InfraGuard
Se connecter Essayer maintenant Acheter maintenant

Vulnérabilités de MariaDB (liste des CVE)

MariaDB est un système de gestion de base de données relationnelle open source.

430 CVE10.0 CVSS max

Ce que montre l’historique

Au cours de son histoire, MariaDB a accumulé 430 CVE avec un score CVSS maximal de 10.0 et 0 vulnérabilité exploitée connue.

Comment rester protégé

Assurez-vous que les systèmes exécutent des branches de version prises en charge telles que 11.4 ou 10.11, et auditez régulièrement les versions installées.

Vérifiez votre versionmariadb --version

Branches de versions concernées

Vulnérabilités connues

CVE Titre Versions concernées CVSS Exploitée EPSS Publication
CVE-2026-97380 MariaDB: GRANT PROXY with empty password incorrectly checks grantor's privileges ≥ 10.6.1 < 10.6.28 ≥ 10.11.1 < 10.11.19 ≥ 11.4.1 < 11.4.13 8.8 — 2026-10-16
CVE-2026-86047 MariaDB: Insufficient quoting in mariadb-dump and SHOW commands ≥ 10.6.1 < 10.6.28 ≥ 10.11.1 < 10.11.19 ≥ 11.4.1 < 11.4.13 7.7 — 2026-10-16
CVE-2026-92262 MariaDB: Numerous issues caused by historical #mysql50# tablename encoding bypass. ≥ 10.6.1 < 10.6.28 ≥ 10.11.1 < 10.11.19 ≥ 11.4.1 < 11.4.13 9.9 — 2026-10-16
CVE-2026-85745 MariaDB: Out-of-bound buffer read on in `ST_Area` of a multipolygon. ≥ 10.6.1 < 10.6.28 ≥ 10.11.1 < 10.11.19 ≥ 11.4.1 < 11.4.13 4.3 — 2026-10-16
CVE-2026-85746 MariaDB: Out-of-bound buffer write on in `ST_AsText` of nested GeometryCollections ≥ 10.6.1 < 10.6.28 ≥ 10.11.1 < 10.11.19 ≥ 11.4.1 < 11.4.13 9.9 — 2026-10-16
CVE-2026-85748 MariaDB: Use-after-free with a large number of SYS_REFCURSOR's ≥ 12.3.1 < 12.3.3 = 13.0.1 9.9 — 2026-10-16
CVE-2026-85985 MariaDB: Unauthorized file access via CONNECT engine UDFs ≥ 10.6.1 < 10.6.28 ≥ 10.11.1 < 10.11.19 ≥ 11.4.1 < 11.4.13 5.4 — 2026-10-16
CVE-2026-107822 MariaDB: database privilege escalation via user / role name collision in the acl cache ≥ 10.6.1 < 10.6.28 ≥ 10.11.1 < 10.11.19 ≥ 11.4.1 < 11.4.13 6.4 — 2026-10-09
CVE-2026-107823 MariaDB: privilege escalation via incorrect view frm parsing ≥ 10.6.1 < 10.6.28 ≥ 10.11.1 < 10.11.19 ≥ 11.4.1 < 11.4.13 7.2 — 2026-10-09
CVE-2026-107816 MariaDB: `qc_info` plugin can do OOB reads if query contains \0 ≥ 10.6.1 < 10.6.28 ≥ 10.11.1 < 10.11.19 ≥ 11.4.1 < 11.4.13 6.4 — 2026-10-09
CVE-2026-107817 MariaDB: mysql_json plugin OOB reads ≥ 10.6.1 < 10.6.28 ≥ 10.11.1 < 10.11.19 ≥ 11.4.1 < 11.4.13 4.4 — 2026-10-09
CVE-2026-107818 MariaDB: environment injection via wsrep bootstrap in the mariadb.service file ≥ 10.6.1 < 10.6.28 ≥ 10.11.1 < 10.11.19 ≥ 11.4.1 < 11.4.13 8.4 — 2026-10-09
CVE-2026-107821 MariaDB: insufficient validation of binary frm data when opening a table ≥ 10.6.1 < 10.6.28 ≥ 10.11.1 < 10.11.19 ≥ 11.4.1 < 11.4.13 8.0 — 2026-10-09
CVE-2026-107815 MariaDB: one byte OOB write in DOS tables of the CONNECT engine ≥ 10.6.1 < 10.6.28 ≥ 10.11.1 < 10.11.19 ≥ 11.4.1 < 11.4.13 8.5 — 2026-10-09
CVE-2026-107814 MariaDB: Insecure $HOME in MariaDB rpm packages ≥ 10.6.1 < 10.6.28 ≥ 10.11.1 < 10.11.19 ≥ 11.4.1 < 11.4.13 8.4 — 2026-10-09
