Login Request a demo
MA
Product
MariaDB
by MariaDB · last CVE Oct 16, 2026
431
CVEs
0
On KEV
9.9
Max CVSS
15
New 30D
Vulnerabilities431In the news0Timeline
Severity mix
Critical 11High 72Medium 161Low 9
Severity
All severities431Critical11High72Medium161Low9
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add MariaDB to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-97380
8.8
1%
Oct 16
MariaDB: GRANT PROXY with empty password incorrectly checks grantor's privileges
Affected: 10.6.1 before 10.6.28; 10.11.1 before 10.11.19; 11.4.1 before 11.4.13; 11.8.1 before 11.8.9; 12.3.1 before 12.3.3; 13.0.1
CVE-2017-15365
8.8
3%
Jan 25
sql/event_data_objects.cc in MariaDB before 10.1.30 and 10.2.x before 10.2.10 and Percona XtraDB Cluster before 5.6.37-26.21-3 and 5.7.x before 5.7.19-29.22-3 allows remote…
Affected: before 10.1.30; 10.2.0 before 10.2.10
CVE-2026-107815
8.5
1%
Oct 9
MariaDB: one byte OOB write in DOS tables of the CONNECT engine
Affected: 10.6.1 before 10.6.28; 10.11.1 before 10.11.19; 11.4.1 before 11.4.13; 11.8.1 before 11.8.9; 12.3.1 before 12.3.3; 13.0.1 before 13.0.2
CVE-2026-107818
8.4
0%
Oct 9
MariaDB: environment injection via wsrep bootstrap in the mariadb.service file
Affected: 10.6.1 before 10.6.28; 10.11.1 before 10.11.19; 11.4.1 before 11.4.13; 11.8.1 before 11.8.9; 12.3.1 before 12.3.3; 13.0.1 before 13.0.2
CVE-2026-107814
8.4
0%
Oct 9
MariaDB: Insecure $HOME in MariaDB rpm packages
Affected: 10.6.1 before 10.6.28; 10.11.1 before 10.11.19; 11.4.1 before 11.4.13; 11.8.1 before 11.8.9; 12.3.1 before 12.3.3; 13.0.1 before 13.0.2
CVE-2016-3477
8.1
0%
Jul 21
Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier, 5.6.30 and earlier, and 5.7.12 and earlier and MariaDB before 5.5.50, 10.0.x before 10.0.26, and 10.1.x before…
Affected: 5.5.20 before 5.5.50; 10.0.0 before 10.0.26; 10.1.0 before 10.1.15
CVE-2026-107821
8.0
1%
Oct 9
MariaDB: insufficient validation of binary frm data when opening a table
Affected: 10.6.1 before 10.6.28; 10.11.1 before 10.11.19; 11.4.1 before 11.4.13; 11.8.1 before 11.8.9; 12.3.1 before 12.3.3; 13.0.1 before 13.0.2
CVE-2026-44168
8.0
1%
Jun 12
MariaDB: wsrep SST unsafe parameter handling on the donor side
Affected: 10.6.1 before 10.6.26; 10.11.1 before 10.11.17; 11.4.1 before 11.4.11; 11.8.1 before 11.8.7; 12.3.1
CVE-2026-44171
7.8
0%
Jun 12
MariaDB: path traversal in mbstream
Affected: 10.6.1 before 10.6.26; 10.11.1 before 10.11.17; 11.4.1 before 11.4.11; 11.8.1 before 11.8.7; 12.3.1
CVE-2022-24052
7.8
1%
Feb 18
MariaDB CONNECT Storage Engine Heap-based Buffer Overflow Privilege Escalation Vulnerability
Affected: 10.2.0 before 10.2.42; 10.3.0 before 10.3.33; 10.4.0 before 10.4.23; 10.5.0 before 10.5.14; 10.6.0 before 10.6.6; 10.7.0 before 10.7.2; +1 more
CVE-2022-24051
7.8
1%
Feb 18
MariaDB CONNECT Storage Engine Format String Privilege Escalation Vulnerability
Affected: 10.2.0 before 10.2.42; 10.3.0 before 10.3.33; 10.4.0 before 10.4.23; 10.5.0 before 10.5.14; 10.6.0 before 10.6.6; 10.7.0 before 10.7.2; +1 more
CVE-2022-24050
7.8
1%
Feb 18
MariaDB CONNECT Storage Engine Use-After-Free Privilege Escalation Vulnerability
Affected: 10.2.0 before 10.2.42; 10.3.0 before 10.3.33; 10.4.0 before 10.4.23; 10.5.0 before 10.5.14; 10.6.0 before 10.6.6; 10.7.0 before 10.7.2; +1 more
