MA
Product
MariaDB
430
CVEs
0
On KEV
9.9
Max CVSS
15
New 30D
Severity mix
Critical 11High 71Medium 161Low 9
Watch
Add MariaDB to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-27446 | 7.5 | Apr 14 | MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_cmpfunc.h Affected: 10.4.0 before 10.4.25; 10.5.0 before 10.5.16; 10.6.0 before 10.6.8; 10.7.0 before 10.7.4 |
| CVE-2022-27445 | 7.5 | Apr 14 | MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/sql_window.cc Affected: 10.2.0 before 10.2.44; 10.3.0 before 10.3.35; 10.4.0 before 10.4.25; 10.5.0 before 10.5.16; 10.6.0 before 10.6.8; 10.7.0 before 10.7.4 |
| CVE-2022-27444 | 7.5 | Apr 14 | MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_subselect.cc Affected: 10.4.0 before 10.4.25; 10.5.0 before 10.5.16; 10.6.0 before 10.6.8; 10.7.0 before 10.7.4 |
| CVE-2022-27387 | 7.5 | Apr 12 | MariaDB Server v10.7 and below was discovered to contain a global buffer overflow in the component decimal_bin_size, which is exploited via specially crafted SQL statements Affected: 10.2.0 before 10.2.44; 10.3.0 before 10.3.35; 10.4.0 before 10.4.25; 10.5.0 before 10.5.16; 10.6.0 before 10.6.8; 10.7.0 before 10.7.4 |
| CVE-2022-27386 | 7.5 | Apr 12 | MariaDB Server v10.7 and below was discovered to contain a segmentation fault via the component sql/sql_class.cc Affected: 10.2.0 before 10.2.44; 10.3.0 before 10.3.35; 10.4.0 before 10.4.25; 10.5.0 before 10.5.16; 10.6.0 before 10.6.8; 10.7.0 before 10.7.4 |
| CVE-2022-27385 | 7.5 | Apr 12 | An issue in the component Used_tables_and_const_cache::used_tables_and_const_cache_join of MariaDB Server v10.7 and below was discovered to allow attackers to cause a Denial of… Affected: before 10.3.32; 10.4.0 before 10.4.22; 10.5.0 before 10.5.13; 10.6.0 before 10.6.5 |
| CVE-2022-27384 | 7.5 | Apr 12 | An issue in the component Item_subselect::init_expr_cache_tracker of MariaDB Server v10.6 and below was discovered to allow attackers to cause a Denial of Service (DoS) via… Affected: 10.2.0 before 10.2.44; 10.3.0 before 10.3.35; 10.4.0 before 10.4.25; 10.5.0 before 10.5.16; 10.6.0 before 10.6.8; 10.7.0 before 10.7.4; +1 more |
| CVE-2022-27383 | 7.5 | Apr 12 | MariaDB Server v10.6 and below was discovered to contain an use-after-free in the component my_strcasecmp_8bit, which is exploited via specially crafted SQL statements Affected: 10.2.0 before 10.2.44; 10.3.0 before 10.3.35; 10.4.0 before 10.4.25; 10.5.0 before 10.5.16; 10.6.0 before 10.6.8; 10.7.0 before 10.7.4; +1 more |
| CVE-2022-27382 | 7.5 | Apr 12 | MariaDB Server v10.7 and below was discovered to contain a segmentation fault via the component Item_field::used_tables/update_depend_map_for_order Affected: 10.4.0 before 10.4.25; 10.5.0 before 10.5.16; 10.6.0 before 10.6.8; 10.7.0 before 10.7.4 |
| CVE-2022-27381 | 7.5 | Apr 12 | An issue in the component Field::set_default of MariaDB Server v10.6 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL… Affected: 10.2.0 before 10.2.44; 10.3.0 before 10.3.35; 10.4.0 before 10.4.25; 10.5.0 before 10.5.16; 10.6.0 before 10.6.8; 10.7.0 before 10.7.4 |
