MySQL vulnerabilities and fixes

CVEs that mention MySQL, ranked by priority. 87 tracked.

MySQL has 87 tracked vulnerabilities, 4 critical. A fixed release or vendor patch exists for 69. Most recent: 2026-10-21. Highest priority: CVE-2026-104252 (score 64/100).

• CVE-2026-104252 CRITICAL 9.8 UPGRADE Vitess is a database clustering system for horizontal scaling of MySQL
• CVE-2026-57517 CRITICAL 9.8 Control Web Panel before 0.9.8.1225 contains a blind SQL injection vulnerability that allows unauthenticated r
• CVE-2023-22974 HIGH 7.5 UPGRADE A Path Traversal in setup.php in OpenEMR < 7.0.0 allows remote unauthenticated users to read arbitrary files b
• CVE-2026-63106 CRITICAL 9.8 ReadyEcommerce before 4.5.2 contains an unauthenticated SQL injection vulnerability in the product listing API
• CVE-2026-48242 HIGH 8.1 Open ISES Tickets before 3.44.2 contains hardcoded MySQL database connection credentials (host, username, pass
• CVE-2026-114509 CRITICAL 9.2 Laravel is a web application framework
• CVE-2026-60314 HIGH 7.5 UPGRADE Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General)
• CVE-2026-60592 HIGH 8.2 UPGRADE Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: NDB Operator)
• CVE-2026-101679 HIGH 7.5 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs)
• CVE-2026-101768 HIGH 8.1 Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J)
• CVE-2026-101770 HIGH 8.1 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs)
• CVE-2026-101771 HIGH 8.1 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs)
• CVE-2026-101772 HIGH 8.1 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs)
• CVE-2026-101810 HIGH 7.5 Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General)
• CVE-2026-101775 HIGH 7.4 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication)
• CVE-2026-60317 HIGH 7.4 DOWNGRADE Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Net)
• CVE-2026-60725 HIGH 7.4 UPGRADE Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General)
• CVE-2026-101783 HIGH 7.4 Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General)
• CVE-2026-111613 HIGH 7.5 AllData through 0.7.1 contains an unauthenticated JDBC injection vulnerability that allows remote attackers to
• CVE-2026-101781 HIGH 8.8 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication
• CVE-2026-101785 HIGH 8.3 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON)
• CVE-2026-101769 HIGH 7.0 Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General)
• CVE-2026-101786 HIGH 7.2 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer)
• CVE-2026-60586 HIGH 7.7 DOWNGRADE Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J)
• CVE-2026-101774 MEDIUM 6.5 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Pluggable Auth)
• CVE-2026-101788 MEDIUM 5.9 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Components Servic
• CVE-2026-101796 HIGH 7.5 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication)
• CVE-2026-101797 HIGH 7.5 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client: mysqldump)
• CVE-2026-101803 MEDIUM 6.5 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: XML)
• CVE-2026-101725 MEDIUM 6.5 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: C API)
• CVE-2026-101726 MEDIUM 6.5 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: C API)
• CVE-2026-101728 MEDIUM 6.5 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Pluggable Auth)
• CVE-2026-101733 MEDIUM 6.5 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON)
• CVE-2026-101743 MEDIUM 6.5 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: GIS)
• CVE-2026-101747 MEDIUM 6.5 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB)
• CVE-2026-101748 MEDIUM 6.5 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Security: Audit)
• CVE-2026-101761 MEDIUM 5.9 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Security: Encrypt
• CVE-2026-101778 MEDIUM 6.5 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Components Servic
• CVE-2026-101780 MEDIUM 6.5 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin)
• CVE-2026-101789 MEDIUM 6.5 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer)
• CVE-2026-101794 MEDIUM 6.5 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: XML)
• CVE-2026-101802 MEDIUM 6.5 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Parser)
• CVE-2026-60623 HIGH 7.1 DOWNGRADE Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J)
• CVE-2026-60624 MEDIUM 6.5 DOWNGRADE Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J)