CVE-2026-48163 MariaDB: wsrep SST unsafe parameter handling on the donor side (rsync) ≥ 10.6.1 < 10.6.27 ≥ 10.11.1 < 10.11.18 ≥ 11.4.1 < 11.4.12 7.2 — 2026-06-12
CVE-2026-48165 MariaDB: unsafe usage of `wsrep_sst_receive_address` values on the joiner side ≥ 10.6.1 < 10.6.27 ≥ 10.11.1 < 10.11.18 ≥ 11.4.1 < 11.4.12 7.2 — 2026-06-12
CVE-2026-44172 MariaDB: mysql_real_escape_string() incorrectly handled big5 = 3.3.18 = 3.4.8 6.9 — 2026-06-12
CVE-2026-44173 MariaDB: FILE privilege was not checked for subqueries in the FROM clause ≥ 10.6.1 < 10.6.26 ≥ 10.11.1 < 10.11.17 ≥ 11.4.1 < 11.4.11 5.3 — 2026-06-12
CVE-2026-44168 MariaDB: wsrep SST unsafe parameter handling on the donor side ≥ 10.6.1 < 10.6.26 ≥ 10.11.1 < 10.11.17 ≥ 11.4.1 < 11.4.11 8.0 — 2026-06-12
CVE-2026-44169 MariaDB: Authorization bypass in role-based routine-level privilege check exposes stored routine definitions ≥ 11.4.1 < 11.4.11 ≥ 11.8.1 < 11.8.7 = 12.3.1 4.3 — 2026-06-12
CVE-2026-44170 MariaDB: Argument injection in CONNECT REST Xcurl on Windows via unsanitized URL ≥ 10.6.1 < 10.6.26 ≥ 10.11.1 < 10.11.17 ≥ 11.4.1 < 11.4.11 6.3 — 2026-06-12
CVE-2026-44171 MariaDB: path traversal in mbstream ≥ 10.6.1 < 10.6.26 ≥ 10.11.1 < 10.11.17 ≥ 11.4.1 < 11.4.11 7.8 — 2026-06-12
CVE-2026-49261 MariaDB server has unsafe parameter handling in `wsrep_notify_cmd` ≥ 10.6.1 < 10.6.27 ≥ 10.11.1 < 10.11.18 ≥ 11.4.1 < 11.4.12 9.8 — 2026-06-11
CVE-2026-35549 An issue was discovered in MariaDB Server before 11.4.10, 11.5.x through 11.8.x before 11.8.6, and 12.x before... ≥ 11.8.4 < 11.8.6 ≥ 12.1.1 < 12.2.2 = 11.4.9 6.5 — 2026-04-03
CVE-2026-32710 Heap-based Buffer Overflow in MariaDB ≥ 11.4.1 < 11.4.10 ≥ 11.8.1 < 11.8.6 = 12.1.2 9.9 — 2026-03-20
CVE-2026-3494 MariaDB Server Audit Plugin Comment Handling Bypass ≤ 10.6.24 ≥ 10.7.0 ≤ 10.11.15 ≥ 11.0.0 ≤ 11.4.9 5.3 — 2026-03-03
CVE-2023-26785 MariaDB v10.5 was discovered to contain a remote code execution (RCE) vulnerability via UDF Code in a Shared O... = 10.5.0 9.8 — 2024-10-17
CVE-2023-39593 Insecure permissions in the sys_exec function of MariaDB v10.5 allows authenticated attackers to execute arbit... = 10.5.0 5.6 — 2024-10-17
CVE-2024-27766 An issue in MariaDB v.11.1 allows a remote attacker to execute arbitrary code via the lib_mysqludf_sys.so func... = 11.1.0 5.7 — 2024-10-17
CVE-2023-22084 Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are af... ≥ 10.4.0 < 10.4.32 ≥ 10.5.0 < 10.5.23 ≥ 10.6.0 < 10.6.16 4.9 — 2023-10-17
CVE-2023-5157 Mariadb: node crashes with transport endpoint is not connected mysqld got signal 6 < 10.3.36 ≥ 10.4.0 < 10.4.26 ≥ 10.5.0 < 10.5.17 7.5 — 2023-09-27
CVE-2022-47015 MariaDB Server before 10.3.34 thru 10.9.3 is vulnerable to Denial of Service. It is possible for function spid... ≥ 10.3.0 < 10.3.39 ≥ 10.4.0 < 10.4.29 ≥ 10.5.0 < 10.5.20 6.5 — 2023-01-20
CVE-2022-21595 Vulnerability in the MySQL Server product of Oracle MySQL (component: C API). Supported versions that are affe... ≥ 10.2.0 < 10.2.42 ≥ 10.3.0 < 10.3.33 ≥ 10.4.0 < 10.4.23 4.4 — 2022-10-18