| CVE-2022-27380 | 7.5 | Apr 12 | An issue in the component my_decimal::operator= of MariaDB Server v10.6.3 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL… Affected: 10.2.0 before 10.2.44; 10.3.0 before 10.3.35; 10.4.0 before 10.4.25; 10.5.0 before 10.5.16; 10.6.0 before 10.6.8; 10.7.0 before 10.7.4 |
| CVE-2022-27379 | 7.5 | Apr 12 | An issue in the component Arg_comparator::compare_real_fixed of MariaDB Server v10.6.2 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially… Affected: 10.3.0 before 10.3.35; 10.4.0 before 10.4.25; 10.5.0 before 10.5.16; 10.6.0 before 10.6.8; 10.7.0 before 10.7.4 |
| CVE-2022-27378 | 7.5 | Apr 12 | An issue in the component Create_tmp_table::finalize of MariaDB Server v10.7 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted… Affected: 10.2.0 before 10.2.44; 10.3.0 before 10.3.35; 10.4.0 before 10.4.25; 10.5.0 before 10.5.16; 10.6.0 before 10.6.8; 10.7.0 before 10.7.4; +2 more |
| CVE-2022-27377 | 7.5 | Apr 12 | MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component Item_func_in::cleanup(), which is exploited via specially crafted SQL statements Affected: 10.2.0 before 10.2.44; 10.3.0 before 10.3.35; 10.4.0 before 10.4.25; 10.5.0 before 10.5.16; 10.6.0 before 10.6.8; 10.7.0 before 10.7.4 |
| CVE-2022-27376 | 7.5 | Apr 12 | MariaDB Server v10.6.5 and below was discovered to contain an use-after-free in the component Item_args::walk_arg, which is exploited via specially crafted SQL statements Affected: 10.3.0 before 10.3.35; 10.4.0 before 10.4.25; 10.5.0 before 10.5.16; 10.6.0 before 10.6.8; 10.7.0 before 10.7.4 |
| CVE-2018-25032 | 7.5 | Mar 25 | zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches Affected: 10.3.0 before 10.3.36; 10.4.0 before 10.4.26; 10.5.0 before 10.5.17; 10.6.0 before 10.6.9; 10.7.0 before 10.7.5; 10.8.0 before 10.8.4; +1 more |
| CVE-2022-0778 | 7.5 | Mar 15 | Infinite loop in BN_mod_sqrt() reachable when parsing certificates Affected: 10.2.0 before 10.2.42; 10.3.0 before 10.3.33; 10.4.0 before 10.4.23; 10.5.0 before 10.5.14; 10.6.0 before 10.6.6; 10.7.0 before 10.7.2 |
| CVE-2021-46669 | 7.5 | Feb 1 | MariaDB through 10.5.9 allows attackers to trigger a convert_const_to_int use-after-free when the BIGINT data type is used Affected: before 10.2.44; 10.3.0 before 10.3.35; 10.4.0 before 10.4.25; 10.5.0 before 10.5.16; 10.6.0 before 10.6.8; 10.7.0 before 10.7.4 |
| CVE-2017-16046 | 7.5 | Jun 4 | `mariadb` was a malicious module published with the intent to hijack environment variables Affected: 2.13.0 |
| CVE-2017-3302 | 7.5 | Feb 12 | Crash in libmysqlclient.so in Oracle MySQL before 5.6.21 and 5.7.x before 5.7.5 and MariaDB through 5.5.54, 10.0.x through 10.0.29, 10.1.x through 10.1.21, and 10.2.x through… Affected: through 5.5.54; 10.0.0 through 10.0.29; 10.1.0 through 10.1.21; 10.2.0 through 10.2.3 |
| CVE-2016-3471 | 7.5 | Jul 21 | Unspecified vulnerability in Oracle MySQL 5.5.45 and earlier and 5.6.26 and earlier allows local users to affect confidentiality, integrity, and availability via vectors related… Affected: 5.5.0 before 5.5.46; 10.0.0 before 10.0.22; 10.1.0 before 10.1.9 |
