mariadb has 22 CVEs on record. Disclosure cadence is accelerating: 21 in the last 90 days against 1 in the 90 before. The busiest recent month was October 2026 with 13. The median CVSS is 6.5 (medium), with 1 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-522 (5) and CWE-89 (4). Most affected products: mariadb (16), org.mariadb.jdbc:mariadb-java-client (3), org.mariadb:r2dbc-mariadb (2).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.5
- Publish → KEV
- —
- Last 90 days
- 21 prev 1
Products
- mariadb 16
- org.mariadb.jdbc:mariadb-java-client 3
- org.mariadb:r2dbc-mariadb 2
- server 1
Worst active — by depth score
CVE-2026-107821High· 8.0MariaDB server is a community developed fork of MySQL server56CVE-2026-44172Critical· 9.1MariaDB server is a community developed fork of MySQL server50CVE-2026-107815High· 8.5MariaDB server is a community developed fork of MySQL server47CVE-2026-107818High· 8.4MariaDB server is a community developed fork of MySQL server46CVE-2026-107814High· 8.4MariaDB server is a community developed fork of MySQL server46
mariadb vulnerabilities
CVEs affecting mariadb, newest first. Open any entry for full detail, references, and exploit status.
22 CVEsRSS
CVE-2026-85745Medium· 4.3MariaDB: Out-of-bound buffer read on in `ST_Area` of a multipolygon.
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_Area reads beyond the allocated buffer when processing invalid WKB for a MultiPolygon because the …
CVE-2026-107823High· 7.2MariaDB server is a community developed fork of MySQL server
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the MariaDB view FRM parser did not safely encode embedded newline characters in a username. An accou…
CVE-2026-107822Medium· 6.4MariaDB server is a community developed fork of MySQL server
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user …
CVE-2026-107821High· 8.0PoCMariaDB server is a community developed fork of MySQL server
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, and field boundaries in FRM metadata while…
CVE-2026-107818High· 8.4MariaDB server is a community developed fork of MySQL server
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster during the next service restart. A databa…
CVE-2026-107817Medium· 4.4MariaDB server is a community developed fork of MySQL server
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mysql_json plugin assumed that imported MySQL tables contained valid MySQL binary JSON data. A sp…
CVE-2026-107816Medium· 6.4MariaDB server is a community developed fork of MySQL server
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc_info plugin could be confused by a query containing embedded null bytes. Reading information_s…
CVE-2026-107815High· 8.5MariaDB server is a community developed fork of MySQL server
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundary check that permitted a one-byte null w…
CVE-2026-107814High· 8.4MariaDB server is a community developed fork of MySQL server
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as …
CVE-2026-107385High· 7.4MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, text-protocol escaping always prefixes quotes with a backslash and does not honor the…
CVE-2026-107384High· 8.1MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.2.0 until 3.2.5, 3.3.4, 3.4.7, and 3.5.4, applications that enable permitSetMultiParamEntries can pass objects whose ke…
CVE-2026-107383High· 7.5MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, the GeoJSON Polygon and MultiPolygon binary encoders size a Buffer.allocUnsafe() allo…
CVE-2026-107382Medium· 5.9MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.3.0 until 3.5.4, the zero-configuration TLS fingerprint-validation path calls Ed25519PasswordAuth.hash() through Authen…
CVE-2026-55856Medium· 5.9MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases
MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, when a Java application connects with sslMode=verify-full or sslMode=verify-ca, supplies a pa…
CVE-2026-55857Medium· 5.9MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases
MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, PAM dialog authentication can be coerced into transmitting the account password over an insec…
CVE-2026-55858Medium· 5.9MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases
MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, the connector encodes and decodes protocol text and performs client-side escaping under the a…
CVE-2026-55859Medium· 5.9MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented in Java
MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented in Java. Prior to 1.4.1, org.mariadb:r2dbc-mariadb encodes and decodes all character data under the assumption that the connection character set is UTF-8. A s…
CVE-2026-55860Medium· 5.9MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented in Java
MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented in Java. Prior to 1.4.1, org.mariadb:r2dbc-mariadb does not gate clear-text password authentication plugins on transport encryption because the Authentication…
CVE-2026-55855Medium· 6.5MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3, MariaDB Connector/Node.js permits SQL injection when attacker-controlled Buffer param…
CVE-2026-55854Medium· 5.9MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3, MariaDB Connector/Node.js can disclose an account password when PAM dialog authentica…
CVE-2026-55215High· 7.5MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to versions 3.3.3, 3.4.6, and 3.5.3, when ssl is enabled without a pinned CA or server certificate, MariaDB Connector/No…
CVE-2026-44172Critical· 9.1⚖ disputedMariaDB server is a community developed fork of MySQL server
MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysql_real_escape_string() and sending it to the database using text pr…