Skip to content
Noroxi

MariaDB records

434 published records for vendor MariaDB. 0 of them have been exploited in the wild (listed in CISA KEV) and 5 have a ready-made attack tool.

Filter by product ↓

Researcher profile

Entered KEV
0 · 0%
Weaponized
5 · 1.2%
Pre-auth RCE
8
With a fix record
92.6%
Median publish → KEV
No record has entered KEV

Pre-auth RCE: flaws that let an attacker run code over the network without an account. Median publish → KEV: the typical time between a record being published and CISA listing it as exploited.

Records by year

  1. 16
  2. 17
  3. 18
  4. 19
  5. 20
  6. 21
  7. 22
  8. 23
  9. 24
  10. 25
  11. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

Bug bounty scope

The product’s vendor appears in a public program. Matched by name; verify the scope text in the program.

All records

434 records
  • CVE-2014-0224
    60This week

    OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, whi

    HighCVSS 7.4WeaponizedEPSS 95%

    openssl · opensslJun 5, 2014

  • CVE-2016-6662
    59Plan

    Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.27, and 10.1.x before

    CriticalCVSS 9.8Proof of conceptEPSS 67%

    oracle · mysqlSep 20, 2016

  • CVE-2014-0195
    57Plan

    The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properl

    MediumCVSS 6.8WeaponizedEPSS 99%

    openssl · opensslJun 5, 2014

  • CVE-2022-0778
    52Plan

    Infinite loop in BN_mod_sqrt() reachable when parsing certificates

    HighCVSS 7.5Proof of conceptEPSS 73%

    openssl · opensslMar 15, 2022

  • CVE-2009-4484
    51Plan

    Multiple stack-based buffer overflows in the CertDecoder::GetName function in src/asn.cpp in TaoCrypt in yaSSL before 1.9.9, as used in mysq

    HighCVSS 7.5WeaponizedEPSS 69%

    oracle · mysqlDec 30, 2009

  • CVE-2012-2122
    49Plan

    sql/password.c in Oracle MySQL 5.1.x before 5.1.63, 5.5.x before 5.5.24, and 5.6.x before 5.6.6, and MariaDB 5.1.x before 5.1.62, 5.2.x befo

    MediumCVSS 5.1WeaponizedEPSS 96%

    oracle · mysqlJun 26, 2012

  • CVE-2018-25032
    46Plan

    zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.

    HighCVSS 7.5Proof of conceptEPSS 51%

    zlib · zlibMar 25, 2022

  • CVE-2014-0221
    43Plan

    The dtls1_get_message_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote a

    MediumCVSS 4.3Proof of conceptEPSS 87%

    openssl · opensslJun 5, 2014

  • CVE-2014-3470
    43Plan

    The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h, when an ano

    MediumCVSS 4.3No exploitEPSS 85%

    openssl · opensslJun 5, 2014

  • CVE-2016-9843
    41Plan

    The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big

    CriticalCVSS 9.8No exploitEPSS 5%

    zlib · zlibMay 23, 2017

  • CVE-2012-2750
    41Plan

    Unspecified vulnerability in MySQL 5.5.x before 5.5.23 has unknown impact and attack vectors related to a "Security Fix", aka Bug #59533.

    CriticalCVSS 10.0No exploitEPSS 3%

    oracle · mysqlAug 16, 2012

  • CVE-2012-5613
    40Plan

    MySQL 5.5.19 and possibly other versions, and MariaDB 5.5.28a and possibly other versions, when configured to assign the FILE privilege to u

    MediumCVSS 6.0WeaponizedEPSS 31%

    mariadb · mariadbDec 3, 2012

  • CVE-2023-26785
    40Plan

    MariaDB v10.5 was discovered to contain a remote code execution (RCE) vulnerability via UDF Code in a Shared Object File, followed by a "cre

    CriticalCVSS 9.8No exploitEPSS 2%

    mariadb · mariadbOct 17, 2024

  • CVE-2021-27928
    39Monitor

    A remote code execution issue was discovered in MariaDB 10.2 before 10.2.37, 10.3 before 10.3.28, 10.4 before 10.4.18, and 10.5 before 10.5.

    HighCVSS 7.2Proof of conceptEPSS 38%

    mariadb · mariadbMar 18, 2021

  • CVE-2026-49261
    39Monitor

    MariaDB server has unsafe parameter handling in `wsrep_notify_cmd`

    CriticalCVSS 9.8No exploitEPSS 1%

    mariadb · mariadbJun 11, 2026

  • CVE-2026-92262
    39Monitor

    MariaDB: Numerous issues caused by historical #mysql50# tablename encoding bypass.

    CriticalCVSS 9.9Proof of conceptEPSS 1%

    mariadb · mariadbOct 16, 2026

  • CVE-2026-85748
    39Monitor

    MariaDB: Use-after-free with a large number of SYS_REFCURSOR's

    CriticalCVSS 9.9No exploitEPSS 1%

    mariadb · mariadbOct 16, 2026

  • CVE-2026-85746
    39Monitor

    MariaDB: Out-of-bound buffer write on in `ST_AsText` of nested GeometryCollections

    CriticalCVSS 9.9No exploitEPSS 0%

    mariadb · mariadbOct 16, 2026

  • CVE-2026-32710
    39Monitor

    Heap-based Buffer Overflow in MariaDB

    CriticalCVSS 9.9Proof of conceptEPSS 0%

    mariadb · mariadbMar 20, 2026

  • CVE-2020-15180
    38Monitor

    A flaw was found in the mysql-wsrep component of mariadb.

    CriticalCVSS 9.0No exploitEPSS 5%

    mariadb · mariadbMay 27, 2021

  • CVE-2012-3163
    38Monitor

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.64 and earlier, and 5.5.26 and earlier, allows remote authentica

    CriticalCVSS 9.0No exploitEPSS 5%

    oracle · mysqlOct 16, 2012

  • CVE-2017-15365
    36Monitor

    sql/event_data_objects.cc in MariaDB before 10.1.30 and 10.2.x before 10.2.10 and Percona XtraDB Cluster before 5.6.37-26.21-3 and 5.7.x bef

    HighCVSS 8.8No exploitEPSS 3%

    mariadb · mariadbJan 25, 2018

  • CVE-2020-13249
    36Monitor

    libmariadb/mariadb_lib.c in MariaDB Connector/C before 3.1.8 does not properly validate the content of an OK packet received from a server.

    HighCVSS 8.8No exploitEPSS 2%

    mariadb · connector\/cMay 20, 2020

  • CVE-2026-97380
    35Monitor

    MariaDB: GRANT PROXY with empty password incorrectly checks grantor's privileges

    HighCVSS 8.8No exploitEPSS 1%

    mariadb · mariadbOct 16, 2026

  • CVE-2026-107815
    34Monitor

    MariaDB: one byte OOB write in DOS tables of the CONNECT engine

    HighCVSS 8.5No exploitEPSS 1%

    mariadb · mariadbOct 9, 2026