Databases: vulnerabilities and fixes

MySQL, PostgreSQL, MongoDB, Redis, Oracle, SQL Server and search engines. 254 CVEs tracked.

Databases has 254 tracked vulnerabilities, 21 critical and 2 exploited in the wild (CISA KEV). A fixed release or vendor patch exists for 205. Most recent: 2026-10-24. Highest priority: CVE-2026-9586 (score 97/100).

• CVE-2026-9586 CRITICAL 9.8 EXPLOITED UPGRADE Sangoma Switchvox SQL Injection Vulnerability
• CVE-2019-1068 HIGH 8.8 EXPLOITED DOWNGRADE UPGRADE Microsoft SQL Server Remote Code Execution Vulnerability
• CVE-2026-104252 CRITICAL 9.8 UPGRADE Vitess is a database clustering system for horizontal scaling of MySQL
• CVE-2026-69085 CRITICAL 10.0 SiYuan before v3.7.3 contains a SQL injection vulnerability in the /api/filetree/searchDocs endpoint, where th
• CVE-2026-57517 CRITICAL 9.8 Control Web Panel before 0.9.8.1225 contains a blind SQL injection vulnerability that allows unauthenticated r
• CVE-2026-75854 CRITICAL 9.8 ArcadeDB versions before 26.8.1 contain a missing authentication vulnerability in the Redis wire-protocol plug
• CVE-2023-22974 HIGH 7.5 UPGRADE A Path Traversal in setup.php in OpenEMR < 7.0.0 allows remote unauthenticated users to read arbitrary files b
• CVE-2026-48031 CRITICAL 9.1 go-base is a Go RESTful API Boilerplate template with JWT Authentication, backed by PostgreSQL
• CVE-2022-44566 HIGH 7.5 UPGRADE A denial of service vulnerability present in ActiveRecord's PostgreSQL adapter <7.0.4.1 and <6.1.7.1
• CVE-2026-35052 CRITICAL 9.8 UPGRADE D-Tale is the combination of a Flask back-end and a React front-end to view & analyze Pandas data structures
• CVE-2026-114119 CRITICAL 9.8 Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server administrative pass
• CVE-2026-19001 CRITICAL 9.8 UPGRADE The MongoDB BI Connector ODBC Driver may write outside the bounds of a fixed-size buffer when an application s
• CVE-2026-63106 CRITICAL 9.8 ReadyEcommerce before 4.5.2 contains an unauthenticated SQL injection vulnerability in the product listing API
• CVE-2026-75852 CRITICAL 9.8 ArcadeDB versions before 26.8.1 fail to enforce SASL authentication on data commands in the MongoDB wire-proto
• CVE-2025-34179 HIGH 8.7 NetSupport Manager < 14.12.0001 contains an unauthenticated SQL injection vulnerability in its Connectivity Se
• CVE-2026-53984 CRITICAL 9.1 Ground Station prior to 0.6.0 contains an unauthenticated database-destruction and arbitrary-data-injection vu
• CVE-2026-69259 HIGH 8.8 UPGRADE Flowise is a drag & drop user interface to build a customized large language model flow
• CVE-2026-16503 CRITICAL 9.1 Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all i
• CVE-2026-48242 HIGH 8.1 Open ISES Tickets before 3.44.2 contains hardcoded MySQL database connection credentials (host, username, pass
• CVE-2026-69219 HIGH 8.7 The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with Rabbit
• CVE-2026-69220 HIGH 8.7 The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with Rabbit
• CVE-2026-73500 HIGH 8.7 etcd is a distributed key-value store for the data of a distributed system
• CVE-2026-114087 HIGH 8.1 Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from hosting/docker/
• CVE-2026-34501 HIGH 7.5 UPGRADE Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client. This issue affects
• CVE-2026-34502 HIGH 7.5 UPGRADE Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client This issue affec
• CVE-2026-114509 CRITICAL 9.2 Laravel is a web application framework
• CVE-2026-48616 CRITICAL 9.3 UPGRADE Rocket.Chat versions <8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, 7.13.9, 7.10.13 has an access control vulnerab
• CVE-2026-5423 HIGH 8.2 @neo4j/graphql library versions prior to 7.5.6 fail to verify the authenticity of a client-supplied, pre-decod
• CVE-2026-60314 HIGH 7.5 UPGRADE Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General)
• CVE-2026-60592 HIGH 8.2 UPGRADE Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: NDB Operator)
• CVE-2026-62238 HIGH 8.8 UPGRADE OpenRemote before 1.26.0 contain an authenticated SQL injection vulnerability in the datapoint crosstab export
• CVE-2026-71102 CRITICAL 9.1 UPGRADE Vulnerability in the Portable Clusterware component of Oracle Database Server
• CVE-2026-101679 HIGH 7.5 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs)
• CVE-2026-101768 HIGH 8.1 Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J)
• CVE-2026-101770 HIGH 8.1 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs)
