CVE Tools
Track your stack

MariaDB

439 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for MariaDB, a product in the databases space. Use it to gauge the current risk picture and drill into individual advisories.

MariaDB CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
MariaDB CVEs per month
MonthCVEs
2024-120
2025-010
2025-020
2025-034
2025-041
2025-050
2025-060
2025-070
2025-080
2025-090
2025-100
2025-110
2025-121
2026-010
2026-020
2026-032
2026-041
2026-050
2026-069
2026-070
2026-080
2026-090
2026-1015
2026-110

Severity

How the 439 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical123%
  • High8018%
  • Medium29868%
  • Low4911%

Latest CVEs

The 15 most recently published vulnerabilities affecting MariaDB.

  1. CVE-2026-86047MariaDB: Insufficient quoting in mariadb-dump and SHOW commands7.7
  2. CVE-2026-85745MariaDB: Out-of-bound buffer read on in `ST_Area` of a multipolygon.4.3
  3. CVE-2026-85748MariaDB: Use-after-free with a large number of SYS_REFCURSOR's9.9
  4. CVE-2026-85746MariaDB: Out-of-bound buffer write on in `ST_AsText` of nested GeometryCollections9.9
  5. CVE-2026-92262MariaDB: Numerous issues caused by historical #mysql50# tablename encoding bypass.9.9
  6. CVE-2026-97380MariaDB: GRANT PROXY with empty password incorrectly checks grantor's privileges8.8
  7. CVE-2026-85985MariaDB: Unauthorized file access via CONNECT engine UDFs5.4
  8. CVE-2026-107823MariaDB: privilege escalation via incorrect view frm parsing7.2
  9. CVE-2026-107822MariaDB: database privilege escalation via user / role name collision in the acl cache6.4
  10. CVE-2026-107821MariaDB: insufficient validation of binary frm data when opening a table8.0
  11. CVE-2026-107818MariaDB: environment injection via wsrep bootstrap in the mariadb.service file8.4
  12. CVE-2026-107817MariaDB: mysql_json plugin OOB reads4.4
  13. CVE-2026-107816MariaDB: `qc_info` plugin can do OOB reads if query contains \06.4
  14. CVE-2026-107815MariaDB: one byte OOB write in DOS tables of the CONNECT engine8.5
  15. CVE-2026-107814MariaDB: Insecure $HOME in MariaDB rpm packages8.4

Product grouping is registry-driven, with AI assist and human review. How it works