M
Vendor security profile
mariadb
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs26
Critical1
CISA KEV0
Public exploit1
Patch rate%8
Avg. CVSS7.0
12-month vulnerability rate
0
0
0
0
1
1
0
7
0
3
0
13
CVE KEV
CVE severity distribution
26toplam CVE
Critical1 (4%)
High13 (50%)
Medium12 (46%)
Patch and exploitation view
%8
Verified patch
%0
CISA KEV
%4
Public exploit
2Patch available
0Partial
0Workaround
0Vendor: no patch
24Unknown
Latest vulnerabilities
7.2
CVE-2026-107823
MariaDB: privilege escalation via incorrect view frm parsing
M
Patch status unknownEPSS %0
6.4
CVE-2026-107822
MariaDB: database privilege escalation via user / role name collision in the acl cache
M
Patch status unknownEPSS %0
8.0
CVE-2026-107821
MariaDB: insufficient validation of binary frm data when opening a table
M
Patch status unknownEPSS %0
5.9
CVE-2026-107819
MariaDB Connector/C: libmariadb allowed cleartext password leakage on TLS hostname verification failure
M
Patch status unknownEPSS %0
8.4
CVE-2026-107818
MariaDB: environment injection via wsrep bootstrap in the mariadb.service file
M
Patch status unknownEPSS %0
4.4
CVE-2026-107817
MariaDB: mysql_json plugin OOB reads
M
Patch status unknownEPSS %0
6.4
CVE-2026-107816
MariaDB: `qc_info` plugin can do OOB reads if query contains \0
M
Patch status unknownEPSS %0
8.5
CVE-2026-107815
MariaDB: one byte OOB write in DOS tables of the CONNECT engine
M
Patch status unknownEPSS %1
8.4
CVE-2026-107814
MariaDB: Insecure $HOME in MariaDB rpm packages
M
Patch status unknownEPSS %0
7.4
CVE-2026-107385
MariaDB Connector/Node.js: SQL injection in the text protocol when the session uses NO_BACKSLASH_ESCAPES
M
Patch status unknownEPSS %0