CVE Tools
Track your stack

Databases

16,222 CVEs tracked since 1999. In the last 12 months, 3,735, +270% on the 12 before.

Databases by subsector, Oct 2026 so far

Oct 2026 so far: 669 CVEs across 6 subsectors. Area is each subsector's share; inside are the products it counted most. Point at one to read it.
  • Relational40561% · 8 vendors
  • Database tooling7511% · 9 vendors
  • Warehouses & analytics6610% · 6 vendors
  • Not yet sub-classified52The tagger has not placed these yet
  • NoSQL477% · 11 vendors
  • Caches & message queues244% · 4 vendors

Month by month

Every monthly snapshot of Databases. A column is the CVEs published that month.

Oct 2021 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Databases CVEs per month
MonthCVEs
2021-10175
2021-1129
2021-1237
2022-01214
2022-0248
2022-0358
2022-04161
2022-0532
2022-0638
2022-07118
2022-0822
2022-0920
2022-1090
2022-1135
2022-1228
2023-01115
2023-0262
2023-030
2023-04122
2023-0574
2023-0643
2023-0788
2023-0840
2023-0921
2023-10118
2023-1142
2023-1250
2024-0172
2024-0280
2024-0349
2024-04151
2024-0565
2024-0643
2024-07106
2024-0832
2024-0919
2024-10111
2024-1125
2024-1222
2025-01285
2025-0259
2025-0354
2025-04128
2025-0543
2025-0664
2025-07145
2025-0831
2025-0942
2025-10127
2025-1143
2025-1226
2026-0189
2026-0272
2026-0361
2026-04143
2026-05122
2026-06260
2026-071091
2026-08936
2026-09765
2026-10669

Vendors

Who shipped the most Databases CVEs in Oct 2026 so far, with their rank across all vendors.

  1. Oracle1,078#2
  2. Mongodb37#40
  3. MariaDB16#90
  4. Elastic14#105
  5. Part-db9#192

Weaknesses

The weakness classes behind Databases CVEs in Oct 2026 so far.

  1. CWE-284 Improper Access Control256
  2. CWE-200 Information Exposure79
  3. CWE-306 Missing Auth for Critical Function29
  4. CWE-862 Missing Authorization27
  5. CWE-863 Incorrect Authorization12
  6. CWE-122 Heap Buffer Overflow10

Latest CVEs

The 15 most recently published vulnerabilities in Databases.

  1. CVE-2026-115713Improper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Information Disclosure and Data Modification7.5
  2. CVE-2026-115712Incorrect Authorization in Elastic Cloud Enterprise (ECE) Leading to Unauthorized Modification of Platform Settings4.3
  3. CVE-2026-115711Insertion of Sensitive Information into Externally-Accessible File or Directory in Elastic Cloud Enterprise (ECE) Leading to Credential Disclosure6.4
  4. CVE-2026-115709Improper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Information Disclosure and Data Loss8.2
  5. CVE-2026-115708Improper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Authentication Bypass7.2
  6. CVE-2026-115707Insertion of Sensitive Information into Externally-Accessible File or Directory in Elastic Cloud Enterprise (ECE) Leading to Privilege Escalation6.4
  7. CVE-2026-115706Authorization Bypass Through User-Controlled Key in Elastic Cloud Enterprise (ECE) Leading to Privilege Escalation6.8
  8. CVE-2026-93009Dnsmasq: dnsmasq: heap out-of-bounds read in dhcpv6 option 39 fqdn decoder4.3
  9. CVE-2026-93010Dnsmasq: dnsmasq: --leasequery without address argument applies no source address check4.3
  10. CVE-2026-93006Dnsmasq: dnsmasq: tftp prefetch cache keyed on stale heap pointer serves wrong file content6.8
  11. CVE-2026-93007Dnsmasq: dnsmasq: tcp/53 child-slot exhaustion starves dnssec validation5.3
  12. CVE-2026-93011Dnsmasq: dnsmasq: heap out-of-bounds write in dnssec validator via to_wire/from_wire transforms5.3
  13. CVE-2026-93008Dnsmasq: dnsmasq: out-of-bailiwick cache injection through cname chase in split-dns configurations6.8
  14. CVE-2026-117548389-ds-base: 389-ds-base: null pointer dereference via modifydn using an attribute's schema alias name causes denial of service6.5
  15. CVE-2026-116641The DB Tools trust certificates issued by recoverable eMudhra intermediate CAs6.8

The record

Busiest month
Jul 2026, 1,091 CVEs
Oct 2026 so far
669 CVEs from 44 vendors
Deployment
On-prem, 100%
Monthly snapshots
284 since 1999
All 15 sectors on one map

Is your business exposed to threats like these?

Discuss a security assessment of your internet-facing systems. Scope, price and timing agreed before testing.

Request an assessment