MS
Product
MySQL Server
356
CVEs
0
On KEV
9.8
Max CVSS
12
New 30D
Severity mix
Critical 7High 23Medium 303Low 23
Watch
Add MySQL Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-60163 | 8.4 | Jul 21 | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin) Affected: 8.4.0 through 8.4.10; 9.7.0; 9.7.1 |
| CVE-2026-60315 | 8.2 | Jul 21 | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin) Affected: 8.4.0 through 8.4.10; 9.7.0; 9.7.1 |
| CVE-2022-21824 | 8.2 | Feb 24 | Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously… Affected: through 8.0.29 |
| CVE-2022-27778 | 8.1 | Jun 1 | A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is used together with `--remove-on-error` Affected: through 5.7.38; 8.0.0 through 8.0.29 |
| CVE-2021-22901 | 8.1 | Jun 11 | curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection Affected: through 5.7.34; 8.0.0 through 8.0.25 |
| CVE-2019-5443 | 7.8 | Jul 2 | A non-privileged user or program can put code and a config file in a known non-privileged path (under C:/usr/local/) that will make curl <= 7.65.1 automatically run the code (as… Affected: 5.0.0 through 5.7.27; 8.0.0 through 8.0.17 |
| CVE-2019-5436 | 7.8 | May 28 | A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1 Affected: through 5.7.27; 5.7.28 through 8.0.17 |
| CVE-2026-46863 | 7.5 | Jun 16 | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Connection Handling) Affected: 8.4.0 through 8.4.9; 9.0.0 through 9.7.0 |
| CVE-2025-21521 | 7.5 | Jan 21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Thread Pooling) Affected: through 8.0.39; through 8.4.2; through 9.0.1 |
| CVE-2023-21912 | 7.5 | Apr 18 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges) Affected: 5.7.0 through 5.7.41; 8.0.0 through 8.0.30 |
| CVE-2021-35583 | 7.5 | Oct 20 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Windows) Affected: 8.0.0 through 8.0.25 |
| CVE-2021-22946 | 7.5 | Sep 29 | A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line… Affected: 5.7.0 through 5.7.35; 8.0.0 through 8.0.26 |
| CVE-2021-22926 | 7.5 | Aug 5 | libcurl-using applications can ask for a specific client certificate to be used in a transfer Affected: 5.7.0 through 5.7.35; 8.0.0 through 8.0.26 |
| CVE-2021-36222 | 7.5 | Jul 22 | ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.4 and 1.19.x before 1.19.2 allows remote attackers to cause a NULL… Affected: 8.0.0 through 8.0.26 |
| CVE-2021-21348 | 7.5 | Mar 22 | XStream is vulnerable to an attack using Regular Expression for a Denial of Service (ReDos) Affected: through 8.0.27 |
| CVE-2021-23840 | 7.5 | Feb 16 | Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable… Affected: before 5.7.33; 8.0.15 before 8.0.23 |
| CVE-2020-28196 | 7.5 | Nov 6 | MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support… Affected: through 8.0.23 |
| CVE-2021-44531 | 7.4 | Feb 24 | Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates Affected: through 5.7.37; 8.0.0 through 8.0.28 |
| CVE-2021-3712 | 7.4 | Aug 24 | ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length Affected: 5.7.0 through 5.7.35; 8.0.0 through 8.0.26 |
| CVE-2021-3450 | 7.4 | Mar 25 | CA certificate check bypass with X509_V_FLAG_X509_STRICT Affected: through 5.7.33; 8.0.15 through 8.0.23 |
| CVE-2022-1292 | 7.3 | May 3 | The c_rehash script allows command injection Affected: 5.0.0 through 5.7.38; 8.0.0 through 8.0.29 |
| CVE-2026-61094 | 7.2 | Jul 21 | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication) Affected: 8.4.0 through 8.4.10; 9.7.0; 9.7.1 |
| CVE-2026-60316 | 7.2 | Jul 21 | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin) Affected: 8.4.0 through 8.4.10; 9.7.0; 9.7.1 |
Showing 23