| CVE-2014-0224 | 7.4 | Jun 5 | OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers… Affected: 10.0.0 before 10.0.13 |
| CVE-2026-107823 | 7.2 | Oct 9 | MariaDB: privilege escalation via incorrect view frm parsing Affected: 10.6.1 before 10.6.28; 10.11.1 before 10.11.19; 11.4.1 before 11.4.13; 11.8.1 before 11.8.9; 12.3.1 before 12.3.3; 13.0.1 before 13.0.2 |
| CVE-2026-48165 | 7.2 | Jun 12 | MariaDB: unsafe usage of `wsrep_sst_receive_address` values on the joiner side Affected: 10.6.1 before 10.6.27; 10.11.1 before 10.11.18; 11.4.1 before 11.4.12; 11.8.1 before 11.8.8; 12.3.1 |
| CVE-2026-48163 | 7.2 | Jun 12 | MariaDB: wsrep SST unsafe parameter handling on the donor side (rsync) Affected: 10.6.1 before 10.6.27; 10.11.1 before 10.11.18; 11.4.1 before 11.4.12; 11.8.1 before 11.8.8; 12.3.1 |
| CVE-2021-2144 | 7.2 | Apr 22 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser) Affected: 5.5.0 before 5.5.66; 10.1.0 before 10.1.42; 10.2.0 before 10.2.28; 10.3.0 before 10.3.19; 10.4.0 before 10.4.9 |
| CVE-2021-27928 | 7.2 | Mar 19 | A remote code execution issue was discovered in MariaDB 10.2 before 10.2.37, 10.3 before 10.3.28, 10.4 before 10.4.18, and 10.5 before 10.5.9; Percona Server through 2021-03-03;… Affected: 10.2 before 10.2.37; 10.3 before 10.3.28; 10.4 before 10.4.18; 10.5 before 10.5.9 |
| CVE-2018-3064 | 7.1 | Jul 18 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB) Affected: 10.0.0 before 10.0.36; 10.1.0 before 10.1.35; 10.2.0 before 10.2.17; 10.3.0 before 10.3.9 |
| CVE-2018-2562 | 7.1 | Jan 18 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server : Partition) Affected: 5.5.0 before 5.5.59; 10.0.0 before 10.0.34; 10.1.0 before 10.1.31; 10.2.0 before 10.2.13 |
| CVE-2020-28912 | 7.0 | Dec 24 | With MariaDB running on Windows, when local clients connect to the server over named pipes, it's possible for an unprivileged user with an ability to run code on the server… Affected: before 10.1.48; 10.2.0 before 10.2.35; 10.3.0 before 10.3.26; 10.4.0 before 10.4.16; 10.5.0 before 10.5.7 |
| CVE-2016-6664 | 7.0 | Dec 13 | mysqld_safe in Oracle MySQL through 5.5.51, 5.6.x through 5.6.32, and 5.7.x through 5.7.14; MariaDB; Percona Server before 5.5.51-38.2, 5.6.x before 5.6.32-78-1, and 5.7.x before… Affected: 5.5.0 before 5.5.54; 10.0.0 before 10.0.29; 10.1.0 before 10.1.21 |
| CVE-2016-6663 | 7.0 | Dec 13 | Race condition in Oracle MySQL before 5.5.52, 5.6.x before 5.6.33, 5.7.x before 5.7.15, and 8.x before 8.0.1; MariaDB before 5.5.52, 10.0.x before 10.0.28, and 10.1.x before… Affected: 5.5.20 before 5.5.52; 10.0.0 before 10.0.28; 10.1.0 before 10.1.18 |
| CVE-2017-3312 | 6.7 | Jan 27 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Packaging) Affected: 5.5.0 before 5.5.54; 10.0.0 before 10.0.29; 10.1.0 before 10.1.21 |
| CVE-2017-3600 | 6.6 | Apr 24 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client mysqldump) Affected: 5.5.0 before 5.5.53; 10.0.0 before 10.0.28; 10.1.0 before 10.1.19 |
