https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-97380.htmlhttps://patchthecve.com/cve/CVE-2026-97380.htmlTue, 20 Oct 2026 15:31:51 +0000HIGH 8.8: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the GRANT PROXY statement treats an IDENTIFIED clause with an empty password as though authentication were not specified, causing it to check the wrong grantor privhttps://patchthecve.com/cve/CVE-2026-92262.htmlhttps://patchthecve.com/cve/CVE-2026-92262.htmlWed, 21 Oct 2026 03:17:20 +0000CRITICAL 9.9: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the #mysql50# bypass prefix is affected because it allows the #mysql50# prefix to bypass normal table-name filesystem encoding. An attacker can trigger the issue wihttps://patchthecve.com/cve/CVE-2026-86047.htmlhttps://patchthecve.com/cve/CVE-2026-86047.htmlTue, 20 Oct 2026 15:32:39 +0000HIGH 7.7: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump are affected because each does not consistently quote identifiers and values when serializing SQL. A low-privhttps://patchthecve.com/cve/CVE-2026-85985.htmlhttps://patchthecve.com/cve/CVE-2026-85985.htmlTue, 20 Oct 2026 15:32:46 +0000MEDIUM 5.4: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine plugin file-access UDFs json_file(), bson_file(), jfile_make(), bfile_make(), and jbin_file() are affected because each does not enforce FILE prihttps://patchthecve.com/cve/CVE-2026-85748.htmlhttps://patchthecve.com/cve/CVE-2026-85748.htmlTue, 20 Oct 2026 15:32:54 +0000CRITICAL 9.9: MariaDB server is a community developed fork of MySQL server. From 12.3.1 until 12.3.3 and 13.0.2, SYS_REFCURSOR handling is affected because cursor-array reallocation can leave stale references in routine contexts. A low-privileged attacker can open a large number of SYS_REFCURSORs and then fetch ohttps://patchthecve.com/cve/CVE-2026-85746.htmlhttps://patchthecve.com/cve/CVE-2026-85746.htmlTue, 20 Oct 2026 15:33:00 +0000CRITICAL 9.9: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does not account for bythttps://patchthecve.com/cve/CVE-2026-85745.htmlhttps://patchthecve.com/cve/CVE-2026-85745.htmlTue, 20 Oct 2026 15:33:09 +0000MEDIUM 4.3: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_Area reads beyond the allocated buffer when processing invalid WKB for a MultiPolygon because the multi-polygon parser advances past a nested geometry header withttps://patchthecve.com/cve/CVE-2026-107823.htmlhttps://patchthecve.com/cve/CVE-2026-107823.htmlWed, 14 Oct 2026 14:13:32 +0000HIGH 7.2: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the MariaDB view FRM parser did not safely encode embedded newline characters in a username. An account with CREATE USER and CREATE VIEW WITH GRANT OPTION could crehttps://patchthecve.com/cve/CVE-2026-107822.htmlhttps://patchthecve.com/cve/CVE-2026-107822.htmlWed, 14 Oct 2026 14:13:22 +0000MEDIUM 6.4: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. An https://patchthecve.com/cve/CVE-2026-107821.htmlhttps://patchthecve.com/cve/CVE-2026-107821.htmlWed, 14 Oct 2026 14:13:07 +0000HIGH 8.0: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, and field boundaries in FRM metadata while opening binary FRM files. An attacker able to place a crafted https://patchthecve.com/cve/CVE-2026-107818.htmlhttps://patchthecve.com/cve/CVE-2026-107818.htmlWed, 14 Oct 2026 14:12:57 +0000HIGH 8.4: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster during the next service restart. A database user with FILE privilege and a secure-file-priv configuratiohttps://patchthecve.com/cve/CVE-2026-107817.htmlhttps://patchthecve.com/cve/CVE-2026-107817.htmlWed, 14 Oct 2026 14:12:48 +0000MEDIUM 