• CVE-2026-101771 HIGH 8.1 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs)
• CVE-2026-101772 HIGH 8.1 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs)
• CVE-2026-101810 HIGH 7.5 Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General)
• CVE-2026-49004 MEDIUM 6.5 The built-in PostgreSQL service on the mobile device suffers from misconfiguration flaws and command injection
• CVE-2026-49221 HIGH 8.8 Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores
• CVE-2026-49228 HIGH 8.8 Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores
• CVE-2026-62246 HIGH 8.5 Kamaji is the Hosted Control Plane Manager for Kubernetes
• CVE-2026-19004 HIGH 8.1 UPGRADE An application using the MongoDB BI Connector ODBC Driver may experience a memory-safety issue when processing
• CVE-2026-19111 HIGH 8.1 Insecure direct object reference in the mongodb_memory, elasticsearch_memory, and mem0_memory tools in Amazon
• CVE-2026-54368 HIGH 8.8 CentreStack before 17.4 contains a SQL injection vulnerability in GladDBFiles.SearchEx() and SearchExUnder() t
• CVE-2026-61211 CRITICAL 9.9 UPGRADE Vulnerability in the RDBMS component of Oracle Database Server
• CVE-2026-9193 CRITICAL 9.9 UPGRADE An improper privilege management vulnerability in the Hadoop integration of Progress MarkLogic Server before 1
• CVE-2026-17346 HIGH 8.8 UPGRADE The fix for CVE-2026-12044 in pgAdmin 4 9.16 hardened qtLiteral and switched sixteen COMMENT ON / pgstattuple
• CVE-2026-19678 HIGH 8.7 A server-side request forgery (SSRF) vulnerability in the unauthenticated form service in version 11.0.14 in o
• CVE-2026-72600 HIGH 7.5 A broken access control vulnerability in Idurar IDURAR ERP CRM 4.1.0 allows unauthenticated remote attackers t
• CVE-2026-101775 HIGH 7.4 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication)
• CVE-2026-13072 HIGH 8.1 UPGRADE When compute mode is enabled on a standalone mongod instance, insufficient validation of externally sourced BS
• CVE-2026-17351 CRITICAL 9.0 UPGRADE The fix for CVE-2026-12045 in pgAdmin 4 9.16 required the LLM-supplied query passed to the AI Assistant's exec
• CVE-2026-18692 HIGH 8.8 UPGRADE DOWNGRADE An issue in MongoDB Server's handling of timeseries bucket lifecycle could allow an authenticated user with wr
• CVE-2026-19002 HIGH 8.1 UPGRADE A missing bounds check when parsing stored procedure parameter metadata in the MongoDB BI Connector ODBC Drive
• CVE-2026-44615 MEDIUM 6.5 UPGRADE Path traversal vulnerability in Apache Zeppelin
• CVE-2026-49224 HIGH 8.3 Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores
• CVE-2026-49226 HIGH 8.3 Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores
• CVE-2026-60317 HIGH 7.4 DOWNGRADE Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Net)
• CVE-2026-60725 HIGH 7.4 UPGRADE Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General)
• CVE-2026-71063 CRITICAL 9.6 UPGRADE Vulnerability in the Portable Clusterware component of Oracle Database Server
• CVE-2026-71064 CRITICAL 9.6 UPGRADE Vulnerability in the Portable Clusterware component of Oracle Database Server
• CVE-2026-101783 HIGH 7.4 Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General)
• CVE-2026-111613 HIGH 7.5 AllData through 0.7.1 contains an unauthenticated JDBC injection vulnerability that allows remote attackers to
• CVE-2026-18697 HIGH 7.5 UPGRADE DOWNGRADE An issue in MongoDB Server's aggregation framework could allow an unauthenticated party to cause a mongos (rou
• CVE-2026-19754 HIGH 8.6 Baserow versions 2.2.0 through 2.3.3 contain an SQL injection vulnerability in the index() formula function
• CVE-2026-48080 HIGH 8.0 OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform
• CVE-2026-63337 HIGH 7.5 The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with Rabbit
• CVE-2026-72775 HIGH 8.8 UPGRADE n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the PostgresTrigger node, wh
• CVE-2026-101781 HIGH 8.8 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication
• CVE-2026-101785 HIGH 8.3 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON)
• CVE-2026-63120 HIGH 8.4 pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores
• CVE-2026-101769 HIGH 7.0 Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General)
• CVE-2026-101786 HIGH 7.2 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer)
• CVE-2026-49225 HIGH 8.3 Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores
