MA
Product
MariaDB
435
CVEs
0
On KEV
9.9
Max CVSS
15
New 30D
Severity mix
Critical 11High 72Medium 165Low 9
Watch
Add MariaDB to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2015-7744 | 5.9 | Jan 22 | wolfSSL (formerly CyaSSL) before 3.6.8 does not properly handle faults associated with the Chinese Remainder Theorem (CRT) process when allowing ephemeral key exchange without low… Affected: 5.5.0 before 5.5.46; 10.0.0 before 10.0.22; 10.1.0 before 10.1.9 |
| CVE-2024-27766 | 5.7 | Oct 17 | An issue in MariaDB v.11.1 allows a remote attacker to execute arbitrary code via the lib_mysqludf_sys.so function Affected: 11.1.0 |
| CVE-2023-39593 | 5.6 | Oct 17 | Insecure permissions in the sys_exec function of MariaDB v10.5 allows authenticated attackers to execute arbitrary commands with elevated privileges Affected: 10.5.0 |
| CVE-2017-3265 | 5.6 | Jan 27 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Packaging) Affected: 5.5.0 before 5.5.54; 10.0.0 before 10.0.29; 10.1.0 before 10.1.21 |
| CVE-2022-38791 | 5.5 | Aug 27 | In MariaDB before 10.9.2, compress_write in extra/mariabackup/ds_compress.cc does not release data_mutex upon a stream write failure, which allows local users to trigger a… Affected: 10.3.0 before 10.3.36; 10.4.0 before 10.4.26; 10.5.0 before 10.5.17; 10.6.0 before 10.6.9; 10.7.0 before 10.7.5; 10.8.0 before 10.8.4; +1 more |
| CVE-2022-31624 | 5.5 | May 25 | MariaDB Server before 10.7 is vulnerable to Denial of Service Affected: before 10.2.41; 10.3.0 before 10.3.32; 10.4.0 before 10.4.22; 10.5.0 before 10.5.13; 10.6.0 before 10.6.5 |
| CVE-2022-31623 | 5.5 | May 25 | MariaDB Server before 10.7 is vulnerable to Denial of Service Affected: before 10.2.42; 10.3.0 before 10.3.33; 10.4.0 before 10.4.23; 10.5.0 before 10.5.14; 10.6.0 before 10.6.6; 10.7.0 before 10.7.2 |
| CVE-2022-31622 | 5.5 | May 25 | MariaDB Server before 10.7 is vulnerable to Denial of Service Affected: before 10.2.42; 10.3.0 before 10.3.33; 10.4.0 before 10.4.23; 10.5.0 before 10.5.14; 10.6.0 before 10.6.6; 10.7.0 before 10.7.2 |
| CVE-2022-31621 | 5.5 | May 25 | MariaDB Server before 10.7 is vulnerable to Denial of Service Affected: before 10.2.41; 10.3.0 before 10.3.32; 10.4.0 before 10.4.22; 10.5.0 before 10.5.13; 10.6.0 before 10.6.5 |
| CVE-2021-46668 | 5.5 | Feb 1 | MariaDB through 10.5.9 allows an application crash via certain long SELECT DISTINCT statements that improperly interact with storage-engine resource limitations for temporary data… Affected: 10.2.0 before 10.2.43; 10.3.0 before 10.3.34; 10.4.0 before 10.4.24; 10.5.0 before 10.5.15; 10.6.0 before 10.6.7; 10.7.0 before 10.7.3 |
| CVE-2021-46667 | 5.5 | Feb 1 | MariaDB before 10.6.5 has a sql_lex.cc integer overflow, leading to an application crash Affected: before 10.2.41; 10.3.0 before 10.3.32; 10.4.0 before 10.4.22; 10.5.0 before 10.5.13; 10.6.0 before 10.6.5 |
| CVE-2021-46666 | 5.5 | Feb 1 | MariaDB before 10.6.2 allows an application crash because of mishandling of a pushdown from a HAVING clause to a WHERE clause Affected: before 10.2.39; 10.3.0 before 10.3.30; 10.4.0 before 10.4.20; 10.5.0 before 10.5.11; 10.6.0 before 10.6.2 |
| CVE-2021-46665 | 5.5 | Feb 1 | MariaDB through 10.5.9 allows a sql_parse.cc application crash because of incorrect used_tables expectations Affected: 10.2.0 before 10.2.43; 10.3.0 before 10.3.34; 10.4.0 before 10.4.24; 10.5.0 before 10.5.15; 10.6.0 before 10.6.7; 10.7.0 before 10.7.3 |
| CVE-2021-46664 | 5.5 | Feb 1 | MariaDB through 10.5.9 allows an application crash in sub_select_postjoin_aggr for a NULL value of aggr Affected: 10.2.0 before 10.2.43; 10.3.0 before 10.3.34; 10.4.0 before 10.4.24; 10.5.0 before 10.5.15; 10.6.0 before 10.6.7; 10.7.0 before 10.7.3 |
| CVE-2021-46663 | 5.5 | Feb 1 | MariaDB through 10.5.13 allows a ha_maria::extra application crash via certain SELECT statements Affected: 10.2.41 before 10.2.43; 10.3.32 before 10.3.34; 10.4.22 before 10.4.24; 10.5.9 before 10.5.15; 10.6.0 before 10.6.7; 10.7.0 before 10.7.3 |
