Mariadb vulnerabilities
57 CVEs and advisories name Mariadb as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-55859MariaDB Connector/R2DBC: Inappropriate Encoding for Output Context and Improper Encoding or Escaping of Output in org.mariadb:r2dbc-mariadb
- CVE-2026-55858MariaDB Connector/J: Inappropriate Encoding for Output Context in org.mariadb.jdbc:mariadb-java-client
- CVE-2026-55857MariaDB Connector/J: Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials
- CVE-2026-55856MariaDB Connector/J: Cleartext password disclosure to a MITM on the initial-handshake
- CVE-2026-55855MariaDB Connector/Node.js: Possible SQL injection in Buffer parameter escaping under big5/gbk/sjis/cp932/gb18030 client charsets
- CVE-2026-55854MariaDB Connector/Node.js: Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials in mariadb
- CVE-2026-55215MariaDB Connector/Node.js: Connector leaks the cleartext password to an MitM despite `ssl: true`
- CVE-2026-48165MariaDB: unsafe usage of `wsrep_sst_receive_address` values on the joiner side
- CVE-2026-48163MariaDB: wsrep SST unsafe parameter handling on the donor side (rsync)
- CVE-2026-44173MariaDB: FILE privilege was not checked for subqueries in the FROM clause
- CVE-2026-44172MariaDB: mysql_real_escape_string() incorrectly handled big5
- CVE-2026-44171MariaDB: path traversal in mbstream
- CVE-2026-44169MariaDB: Authorization bypass in role-based routine-level privilege check exposes stored routine definitions
- CVE-2026-44168MariaDB: wsrep SST unsafe parameter handling on the donor side
- CVE-2026-44170MariaDB: Argument injection in CONNECT REST Xcurl on Windows via unsanitized URL
- CVE-2026-49261MariaDB server has unsafe parameter handling in `wsrep_notify_cmd`
- CVE-2026-35549An issue was discovered in MariaDB Server before 11.4.10, 11.5.x through 11.8.x before 11.8.6, and 12.x before 12.2.2.
- CVE-2026-32710Heap-based Buffer Overflow in MariaDB
- CVE-2025-13699MariaDB mariadb-dump Utility Directory Traversal Remote Code Execution Vulnerability
- CVE-2023-52971MariaDB Server 10.10 through 10.11.* and 11.0 through 11.4.* crashes in JOIN::fix_all_splittings_in_plan.
- CVE-2023-52970MariaDB Server 10.4 through 10.5.*, 10.6 through 10.6.*, 10.7 through 10.11.*, 11.0 through 11.0.*, and 11.1 through 11.4.* crashes in Item_
- CVE-2023-52969MariaDB Server 10.4 through 10.5.*, 10.6 through 10.6.*, 10.7 through 10.11.*, and 11.0 through 11.0.* can sometimes crash with an empty bac
- CVE-2023-52968MariaDB Server 10.4 before 10.4.33, 10.5 before 10.5.24, 10.6 before 10.6.17, 10.7 through 10.11 before 10.11.7, 11.0 before 11.0.5, and 11.
- CVE-2022-24052MariaDB CONNECT Storage Engine Heap-based Buffer Overflow Privilege Escalation Vulnerability.
- CVE-2022-24051MariaDB CONNECT Storage Engine Format String Privilege Escalation Vulnerability.
- CVE-2022-24050MariaDB CONNECT Storage Engine Use-After-Free Privilege Escalation Vulnerability.
- CVE-2022-24048MariaDB CONNECT Storage Engine Stack-based Buffer Overflow Privilege Escalation Vulnerability.