• CVE-2026-60586 HIGH 7.7 DOWNGRADE Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J)
• CVE-2026-73618 HIGH 8.3 Budibase Server before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB query execution endpoint
• CVE-2026-91499 HIGH 8.8 Vulnerability in the RDBMS component of Oracle Database Server
• CVE-2026-101774 MEDIUM 6.5 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Pluggable Auth)
• CVE-2026-16551 MEDIUM 6.9 Denial-of-Service in Thinkst Applied Research OpenCanary (MongoDB module) allows Excessive Allocation. This
• CVE-2026-18691 HIGH 8.8 UPGRADE DOWNGRADE An issue in MongoDB Server's intra-cluster connection setup could allow a party with suitable network access t
• CVE-2026-49223 HIGH 7.6 Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores
• CVE-2026-73499 HIGH 7.1 etcd is a distributed key-value store for the data of a distributed system
• CVE-2026-73562 MEDIUM 6.5 Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment
• CVE-2026-101788 MEDIUM 5.9 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Components Servic
• CVE-2026-18655 MEDIUM 6.5 Improper restriction of intended endpoints in the RabbitMQ broker connection tools of the Amazon MQ MCP Server
• CVE-2026-18690 HIGH 8.1 UPGRADE DOWNGRADE An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an
• CVE-2026-19869 HIGH 7.6 @neo4j/graphql from 5.2.0 until the patched versions fails to enforce field-level @authentication rules on roo
• CVE-2026-101796 HIGH 7.5 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication)
• CVE-2026-101797 HIGH 7.5 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client: mysqldump)
• CVE-2026-101803 MEDIUM 6.5 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: XML)
• CVE-2026-114644 MEDIUM 5.9 The MongoDB C# Driver's BSON library contains an uncontrolled resource consumption weakness in its deserializa
• CVE-2026-13059 HIGH 8.1 UPGRADE An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protect
• CVE-2026-47769 MEDIUM 5.3 APIFold reads an OpenAPI 3.x or Swagger 2.x specification and generates a live, production-ready MCP server en
• CVE-2026-63335 MEDIUM 6.3 The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with Rabbit
• CVE-2026-71062 HIGH 8.5 UPGRADE Vulnerability in the RDBMS component of Oracle Database Server
• CVE-2026-101725 MEDIUM 6.5 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: C API)
• CVE-2026-101726 MEDIUM 6.5 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: C API)
• CVE-2026-101728 MEDIUM 6.5 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Pluggable Auth)
• CVE-2026-101733 MEDIUM 6.5 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON)
• CVE-2026-101743 MEDIUM 6.5 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: GIS)
• CVE-2026-101747 MEDIUM 6.5 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB)
• CVE-2026-101748 MEDIUM 6.5 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Security: Audit)
• CVE-2026-101761 MEDIUM 5.9 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Security: Encrypt
• CVE-2026-101778 MEDIUM 6.5 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Components Servic
• CVE-2026-101780 MEDIUM 6.5 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin)
• CVE-2026-101789 MEDIUM 6.5 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer)
• CVE-2026-101794 MEDIUM 6.5 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: XML)
• CVE-2026-101802 MEDIUM 6.5 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Parser)
• CVE-2026-114654 MEDIUM 6.5 A numeric-type conversion flaw in the BSON handling library of the MongoDB C# Driver allows an out-of-range bi
• CVE-2026-13078 HIGH 7.7 UPGRADE A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally
• CVE-2026-49222 HIGH 7.6 Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores
• CVE-2026-49227 HIGH 7.6 Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores
• CVE-2026-50736 HIGH 7.5 UPGRADE The pglogical queue mechanism, used to convey out-of-band commands such as replicated DDL from a publisher to
• CVE-2026-60623 HIGH 7.1 DOWNGRADE Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J)
• CVE-2026-60624 MEDIUM 6.5 DOWNGRADE Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J)
• CVE-2026-71079 MEDIUM 6.5 DOWNGRADE Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/ODBC)
• CVE-2026-71576 HIGH 8.5 A flaw was found in multicluster-global-hub
• CVE-2026-76298 HIGH 8.8 In Splunk Enterprise versions below 10.4.4 and 10.2.8, a user who does not hold the "admin" or "power" Splunk