| CVE-2021-46662 | 5.5 | Feb 1 | MariaDB through 10.5.9 allows a set_var.cc application crash via certain uses of an UPDATE statement in conjunction with a nested subquery Affected: 10.3.0 before 10.3.32; 10.4.0 before 10.4.22; 10.5.0 before 10.5.13; 10.6.0 before 10.6.5 |
| CVE-2021-46661 | 5.5 | Feb 1 | MariaDB through 10.5.9 allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE) Affected: 10.2.0 before 10.2.43; 10.3.0 before 10.3.34; 10.4.0 before 10.4.24; 10.5.0 before 10.5.15; 10.6.0 before 10.6.7; 10.7.0 before 10.7.3 |
| CVE-2021-46659 | 5.5 | Jan 29 | MariaDB before 10.7.2 allows an application crash because it does not recognize that SELECT_LEX::nest_level is local to each VIEW Affected: 5.5.0 before 10.2.42; 10.3.0 before 10.3.33; 10.4.0 before 10.4.23; 10.5.0 before 10.5.14; 10.6.0 before 10.6.6; 10.7.0 before 10.7.2 |
| CVE-2021-46658 | 5.5 | Jan 29 | save_window_function_values in MariaDB before 10.6.3 allows an application crash because of incorrect handling of with_window_func=true for a subquery Affected: 10.2.0 before 10.2.40; 10.3.0 before 10.3.31; 10.4.0 before 10.4.21; 10.5.0 before 10.5.12; 10.6.0 before 10.6.3 |
| CVE-2021-46657 | 5.5 | Jan 29 | get_sort_by_table in MariaDB before 10.6.2 allows an application crash via certain subquery uses of ORDER BY Affected: 5.5.20 through 5.5.68; 10.0.0 before 10.2.39; 10.3.0 before 10.3.30; 10.4.0 before 10.4.20; 10.5.0 before 10.5.11; 10.6.0 before 10.6.2 |
| CVE-2021-35604 | 5.5 | Oct 20 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB) Affected: 10.2.0 before 10.2.41; 10.3.0 before 10.3.32; 10.4.0 before 10.4.22; 10.5.0 before 10.5.13; 10.6.0 before 10.6.3 |
| CVE-2020-2760 | 5.5 | Apr 15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB) Affected: 10.2.0 before 10.2.32; 10.3.0 before 10.3.23; 10.4.0 before 10.4.13 |
| CVE-2015-2326 | 5.5 | Jan 14 | The pcre_compile2 function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code and cause a denial of service (out-of-bounds read) via regular… Affected: 10.0.0 before 10.0.18 |
| CVE-2019-2758 | 5.5 | Jul 23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB) Affected: 10.2.0 before 10.2.26; 10.3.0 before 10.3.17; 10.4.0 before 10.4.7 |
| CVE-2018-3185 | 5.5 | Oct 17 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB) Affected: 10.2.0 before 10.2.19; 10.3.0 before 10.3.11 |
| CVE-2018-2787 | 5.5 | Apr 19 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB) Affected: 10.0.0 before 10.0.35; 10.1.0 before 10.1.33; 10.2.0 before 10.2.15 |
| CVE-2018-2786 | 5.5 | Apr 19 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB) Affected: 10.2.0 before 10.2.15 |
| CVE-2016-7440 | 5.5 | Dec 13 | The C software implementation of AES Encryption and Decryption in wolfSSL (formerly CyaSSL) before 3.9.10 makes it easier for local users to discover AES keys by leveraging… Affected: 5.5.0 before 5.5.53; 10.0.0 before 10.0.28; 10.1.0 before 10.1.19 |
| CVE-2016-0666 | 5.5 | Apr 21 | Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before… Affected: 5.5.20 before 5.5.49; 10.0.0 before 10.0.25; 10.1.0 before 10.1.14 |
| CVE-2016-0651 | 5.5 | Apr 21 | Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows local users to affect availability via vectors related to Optimizer Affected: 5.5.0 before 5.5.47; 10.0.0 before 10.0.23; 10.1.0 before 10.1.10 |
| CVE-2016-0650 | 5.5 | Apr 21 | Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x before 10.0.24, and 10.1.x before… Affected: 5.5.20 before 5.5.48; 10.0.0 before 10.0.24; 10.1.0 before 10.1.12 |
| CVE-2016-0649 | 5.5 | Apr 21 | Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x before 10.0.24, and 10.1.x before… Affected: 5.5.20 before 5.5.48; 10.0.0 before 10.0.24; 10.1.0 before 10.1.12 |
| CVE-2016-0648 | 5.5 | Apr 21 | Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before… Affected: 5.5.20 before 5.5.49; 10.0.0 before 10.0.25; 10.1.0 before 10.1.14 |
