE-2022-24048 | High | 7.8 | 2022-02-18 | MariaDB CONNECT Storage Engine Stack-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges… |
CVE-2021-46669 | High | 7.5 | 2022-02-01 | MariaDB through 10.5.9 allows attackers to trigger a convert_const_to_int use-after-free when the BIGINT data type is used. |
CVE-2021-46668 | Medium | 5.5 | 2022-02-01 | MariaDB through 10.5.9 allows an application crash via certain long SELECT DISTINCT statements that improperly interact with storage-engine resource limitation… |
CVE-2021-46667 | Medium | 5.5 | 2022-02-01 | MariaDB before 10.6.5 has a sql_lex.cc integer overflow, leading to an application crash. |
CVE-2021-46666 | Medium | 5.5 | 2022-02-01 | MariaDB before 10.6.2 allows an application crash because of mishandling of a pushdown from a HAVING clause to a WHERE clause. |
CVE-2021-46665 | Medium | 5.5 | 2022-02-01 | MariaDB through 10.5.9 allows a sql_parse.cc application crash because of incorrect used_tables expectations. |
CVE-2021-46664 | Medium | 5.5 | 2022-02-01 | MariaDB through 10.5.9 allows an application crash in sub_select_postjoin_aggr for a NULL value of aggr. |
CVE-2021-46663 | Medium | 5.5 | 2022-02-01 | MariaDB through 10.5.13 allows a ha_maria::extra application crash via certain SELECT statements. |
CVE-2021-46662 | Medium | 5.5 | 2022-02-01 | MariaDB through 10.5.9 allows a set_var.cc application crash via certain uses of an UPDATE statement in conjunction with a nested subquery. |
CVE-2021-46661 | Medium | 5.5 | 2022-02-01 | MariaDB through 10.5.9 allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE). |
CVE-2021-46659 | Medium | 5.5 | 2022-01-29 | MariaDB before 10.7.2 allows an application crash because it does not recognize that SELECT_LEX::nest_level is local to each VIEW. |
CVE-2021-46658 | Medium | 5.5 | 2022-01-29 | save_window_function_values in MariaDB before 10.6.3 allows an application crash because of incorrect handling of with_window_func=true for a subquery. |
CVE-2021-46657 | Medium | 5.5 | 2022-01-29 | get_sort_by_table in MariaDB before 10.6.2 allows an application crash via certain subquery uses of ORDER BY. |
CVE-2021-35604 | Medium | 5.5 | 2021-10-20 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.35 and prior and 8.0.26 and prior… |
CVE-2021-2389 | Medium | 5.9 | 2021-07-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.34 and prior and 8.0.25 and prior… |
CVE-2021-2372 | Medium | 4.4 | 2021-07-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.34 and prior and 8.0.25 and prior… |
CVE-2020-15180 | Critical | 9.0 | 2021-05-27 | A flaw was found in the mysql-wsrep component of mariadb. Lack of input sanitization in `wsrep_sst_method` allows for command injection that can be exploited b… |
CVE-2021-2194 | Medium | 4.9 | 2021-04-22 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.33 and prior and 8.0.23 and prior… |
CVE-2021-2180 | Medium | 4.9 | 2021-04-22 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.33 and prior and 8.0.23 and prior… |
CVE-2021-2174 | Medium | 4.4 | 2021-04-22 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.33 and prior and 8.0.23 and prior… |
CVE-2021-2166 | Medium | 4.9 | 2021-04-22 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 5.7.33 and prior and 8.0.23 and pr… |
CVE-2021-2154 | Medium | 4.9 | 2021-04-22 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 5.7.33 and prior. Easily exploitab… |
CVE-2021-2144 | High | 7.2 | 2021-04-22 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions that are affected are 5.7.29 and prior and 8.0.19 and… |
CVE-2021-27928 | High | 7.2 | 2021-03-19 | A remote code execution issue was discovered in MariaDB 10.2 before 10.2.37, 10.3 before 10.3.28, 10.4 before 10.4.18, and 10.5 before 10.5.9; Percona Server t… |
CVE-2021-2032 | Medium | 4.3 | 2021-01-20 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Information Schema). Supported versions that are affected are 5.7.32 and prior and 8.0.22… |
CVE-2021-2022 | Medium | 4.4 | 2021-01-20 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.6.50 and prior, 5.7.32 and prior and… |
CVE-2021-2011 | Medium | 5.9 | 2021-01-20 | Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are 5.7.32 and prior and 8.0.22 and prior. D… |
CVE-2021-2007 | Low | 3.7 | 2021-01-20 | Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are 5.6.47 and prior, 5.7.29 and prior and 8… |
CVE-2020-28912 | High | 7.0 | 2020-12-24 | With MariaDB running on Windows, when local clients connect to the server over named pipes, it's possible for an unprivileged user with an ability to run code… |