• CVE-2026-101720 MEDIUM 5.3 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Connection Handli
• CVE-2026-113870 HIGH 8.8 MongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline in
• CVE-2026-115478 HIGH 7.1 obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults
• CVE-2026-13077 HIGH 7.1 UPGRADE A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds
• CVE-2026-50737 HIGH 7.5 UPGRADE When applying replicated changes for a row that is missing one or more columns, pglogical evaluates the affect
• CVE-2024-47091 HIGH 7.8 DOWNGRADE Privilege escalation in the mk_mysql agent plugin on Windows in Checkmk <2.4.0p29, <2.3.0p47, and 2.2.0 (EOL)
• CVE-2026-101773 HIGH 7.1 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication
• CVE-2026-101800 MEDIUM 6.8 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Security: Privile
• CVE-2026-101806 MEDIUM 6.8 Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/ODBC)
• CVE-2026-114648 HIGH 7.6 The MongoDB C# Driver does not neutralize dot and dollar characters in dictionary keys, field names and array-
• CVE-2026-13065 MEDIUM 6.5 UPGRADE A user with read-only privileges is able to craft an aggregation pipeline using the $linearFill window functio
• CVE-2026-13074 MEDIUM 5.3 UPGRADE An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending a specific
• CVE-2026-18688 HIGH 7.1 UPGRADE DOWNGRADE An issue in MongoDB Server's aggregation framework could allow an authenticated user to trigger an out-of-boun
• CVE-2026-18693 HIGH 7.6 UPGRADE DOWNGRADE An issue in MongoDB Server's handling of timeseries collections could allow an authenticated user with write p
• CVE-2026-18694 HIGH 7.1 UPGRADE DOWNGRADE An issue in MongoDB Server's geospatial query processing could allow an authenticated user with write privileg
• CVE-2026-18706 MEDIUM 6.6 UPGRADE DOWNGRADE An issue in MongoDB Server's $graphLookup aggregation stage could allow an authenticated user able to issue ag
• CVE-2026-55442 MEDIUM 5.3 The Goobi viewer is a web application that allows digitised material to be displayed in a web browser
• CVE-2026-55444 MEDIUM 5.3 The Goobi viewer is a web application that allows digitised material to be displayed in a web browser
• CVE-2026-55465 MEDIUM 5.3 The Goobi viewer is a web application that allows digitised material to be displayed in a web browser
• CVE-2026-63263 MEDIUM 6.5 UPGRADE Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Exponential Dat
• CVE-2026-7646 MEDIUM 6.5 UPGRADE IBM Langflow OSS 1.0.0 through 1.10.3 allows users to read arbitrary files from the server filesystem, includi
• CVE-2026-114646 MEDIUM 6.5 A data-validation flaw exists in the BSON handling and binary serialization path of the MongoDB C# Driver
• CVE-2026-13060 MEDIUM 6.5 UPGRADE An authenticated user with limited read privileges may be able to access documents from collections they are n
• CVE-2026-13064 MEDIUM 6.5 UPGRADE Certain query operations involving deeply nested $jsonSchema constructs can trigger disproportionate CPU consu
• CVE-2026-13071 MEDIUM 6.5 UPGRADE An authenticated user with read access can cause the mongod process to be terminated through certain aggregati
• CVE-2026-13075 MEDIUM 6.5 UPGRADE An authenticated user can cause the mongod process to be terminated by the operating system under memory press
• CVE-2026-13076 MEDIUM 6.5 UPGRADE An authenticated user can cause a {{mongod}} process to be terminated by the operating system under memory pre
• CVE-2026-63144 MEDIUM 6.5 UPGRADE Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via a specially crafted search
• CVE-2026-73331 HIGH 7.1 CamaleonCMS 2.9.1 contains an authenticated SQL injection vulnerability that allows authenticated attackers wi
• CVE-2026-73617 HIGH 7.1 Budibase before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB datasource integration where us
• CVE-2026-91503 HIGH 8.1 Vulnerability in the VPD component of Oracle Database Server

FAQ

How do I fix Databases vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Databases being exploited right now?

Yes: 2 Databases CVEs are on the CISA Known Exploited Vulnerabilities list, so patch those first.

Which Databases CVE should I patch first?

CVE-2026-9586 currently ranks highest (97/100): Sangoma Switchvox SQL Injection Vulnerability.

Software in this group

People search for: mysql, postgres, mongodb, redis, database, sql.

← Back to latest CVEs