4.4: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mysql_json plugin assumed that imported MySQL tables contained valid MySQL binary JSON data. A specially prepared MySQL table containing invalid JSON data couldhttps://patchthecve.com/cve/CVE-2026-107816.htmlhttps://patchthecve.com/cve/CVE-2026-107816.htmlWed, 14 Oct 2026 14:12:42 +0000MEDIUM 6.4: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc_info plugin could be confused by a query containing embedded null bytes. Reading information_schema.query_cache_info after such a query was cached could accehttps://patchthecve.com/cve/CVE-2026-107815.htmlhttps://patchthecve.com/cve/CVE-2026-107815.htmlWed, 14 Oct 2026 14:12:37 +0000HIGH 8.5: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundary check that permitted a one-byte null write beyond a stack buffer at an attacker-controlled offset. Anhttps://patchthecve.com/cve/CVE-2026-107814.htmlhttps://patchthecve.com/cve/CVE-2026-107814.htmlWed, 14 Oct 2026 14:12:32 +0000HIGH 8.4: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege couhttps://patchthecve.com/cve/CVE-2026-48165.htmlhttps://patchthecve.com/cve/CVE-2026-48165.htmlMon, 26 Oct 2026 11:10:00 +0000HIGH 8.0: MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, a high-privileged MariaDB user could've used wsrep_sst_receive_address or wsrep_sst_donor global system varhttps://patchthecve.com/cve/CVE-2026-48163.htmlhttps://patchthecve.com/cve/CVE-2026-48163.htmlMon, 26 Oct 2026 11:10:00 +0000HIGH 8.0: MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not ahttps://patchthecve.com/cve/CVE-2026-44173.htmlhttps://patchthecve.com/cve/CVE-2026-44173.htmlMon, 26 Oct 2026 11:10:00 +0000MEDIUM 5.0: MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB allowed SELECT ... INTO OUTFILE and SELECT ... INTO DUMPFILE without verifying the FILE privilege ihttps://patchthecve.com/cve/CVE-2026-44172.htmlhttps://patchthecve.com/cve/CVE-2026-44172.htmlMon, 26 Oct 2026 11:10:00 +0000CRITICAL 9.1: MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysql_real_escape_string() and sending it to the database using text protocol and big5 character set was vulnerable to SQL injections,https://patchthecve.com/cve/CVE-2026-44171.htmlhttps://patchthecve.com/cve/CVE-2026-44171.htmlMon, 26 Oct 2026 11:10:00 +0000MEDIUM 6.3: MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, mbstream did not check for /../ in the path when unpacking the archive. A proper backup can never contain shttps://patchthecve.com/cve/CVE-2026-44170.htmlhttps://patchthecve.com/cve/CVE-2026-44170.htmlMon, 26 Oct 2026 11:10:00 +0000CRITICAL 9.8: MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB on WIndows with installed CONNECT engine and enabled REST support interpolated table HTTP attributehttps://patchthecve.com/cve/CVE-2026-44169.htmlhttps://patchthecve.com/cve/CVE-2026-44169.htmlMon, 26 Oct 2026 11:10:00 +0000MEDIUM 4.3: MariaDB server is a community developed fork of MySQL server. From versions 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, a user getting EXECUTE access to a stored routine via a role, could see the routine definition even without SHOW CREATE ROUTINE privilege. This issue has been pahttps://patchthecve.com/cve/CVE-2026-44168.htmlhttps://patchthecve.com/cve/CVE-2026-44168.htmlMon, 26 Oct 2026 11:10:00 +0000HIGH 8.0: MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not ahttps://patchthecve.com/cve/CVE-2026-49261.htmlhttps://patchthecve.com/cve/CVE-2026-49261.htmlMon, 26 Oct 2026 11:10:00 +0000CRITICAL 10.0: MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with `wsrep_notify_cmd` enabled would execute shell commands embedded in the name of the joiner node. This is fixed in 1