• CVE-2026-71079 MEDIUM 6.5 DOWNGRADE Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/ODBC)
• CVE-2026-101720 MEDIUM 5.3 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Connection Handli
• CVE-2024-47091 HIGH 7.8 DOWNGRADE Privilege escalation in the mk_mysql agent plugin on Windows in Checkmk <2.4.0p29, <2.3.0p47, and 2.2.0 (EOL)
• CVE-2026-101773 HIGH 7.1 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication
• CVE-2026-101800 MEDIUM 6.8 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Security: Privile
• CVE-2026-101806 MEDIUM 6.8 Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/ODBC)
• CVE-2026-101721 MEDIUM 4.9 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Components Servic
• CVE-2026-101724 MEDIUM 4.9 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB)
• CVE-2026-101727 MEDIUM 4.9 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication)
• CVE-2026-101730 MEDIUM 4.9 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer)
• CVE-2026-101731 MEDIUM 4.9 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer)
• CVE-2026-101732 MEDIUM 4.9 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer)
• CVE-2026-101777 MEDIUM 5.5 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Security: Encrypt
• CVE-2026-101799 MEDIUM 6.5 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication
• CVE-2026-101729 MEDIUM 4.9 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication)
• CVE-2026-101749 MEDIUM 4.9 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Security: Encrypt
• CVE-2026-101750 MEDIUM 4.9 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin)
• CVE-2026-101751 MEDIUM 4.9 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication
• CVE-2026-101756 MEDIUM 4.9 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: GIS)
• CVE-2026-101784 MEDIUM 4.9 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer)
• CVE-2026-101787 MEDIUM 4.9 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer)
• CVE-2026-101798 MEDIUM 4.9 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer)
• CVE-2026-101801 MEDIUM 4.9 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer)
• CVE-2026-61082 MEDIUM 6.5 DOWNGRADE Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J)
• CVE-2026-71084 MEDIUM 6.8 DOWNGRADE Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/ODBC)
• CVE-2025-1218 LOW 3.4 UPGRADE The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still hold
• CVE-2026-101795 MEDIUM 6.7 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Components Servic
• CVE-2026-101755 MEDIUM 5.3 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs)
• CVE-2026-101762 MEDIUM 5.3 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Security: Encrypt
• CVE-2026-62845 MEDIUM 4.7 Kamaji is the Hosted Control Plane Manager for Kubernetes
• CVE-2026-101760 MEDIUM 4.9 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB)
• CVE-2026-101776 MEDIUM 4.9 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication
• CVE-2026-101752 MEDIUM 4.4 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Components Servic
• CVE-2026-101753 MEDIUM 4.4 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: RAPID)
• CVE-2026-101754 MEDIUM 4.4 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs)
• CVE-2026-101766 MEDIUM 4.4 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication)
• CVE-2026-71073 MEDIUM 5.5 DOWNGRADE Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/ODBC)
• CVE-2026-75857 HIGH 7.0 CodeWhale versions >= 0.8.41 and < 0.8.64 contain a vulnerability in the exec_shell_interact (alias exec_inter
• CVE-2026-101722 MEDIUM 4.3 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Connection Handli
• CVE-2026-60569 MEDIUM 5.1 UPGRADE Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: NDB Operator)
• CVE-2026-101779 LOW 2.7 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Telemetry)
• CVE-2026-101804 LOW 2.5 Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/ODBC)
• CVE-2026-90484 HIGH n/a The MySQL client response parser in Apache bRPC dereferences a null pointer when the server peer sends a zero-

FAQ

How do I fix MySQL vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is MySQL being exploited right now?

None of the tracked MySQL CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which MySQL CVE should I patch first?

CVE-2026-104252 currently ranks highest (64/100): Vitess is a database clustering system for horizontal scaling of MySQL.

← Back to latest CVEs