CVE-2022-24048
7.8
1%
Feb 18
MariaDB CONNECT Storage Engine Stack-based Buffer Overflow Privilege Escalation Vulnerability
Affected: 10.2.0 before 10.2.42; 10.3.0 before 10.3.33; 10.4.0 before 10.4.23; 10.5.0 before 10.5.14; 10.6.0 before 10.6.6; 10.7.0 before 10.7.2; +1 more
CVE-2020-7221
7.8
1%
Feb 4
mysql_install_db in MariaDB 10.4.7 through 10.4.11 allows privilege escalation from the mysql user account to root because chown and chmod are performed unsafely, as demonstrated…
Affected: 10.4.7 through 10.4.11
CVE-2015-2325
7.8
2%
Jan 14
The compile_branch function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code, cause a denial of service (out-of-bounds heap read and crash), or…
Affected: before 10.0.18
CVE-2017-15945
7.8
0%
Oct 27
The installation scripts in the Gentoo dev-db/mysql, dev-db/mariadb, dev-db/percona-server, dev-db/mysql-cluster, and dev-db/mariadb-galera packages before 2017-09-29 have chown…
Affected: before 10.0.30
CVE-2026-86047
7.7
1%
Oct 16
MariaDB: Insufficient quoting in mariadb-dump and SHOW commands
Affected: 10.6.1 before 10.6.28; 10.11.1 before 10.11.19; 11.4.1 before 11.4.13; 11.8.1 before 11.8.9; 12.3.1 before 12.3.3; 13.0.1
CVE-2018-2755
7.7
1%
Apr 19
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication)
Affected: 5.5.0 before 5.5.60; 10.0.0 before 10.0.35; 10.1.0 before 10.1.33; 10.2.0 before 10.2.15
CVE-2017-3309
7.7
3%
Apr 24
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer)
Affected: 5.5.0 before 5.5.55; 10.0.0 before 10.0.31; 10.1.0 before 10.1.23; 10.2.0 before 10.2.6
CVE-2017-3308
7.7
3%
Apr 24
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML)
Affected: 5.5.0 before 5.5.55; 10.0.0 before 10.0.31; 10.1.0 before 10.1.23; 10.2.0 before 10.2.6
CVE-2023-5157
7.5
2%
Sep 27
A vulnerability was found in MariaDB
Affected: before 10.3.36; 10.4.0 before 10.4.26; 10.5.0 before 10.5.17; 10.6.0 before 10.6.9; 10.7.0 before 10.7.5; 10.8.0 before 10.8.4
CVE-2022-32091
7.5
2%
Jul 1
MariaDB v10.7 was discovered to contain an use-after-poison in in __interceptor_memset at /libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc
Affected: 10.3.0 before 10.3.36; 10.4.0 before 10.4.26; 10.5.0 before 10.5.17; 10.6.0 before 10.6.9; 10.7.0 before 10.7.5; 10.8.0 before 10.8.4; +1 more
CVE-2022-32089
7.5
2%
Jul 1
MariaDB v10.5 to v10.7 was discovered to contain a segmentation fault via the component st_select_lex_unit::exclude_level
Affected: 10.4.0 before 10.4.26; 10.5.0 before 10.5.17; 10.6.0 before 10.6.9; 10.7.0 before 10.7.5; 10.8.0 before 10.8.4; 10.9.0 before 10.9.2
CVE-2022-32088
7.5
2%
Jul 1
MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Exec_time_tracker::get_loops/Filesort_tracker::report_use/filesort
Affected: 10.2.0 before 10.2.44; 10.3.0 before 10.3.35; 10.4.0 before 10.4.25; 10.5.0 before 10.5.16; 10.6.0 before 10.6.8; 10.7.0 before 10.7.4
CVE-2022-32087
7.5
2%
Jul 1
MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Item_args::walk_args
Affected: 10.3.0 before 10.3.35; 10.4.0 before 10.4.25; 10.5.0 before 10.5.16; 10.6.0 before 10.6.8; 10.7.0 before 10.7.4
CVE-2022-32086
7.5
2%
Jul 1
MariaDB v10.4 to v10.8 was discovered to contain a segmentation fault via the component Item_field::fix_outer_field
Affected: 10.4.0 before 10.4.25; 10.5.0 before 10.5.16; 10.6.0 before 10.6.8; 10.7.0 before 10.7.4