CVE-2022-38791 In MariaDB before 10.9.2, compress_write in extra/mariabackup/ds_compress.cc does not release data_mutex upon... ≥ 10.3.0 < 10.3.36 ≥ 10.4.0 < 10.4.26 ≥ 10.5.0 < 10.5.17 5.5 — 2022-08-27
CVE-2022-32081 MariaDB v10.4 to v10.7 was discovered to contain an use-after-poison in prepare_inplace_add_virtual at /storag... ≥ 10.4.0 < 10.4.26 ≥ 10.5.0 < 10.5.17 ≥ 10.6.0 < 10.6.9 7.5 — 2022-07-01
CVE-2022-32082 MariaDB v10.5 to v10.7 was discovered to contain an assertion failure at table->get_ref_count() == 0 in dict0d... ≥ 10.5.0 < 10.5.17 ≥ 10.6.0 < 10.6.9 ≥ 10.7.0 < 10.7.5 7.5 — 2022-07-01
CVE-2022-32083 MariaDB v10.2 to v10.6.1 was discovered to contain a segmentation fault via the component Item_subselect::init... ≥ 10.2.0 < 10.2.44 ≥ 10.3.0 < 10.3.35 ≥ 10.4.0 < 10.4.25 7.5 — 2022-07-01
CVE-2022-32084 MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component sub_select. ≥ 10.3.0 < 10.3.36 ≥ 10.4.0 < 10.4.26 ≥ 10.5.0 < 10.5.17 7.5 — 2022-07-01
CVE-2022-32085 MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Item_func_in::cleanup/... ≥ 10.2.0 < 10.2.44 ≥ 10.3.0 < 10.3.35 ≥ 10.4.0 < 10.4.25 7.5 — 2022-07-01
CVE-2022-32086 MariaDB v10.4 to v10.8 was discovered to contain a segmentation fault via the component Item_field::fix_outer_... ≥ 10.4.0 < 10.4.25 ≥ 10.5.0 < 10.5.16 ≥ 10.6.0 < 10.6.8 7.5 — 2022-07-01
CVE-2022-32087 MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Item_args::walk_args. ≥ 10.3.0 < 10.3.35 ≥ 10.4.0 < 10.4.25 ≥ 10.5.0 < 10.5.16 7.5 — 2022-07-01
CVE-2022-32088 MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Exec_time_tracker::get... ≥ 10.2.0 < 10.2.44 ≥ 10.3.0 < 10.3.35 ≥ 10.4.0 < 10.4.25 7.5 — 2022-07-01
CVE-2022-32089 MariaDB v10.5 to v10.7 was discovered to contain a segmentation fault via the component st_select_lex_unit::ex... ≥ 10.4.0 < 10.4.26 ≥ 10.5.0 < 10.5.17 ≥ 10.6.0 < 10.6.9 7.5 — 2022-07-01
CVE-2022-32091 MariaDB v10.7 was discovered to contain an use-after-poison in in __interceptor_memset at /libsanitizer/saniti... ≥ 10.3.0 < 10.3.36 ≥ 10.4.0 < 10.4.26 ≥ 10.5.0 < 10.5.17 7.5 — 2022-07-01
CVE-2022-31621 MariaDB Server before 10.7 is vulnerable to Denial of Service. In extra/mariabackup/ds_xbstream.cc, when an er... < 10.2.41 ≥ 10.3.0 < 10.3.32 ≥ 10.4.0 < 10.4.22 5.5 — 2022-05-25
CVE-2022-31622 MariaDB Server before 10.7 is vulnerable to Denial of Service. In extra/mariabackup/ds_compress.cc, when an er... < 10.2.42 ≥ 10.3.0 < 10.3.33 ≥ 10.4.0 < 10.4.23 5.5 — 2022-05-25

Suivez ces versions sur vos propres serveurs

InfraGuard collecte les versions logicielles installées sur chaque serveur et signale celles qui présentent des vulnérabilités connues. Auto-hébergé : rien ne quitte votre réseau.

Essayer la démo en direct Acheter maintenant

Récapitulatif hebdomadaire des vulnérabilités exploitées

Les ajouts au KEV qui comptent pour les serveurs auto-hébergés, une fois par semaine. Aucun autre e-mail.

Données : CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (voir EPSS sur https://www.first.org/epss), endoflife.date. Liste des logiciels : awesome-selfhosted (CC BY-SA 3.0).