MS
Product
Mysql Server
318
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 7High 23Medium 270Low 18
Watch
Add Mysql Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-60163 | 8.4 | Jul 21 | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin) Affected: 8.4.0 through 8.4.10; 9.7.0; 9.7.1 |
| CVE-2026-60315 | 8.2 | Jul 21 | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin) Affected: 8.4.0 through 8.4.10; 9.7.0; 9.7.1 |
| CVE-2022-21824 | 8.2 | Feb 24 | Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously… Affected: through 8.0.29 |
| CVE-2022-27778 | 8.1 | Jun 1 | A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is used together with `--remove-on-error` Affected: through 5.7.38; 8.0.0 through 8.0.29 |
| CVE-2021-22901 | 8.1 | Jun 11 | curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection Affected: through 5.7.34; 8.0.0 through 8.0.25 |
| CVE-2019-5443 | 7.8 | Jul 2 | A non-privileged user or program can put code and a config file in a known non-privileged path (under C:/usr/local/) that will make curl <= 7.65.1 automatically run the code (as… Affected: 5.0.0 through 5.7.27; 8.0.0 through 8.0.17 |
| CVE-2019-5436 | 7.8 | May 28 | A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1 Affected: through 5.7.27; 5.7.28 through 8.0.17 |
| CVE-2026-46863 | 7.5 | Jun 16 | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Connection Handling) Affected: 8.4.0 through 8.4.9; 9.0.0 through 9.7.0 |
| CVE-2025-21521 | 7.5 | Jan 21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Thread Pooling) Affected: 8.0.0 through 8.0.39; 8.4.0 through 8.4.2; 9.0.0 through 9.0.1 |
| CVE-2023-21912 | 7.5 | Apr 18 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges) Affected: 5.7.0 through 5.7.41; 8.0.0 through 8.0.30 |
| CVE-2021-35583 | 7.5 | Oct 20 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Windows) Affected: 8.0.0 through 8.0.25 |
| CVE-2021-22946 | 7.5 | Sep 29 | A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line… Affected: 5.7.0 through 5.7.35; 8.0.0 through 8.0.26 |
| CVE-2021-22926 | 7.5 | Aug 5 | libcurl-using applications can ask for a specific client certificate to be used in a transfer Affected: 5.7.0 through 5.7.35; 8.0.0 through 8.0.26 |
| CVE-2021-36222 | 7.5 | Jul 22 | ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.4 and 1.19.x before 1.19.2 allows remote attackers to cause a NULL… Affected: 8.0.0 through 8.0.26 |
| CVE-2021-21348 | 7.5 | Mar 22 | XStream is vulnerable to an attack using Regular Expression for a Denial of Service (ReDos) Affected: through 8.0.27 |
| CVE-2021-23840 | 7.5 | Feb 16 | Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable… Affected: before 5.7.33; 8.0.15 before 8.0.23 |
| CVE-2020-28196 | 7.5 | Nov 6 | MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support… Affected: through 8.0.23 |
| CVE-2021-44531 | 7.4 | Feb 24 | Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates Affected: through 5.7.37; 8.0.0 through 8.0.28 |
| CVE-2021-3712 | 7.4 | Aug 24 | ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length Affected: 5.7.0 through 5.7.35; 8.0.0 through 8.0.26 |
| CVE-2021-3450 | 7.4 | Mar 25 | CA certificate check bypass with X509_V_FLAG_X509_STRICT Affected: through 5.7.33; 8.0.15 through 8.0.23 |
| CVE-2022-1292 | 7.3 | May 3 | The c_rehash script allows command injection Affected: 5.0.0 through 5.7.38; 8.0.0 through 8.0.29 |
| CVE-2026-61094 | 7.2 | Jul 21 | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication) Affected: 8.4.0 through 8.4.10; 9.7.0; 9.7.1 |
| CVE-2026-60316 | 7.2 | Jul 21 | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin) Affected: 8.4.0 through 8.4.10; 9.7.0; 9.7.1 |
Showing 23