CVE-2022-32085
7.5
2%
Jul 1
MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Item_func_in::cleanup/Item::cleanup_processor
Affected: 10.2.0 before 10.2.44; 10.3.0 before 10.3.35; 10.4.0 before 10.4.25; 10.5.0 before 10.5.16; 10.6.0 before 10.6.8; 10.7.0 before 10.7.4
CVE-2022-32084
7.5
2%
Jul 1
MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component sub_select
Affected: 10.3.0 before 10.3.36; 10.4.0 before 10.4.26; 10.5.0 before 10.5.17; 10.6.0 before 10.6.9; 10.7.0 before 10.7.5; 10.8.0 before 10.8.4; +1 more
CVE-2022-32083
7.5
2%
Jul 1
MariaDB v10.2 to v10.6.1 was discovered to contain a segmentation fault via the component Item_subselect::init_expr_cache_tracker
Affected: 10.2.0 before 10.2.44; 10.3.0 before 10.3.35; 10.4.0 before 10.4.25; 10.5.0 before 10.5.16; 10.6.0 before 10.6.8; 10.7.0 before 10.7.4
CVE-2022-32082
7.5
2%
Jul 1
MariaDB v10.5 to v10.7 was discovered to contain an assertion failure at table->get_ref_count() == 0 in dict0dict.cc
Affected: 10.5.0 before 10.5.17; 10.6.0 before 10.6.9; 10.7.0 before 10.7.5; 10.8.0 before 10.8.4; 10.9.0 before 10.9.2
CVE-2022-32081
7.5
2%
Jul 1
MariaDB v10.4 to v10.7 was discovered to contain an use-after-poison in prepare_inplace_add_virtual at /storage/innobase/handler/handler0alter.cc
Affected: 10.4.0 before 10.4.26; 10.5.0 before 10.5.17; 10.6.0 before 10.6.9; 10.7.0 before 10.7.5; 10.8.0 before 10.8.4; 10.9.0 before 10.9.2
CVE-2022-27457
7.5
2%
Apr 14
MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component my_mb_wc_latin1 at /strings/ctype-latin1.c
Affected: 10.4.0 before 10.4.25; 10.5.0 before 10.5.16; 10.6.0 before 10.6.8; 10.7.0 before 10.7.4
CVE-2022-27456
7.5
2%
Apr 14
MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component VDec::VDec at /sql/sql_type.cc
Affected: 10.3.0 before 10.3.35; 10.4.0 before 10.4.25; 10.5.0 before 10.5.16; 10.6.0 before 10.6.8; 10.7.0 before 10.7.4
CVE-2022-27455
7.5
2%
Apr 14
MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component my_wildcmp_8bit_impl at /strings/ctype-simple.c
Affected: 10.4.0 before 10.4.25; 10.5.0 before 10.5.16; 10.6.0 before 10.6.8; 10.7.0 before 10.7.4
CVE-2022-27452
7.5
2%
Apr 14
MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_cmpfunc.cc
Affected: 10.3.0 before 10.3.35; 10.4.0 before 10.4.25; 10.5.0 before 10.5.16; 10.6.0 before 10.6.8; 10.7.0 before 10.7.4
CVE-2022-27451
7.5
2%
Apr 14
MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/field_conv.cc
Affected: 10.4.0 before 10.4.25; 10.5.0 before 10.5.16; 10.6.0 before 10.6.8; 10.7.0 before 10.7.4
CVE-2022-27449
7.5
2%
Apr 14
MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_func.cc:148
Affected: before 10.3.35; 10.4.0 before 10.4.25; 10.5.0 before 10.5.16; 10.6.0 before 10.6.8; 10.7.0 before 10.7.4
CVE-2022-27448
7.5
2%
Apr 14
There is an Assertion failure in MariaDB Server v10.9 and below via 'node->pcur->rel_pos == BTR_PCUR_ON' at /row/row0mysql.cc
Affected: 10.3.0 before 10.3.35; 10.4.0 before 10.4.25; 10.5.0 before 10.5.16; 10.6.0 before 10.6.8; 10.7.0 before 10.7.4
CVE-2022-27447
7.5
2%
Apr 14
MariaDB Server v10.9 and below was discovered to contain a use-after-free via the component Binary_string::free_buffer() at /sql/sql_string.h
