CVE-2026-92262High· 8.8▾ MidnightPoC availableA flaw was found in MariaDB. An authenticated remote attacker can supply a crafted table name with the #mysql50# prefix, which bypasses normal filesystem encoding for table names. By accessing files under unencoded legacy names, the attack…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 48.4 · likelihood 0.3 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the vendor's CSAF advisory record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 17.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.7%
1 GitHub repo
critical → high
Last analysed / modified upstream
0.7% → 1.5%
9.9 → 8.8
A flaw was found in MariaDB. An authenticated remote attacker can supply a crafted table name with the #mysql50# prefix, which bypasses normal filesystem encoding for table names. By accessing files under unencoded legacy names, the attacker can achieve arbitrary code execution, exfiltrate sensitive information, corrupt data, or trigger a denial of service (DoS) by crashing the database server.
mariadb: MariaDB: Numerous issues caused by historical #mysql50# tablename encoding bypass. — rated Important by Red Hat. Released 2026-10-16, updated 2026-10-26.
Affected:
No fix planned:
Not affected:
Affected
Workarounds / mitigations:
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-106071Low· 3.6nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)
CVE-2026-106070Low· 3.7nodejs: Node.js: Security inspection bypass via crafted ZIP archive header mismatch (CVE-2026-106070)
CVE-2026-68138High· 7.8In the Linux kernel, the following vulnerability has been resolved: net/sched: serialize qdisc_rtab_list against concurrent get/put qdisc_get_rtab() and qdisc_put_rtab() mutate the process-global singly linked list qdisc_rtab_list and …
CVE-2026-68136Critical· 9.8In the Linux kernel, the following vulnerability has been resolved: net: gro: fix double aggregation of flush-marked skbs Commit 0ab03f353d36 ("net-gro: Fix GRO flush when receiving a GSO packet.") added a flush check to skb_gro_receiv…
CVE-2026-64564Critical· 9.8In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own transport in DEL-IP processing sctp_process_asconf() caches the transport the ASCONF chunk is processed against in asconf->transport …
CVE-2026-64563High· 7.8In the Linux kernel, the following vulnerability has been resolved: rhashtable: clear stale iter->p on table restart rhashtable_walk_start_check() has two restart paths when resuming a walk. When iter->walker.tbl is valid, it re-valida…