| CVE-2026-35549 | 6.5 | Apr 3 | An issue was discovered in MariaDB Server before 11.4.10, 11.5.x through 11.8.x before 11.8.6, and 12.x before 12.2.2 Affected: before 11.4.10; 11.5.0 before 11.8.6; 12.0.0 before 12.2.2 |
| CVE-2022-47015 | 6.5 | Jan 20 | MariaDB Server before 10.3.34 thru 10.9.3 is vulnerable to Denial of Service Affected: 10.3.0 before 10.3.39; 10.4.0 before 10.4.29; 10.5.0 before 10.5.20; 10.6.0 before 10.6.13; 10.8.0 before 10.8.8; 10.9.0 before 10.9.6; +2 more |
| CVE-2020-14765 | 6.5 | Oct 21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS) Affected: 10.1.0 before 10.1.48; 10.2.0 before 10.2.35; 10.3.0 before 10.3.26; 10.4.0 before 10.4.16; 10.5.0 before 10.5.7 |
| CVE-2020-2780 | 6.5 | Apr 15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML) Affected: 5.5.0 before 5.5.66; 10.1.0 before 10.1.42; 10.2.0 before 10.2.28; 10.3.0 before 10.3.19; 10.4.0 before 10.4.9 |
| CVE-2019-2974 | 6.5 | Oct 16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer) Affected: 5.5.0 before 5.5.66; 10.1.0 before 10.1.42; 10.2.0 before 10.2.28; 10.3.0 before 10.3.19; 10.4.0 before 10.4.9 |
| CVE-2019-2805 | 6.5 | Jul 23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Parser) Affected: 5.5.0 before 5.5.65; 10.1.0 before 10.1.41; 10.2.0 before 10.2.26; 10.3.0 before 10.3.17; 10.4.0 before 10.4.7 |
| CVE-2019-2740 | 6.5 | Jul 23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: XML) Affected: 5.5.0 before 5.5.65; 10.1.0 before 10.1.41; 10.2.0 before 10.2.26; 10.3.0 before 10.3.17; 10.4.0 before 10.4.7 |
| CVE-2019-2455 | 6.5 | Jan 16 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Parser) Affected: 5.5.0 before 5.5.60; 10.0.0 before 10.0.35; 10.1.0 before 10.1.33; 10.2.0 before 10.2.15 |
| CVE-2019-2529 | 6.5 | Jan 16 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer) Affected: 5.5.0 before 5.5.63; 10.0.0 before 10.0.38; 10.1.0 before 10.1.38 |
| CVE-2018-3251 | 6.5 | Oct 17 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB) Affected: 10.0.0 before 10.0.37; 10.1.0 before 10.1.37; 10.2.0 before 10.2.19; 10.3.0 before 10.3.11 |
| CVE-2018-3156 | 6.5 | Oct 17 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB) Affected: 10.0.0 before 10.0.37; 10.1.0 before 10.1.37; 10.2.0 before 10.2.19; 10.3.0 before 10.3.11 |
| CVE-2018-3143 | 6.5 | Oct 17 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB) Affected: 10.0.0 before 10.0.37; 10.1.0 before 10.1.37; 10.2.0 before 10.2.19; 10.3.0 before 10.3.11 |
| CVE-2018-3133 | 6.5 | Oct 17 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Parser) Affected: 5.5.0 before 5.5.59; 10.0.0 before 10.0.34; 10.1.0 before 10.1.30; 10.2.0 before 10.2.12 |
| CVE-2018-3060 | 6.5 | Jul 18 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB) Affected: 10.2.0 before 10.2.17; 10.3.0 before 10.3.9 |
| CVE-2018-2819 | 6.5 | Apr 19 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB) Affected: 5.5.0 before 5.5.60; 10.0.0 before 10.0.35; 10.1.0 before 10.1.33; 10.2.0 before 10.2.15 |
| CVE-2018-2817 | 6.5 | Apr 19 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL) Affected: 5.5.0 before 5.5.60; 10.0.0 before 10.0.35; 10.1.0 before 10.1.33; 10.2.0 before 10.2.15 |