Affected: 10.3.0 before 10.3.35; 10.4.0 before 10.4.25; 10.5.0 before 10.5.16; 10.6.0 before 10.6.8; 10.7.0 before 10.7.4
CVE-2022-27446
7.5
2%
Apr 14
MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_cmpfunc.h
Affected: 10.4.0 before 10.4.25; 10.5.0 before 10.5.16; 10.6.0 before 10.6.8; 10.7.0 before 10.7.4
CVE-2022-27445
7.5
2%
Apr 14
MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/sql_window.cc
Affected: 10.2.0 before 10.2.44; 10.3.0 before 10.3.35; 10.4.0 before 10.4.25; 10.5.0 before 10.5.16; 10.6.0 before 10.6.8; 10.7.0 before 10.7.4
CVE-2022-27444
7.5
1%
Apr 14
MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_subselect.cc
Affected: 10.4.0 before 10.4.25; 10.5.0 before 10.5.16; 10.6.0 before 10.6.8; 10.7.0 before 10.7.4
CVE-2022-27387
7.5
2%
Apr 12
MariaDB Server v10.7 and below was discovered to contain a global buffer overflow in the component decimal_bin_size, which is exploited via specially crafted SQL statements
Affected: 10.2.0 before 10.2.44; 10.3.0 before 10.3.35; 10.4.0 before 10.4.25; 10.5.0 before 10.5.16; 10.6.0 before 10.6.8; 10.7.0 before 10.7.4
CVE-2022-27386
7.5
2%
Apr 12
MariaDB Server v10.7 and below was discovered to contain a segmentation fault via the component sql/sql_class.cc
Affected: 10.2.0 before 10.2.44; 10.3.0 before 10.3.35; 10.4.0 before 10.4.25; 10.5.0 before 10.5.16; 10.6.0 before 10.6.8; 10.7.0 before 10.7.4
CVE-2022-27385
7.5
2%
Apr 12
An issue in the component Used_tables_and_const_cache::used_tables_and_const_cache_join of MariaDB Server v10.7 and below was discovered to allow attackers to cause a Denial of…
Affected: before 10.3.32; 10.4.0 before 10.4.22; 10.5.0 before 10.5.13; 10.6.0 before 10.6.5
CVE-2022-27384
7.5
2%
Apr 12
An issue in the component Item_subselect::init_expr_cache_tracker of MariaDB Server v10.6 and below was discovered to allow attackers to cause a Denial of Service (DoS) via…
Affected: 10.2.0 before 10.2.44; 10.3.0 before 10.3.35; 10.4.0 before 10.4.25; 10.5.0 before 10.5.16; 10.6.0 before 10.6.8; 10.7.0 before 10.7.4; +1 more
CVE-2022-27383
7.5
2%
Apr 12
MariaDB Server v10.6 and below was discovered to contain an use-after-free in the component my_strcasecmp_8bit, which is exploited via specially crafted SQL statements
Affected: 10.2.0 before 10.2.44; 10.3.0 before 10.3.35; 10.4.0 before 10.4.25; 10.5.0 before 10.5.16; 10.6.0 before 10.6.8; 10.7.0 before 10.7.4; +1 more
CVE-2022-27382
7.5
2%
Apr 12
MariaDB Server v10.7 and below was discovered to contain a segmentation fault via the component Item_field::used_tables/update_depend_map_for_order
Affected: 10.4.0 before 10.4.25; 10.5.0 before 10.5.16; 10.6.0 before 10.6.8; 10.7.0 before 10.7.4
CVE-2022-27381
7.5
2%
Apr 12
An issue in the component Field::set_default of MariaDB Server v10.6 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL…
Affected: 10.2.0 before 10.2.44; 10.3.0 before 10.3.35; 10.4.0 before 10.4.25; 10.5.0 before 10.5.16; 10.6.0 before 10.6.8; 10.7.0 before 10.7.4
CVE-2022-27380
7.5
2%
Apr 12
An issue in the component my_decimal::operator= of MariaDB Server v10.6.3 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL…
Affected: 10.2.0 before 10.2.44; 10.3.0 before 10.3.35; 10.4.0 before 10.4.25; 10.5.0 before 10.5.16; 10.6.0 before 10.6.8; 10.7.0 before 10.7.4
Page 1 of 2 · 72 total
12