| CVE-2016-0647 | 5.5 | Apr 21 | Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before… Affected: 5.5.20 before 5.5.49; 10.0.0 before 10.0.25; 10.1.0 before 10.1.14 |
| CVE-2016-0646 | 5.5 | Apr 21 | Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x before 10.0.24, and 10.1.x before… Affected: 5.5.20 before 5.5.48; 10.0.0 before 10.0.24; 10.1.0 before 10.1.12 |
| CVE-2016-0644 | 5.5 | Apr 21 | Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x before 10.0.24, and 10.1.x before… Affected: 5.5.20 before 5.5.48; 10.0.0 before 10.0.24; 10.1.0 before 10.1.12 |
| CVE-2026-85985 | 5.4 | Oct 16 | MariaDB: Unauthorized file access via CONNECT engine UDFs Affected: 10.6.1 before 10.6.28; 10.11.1 before 10.11.19; 11.4.1 before 11.4.13; 11.8.1 before 11.8.9; 12.3.1 before 12.3.3; 13.0.1 |
| CVE-2013-0375 | 5.4 | Jan 17 | Unspecified vulnerability in the Server component in Oracle MySQL 5.1.66 and earlier, and 5.1.28 and earlier, allows remote authenticated users to affect confidentiality and… Affected: 5.1.0 before 5.1.67; 5.2.0 before 5.2.14; 5.3.0 before 5.3.12 |
| CVE-2026-44173 | 5.3 | Jun 12 | MariaDB: FILE privilege was not checked for subqueries in the FROM clause Affected: 10.6.1 before 10.6.26; 10.11.1 before 10.11.17; 11.4.1 before 11.4.11; 11.8.1 before 11.8.7; 12.3.1 |
| CVE-2020-14550 | 5.3 | Jul 15 | Vulnerability in the MySQL Client product of Oracle MySQL (component: C API) Affected: 5.5.0 before 5.5.61; 10.0.0 before 10.0.35; 10.1.0 before 10.1.33; 10.2.0 before 10.2.15 |
| CVE-2020-2752 | 5.3 | Apr 15 | Vulnerability in the MySQL Client product of Oracle MySQL (component: C API) Affected: 5.5.0 before 5.5.68; 10.1.0 before 10.1.45; 10.2.0 before 10.2.32; 10.3.0 before 10.3.23; 10.4.0 before 10.4.13 |
| CVE-2018-3174 | 5.3 | Oct 17 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client programs) Affected: 5.5.0 before 5.5.62; 10.0.0 before 10.0.37; 10.1.0 before 10.1.37; 10.2.0 before 10.2.19; 10.3.0 before 10.3.11 |
| CVE-2017-3636 | 5.3 | Aug 8 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client programs) Affected: 5.5.0 before 5.5.57; 10.0.0 before 10.0.32; 10.1.0 before 10.1.26; 10.2.0 before 10.2.8 |
| CVE-2016-3615 | 5.3 | Jul 21 | Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier, 5.6.30 and earlier, and 5.7.12 and earlier and MariaDB before 5.5.50, 10.0.x before 10.0.26, and 10.1.x before… Affected: 5.5.20 before 5.5.50; 10.0.0 before 10.0.26; 10.1.0 before 10.1.15 |
| CVE-2019-2739 | 5.1 | Jul 23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Privileges) Affected: 5.5.0 before 5.5.65; 10.1.0 before 10.1.41; 10.2.0 before 10.2.26; 10.3.0 before 10.3.17; 10.4.0 before 10.4.7 |
| CVE-2016-0641 | 5.1 | Apr 21 | Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x before 10.0.24, and 10.1.x before… Affected: 5.5.20 through 5.5.47; 10.0.0 before 10.0.24; 10.1.0 before 10.1.12 |
| CVE-2018-3081 | 5.0 | Jul 18 | Vulnerability in the MySQL Client component of Oracle MySQL (subcomponent: Client programs) Affected: 5.5.0 before 5.5.61; 10.0.0 before 10.0.35; 10.1.0 before 10.1.33; 10.2.0 before 10.2.15 |
| CVE-2023-52968 | 4.9 | Mar 8 | MariaDB Server 10.4 before 10.4.33, 10.5 before 10.5.24, 10.6 before 10.6.17, 10.7 through 10.11 before 10.11.7, 11.0 before 11.0.5, and 11.1 before 11.1.4 calls… Affected: 10.4 before 10.4.33; 10.5 before 10.5.24; 10.6 before 10.6.17; 10.7 before 10.11.7; 11.0 before 11.0.5; 11.1 before 11.1.4 |
| CVE-2023-52971 | 4.9 | Mar 8 | MariaDB Server 10.10 through 10.11.* and 11.0 through 11.4.* crashes in JOIN::fix_all_splittings_in_plan Affected: 10.10 before 10.11.*; 11.0 before 11.4.* |
| CVE-2023-52970 | 4.9 | Mar 8 | MariaDB Server 10.4 through 10.5.*, 10.6 through 10.6.*, 10.7 through 10.11.*, 11.0 through 11.0.*, and 11.1 through 11.4.* crashes in… Affected: 10.4 before 10.5.*; 10.6 before 10.6.*; 10.7 before 10.11.*; 11.0 before 11.0.*; 11.1 before 11.4.* |